One extra nuance, is that if an event has a duration greater than 10 seconds, it will be entirely missing from at least one of your 5second buckets, so you have to somehow avoid it not being counted for that bucket. This sort of thing is fixable by using mvrange() and mvexpand, to fabricate extra copies of the events to fill all the spaces. Skipping to the end, here's a full search that I think will do what you need. Again I'm assuming that you have start_time, end_time, duration and name on each event. Also that start_time and end_time are epochtime values, and duration is measured in seconds. <your search terms> | eval bucket_start=mvrange(start_time,end_time,5) | mvexpand bucket_start | bin bucket_start span=5s | eval duration_correction1=max(bucket_start-start_time,0) | eval duration_correction2=max(end_time-bucket_start-5,0) | eval duration_within_bucket=duration - duration_correction1 - duration_correction2 | stats max(duration_within_bucket) as duration by name Walking through this, we make a field called bucket_start , and use mvrange() to assign it a multivalue value. If start_time were 1002, and end_time were 1018, this would be 1002,1007,1012,1017. Now say for a given event, it has N multivalue values for start_time. We then immediately use mvexpand to turn each of our events into N copies of the event, each with one particular value for start_time. (Weird stuff but useful for a variety of advanced concurrency cases.) Next up, at this point we've created lots of little sets of events, but they're not all aligned on the same 0,5,10,15 fenceposts. So we can use the bin command to round our bucket_start values down to the nearest 5 seconds. The next challenge is that for each of our 5 second buckets, we have to calculate, for that value of name, how much of the total duration was actually in that given 5 second bucket. This is easy to work out on pencil and paper and it amounts to snipping off the components of the duration that fall outside our bucket. The one that falls earlier than our bucket is duration_correction1 and the seconds that fall later than our bucket are in duration_correction2. Once we subtract those off we'll have "duration_within_bucket" that is actually accurate. And then we're on the homestretch cause | stats max(duration_within_bucket) as duration by name will roll it all up and give you what you need. I think. ... View more

Maybe it's not this simple, but how about just coalescing to a common field name, then asking stats to count distinct sourcetypes for each value and restricting to the rows that have 2 sourcetypes? Stats can work across a mix of single-value and multivalue rows so I don't think you need the mvexpand necessarily. It would look like this: index=A OR index=B OR index=C sourcetype=sensorA OR sourcetype=sensorB | eval normalized=coalesce(sensorAFieldA,sensorBFieldB) | stats count dc(sourcetype) as sourcetypes by normalized | search sourcetypes>1 | rename normalized as file_hash the maxspan=1h is interesting, so to incorporate that sort of logic you could do this index=A OR index=B OR index=C sourcetype=sensorA OR sourcetype=sensorB | eval normalized=coalesce(sensorAFieldA,sensorBFieldB) | stats values(_time) as timestamps max(_time) as latest min(_time) as earliest count dc(sourcetype) as sourcetypes by normalized | eval delta=latest-earliest | search sourcetypes>1 delta<3600 | rename normalized as file_hash Although technically if the sensorA values kept flagging a particular file for longer than an hour, and then sensor B only flagged it once, this search would filter that out incorrectly. In which case maybe transaction is the better way to go. index=A OR index=B OR index=C sourcetype=sensorA OR sourcetype=sensorB | eval file_hash=coalesce(sensorAFieldA,sensorBFieldB) | transaction file_hash maxspan=1h | search sourcetype=sensorA sourcetype=sensorB ... View more

EDIT - second time's the charm. index=foo conversion_source=Online OR conversion_source=Offline | bin span=1w _time | chart sum(ABC) AS ABC sum(DEF) AS DEF sum(GHI) AS GHI sum(JKL) AS JKL over _time by conversion_source | untable date type count ... View more

Certainly. The other half of the equation is a URLLoader module on the target view. And there's a docs page in Sideview Utils under Key techniques > Linking from view to view> Linking to other views from tables. If you don't see this page, you may be using the extremely old and out of date 1.3.5 version. (Current version is 3.3.2 and available from the sideview site) That page goes over how to do this and gives a working example that uses the index=_internal data. Here's a dead simple example though, to give you the flavor. In view 1: <module name="Table"> <module name="Redirector"> <param name="url">mySecondView</param> <param name="arg.foo">$foo$</param> </module> </module> View 2: <module name="URLLoader" layoutPanel="panel_row1_col1" autoRun="True"> .. possible other modules downstream from URLLoader but upstream from Pulldown <module name="Pulldown"> <param name="name">foo</param> ... other params ... other modules. ... View more

I would look carefully at how the modules are nested. If a given Table is updating when a TimeRangePicker is changed, in the Sideview XML that means that the Table is downstream from the TimeRangePicker, ie nested within it. It's pretty common for the indentation over the months and years to be slightly off, by virtue of someone adding or removing one or two module tags and not indenting the file to match. This is understandable, as being forced to correctly indent large and heavily nested xml files is arguably a form of torture. Fortunately you can instantly fix and clean up all the indentation in any Sideview XML view by Loading that view in the Sideview Editor, picking a random module to edit, and submitting the edit without changing anything. Granted, if you're an app developer and you keep the views in default, it'll write them to local, but it's still exceptionally useful. ... View more

Say your search right now looks like <your search terms> | stats sparkline count by user which is a nice simple sparkline - just the count of events over time for each user. You can also pull out the peak for each user with some search language. Doing this right will technically require that we specify the granularity, but that's probably not a problem. Here I've used 5minutes as the granularity so you'll probably have to change that to suit. <your search terms> | bin _time span=5min | streamstats count as per_user_count by _time user | sort 0 - user per_user_count | sort 0 - _time | eventstats first(_time) as peakTime max(per_user_count) as peakCount by user | fields - per_user_count | stats sparkline count last(peakCount) as peakCount last(peakTime) as peakTime by user Breaking it down, the bin command rounds all of the timestamps down to the nearest 5 minutes. the streamstats considers the data set separately for each combination of user and _time, and for each such combination, it will count the number of events. Then the sort command will sort first by user, and then within that, by per_user_count, descending. Then there's another sort command to restore the initial time order (this may be unnecessary depending on your use case) . Then an eventstats command considers the data for each user (disregarding _time now), and looking at all of the timebuckets for that user, it gets the sparkline but also the first value seen for peakTime and peakCount. Because of the sorting, these will be the peak count, and the timestamp of the peak count respectively (or at least, the timestamp rounded down to nearest 5 minutes). ... View more

The only N/A I can think of is a longstanding bug in the legacy SingleValue module. Are you still using SingleValue? If so there's a page in the docs under the HTML module specifically about replacing SingleValue. ... View more

Nice work getting the Checkbox to pick up the right checked state from the ValueSetter, and to then use inputlookup + append + stats + outputlookup to write the modified state when each checkbox is clicked. To make your eventLink field value into a working drilldown link, ie a plain old clickable blue link that loads an external webpage, it's actually easy compared to the other advanced stuff here. You just Table-embed an HTML module. ie, if "eventLink" was the field holding your URL values, you would put this just inside the Table module: <module name="HTML" group="row.fields.eventLink"> <param name="html"><![CDATA[ <a href="$row.fields.eventLink$" target="_blank">view details</a> ]]></param> </module> ... View more

Let's say the fields are called "ra_date_fulfilled", "rdrive_date_fulfilled", and "request_date". Important things to know! 1) that depending on your timestamp extraction, the request date may actually already be the "_time" field. 2) Even though "_time" often looks like a formatted string, it is actually an epochtime number (seconds since 1/1/1970), and it's customary appearance in the splunk UI is the UI special casing the field's handling, trying to help you. 3) field names in Splunk can have spaces in them, but in some parts of the platform, those spaces kind of cannot easily go. The eval command is one of those places, so I recommend renaming the fields here, either inline in the search, or better yet, just change the field name you're using in any configured field extractions. The answer: | eval ra_date_fulfilled=strptime(ra_date_fulfilled, "%m/%d/%Y") | eval rdrive_date_fulfilled=strptime(rdrive_date_fulfilled, "%m/%d/%Y") | eval request_date=strptime(request_date, "%m/%d/%Y") | eval fulfill_date=min(ra_date_fulfilled,rdrive_date_fulfilled) | eval duration=fulfill_date - request_date So that will give you your duration field on all the raw events. Let me know if request_date is actually the "_time" field, and I will update my answer for you. ... View more