You could try extracting the two values separately and converting them like this: | makeresults | eval data="AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1;;; 12-09-2019 10:54:56.422 -0600 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/blah/colddb/rb_1571334106_1571322635_1847_5F548135-B7B7-4205-8618-398BCC7968B1'" | makemv delim=";;;" data | mvexpand data | rex field=data "rb\_(?<latest_epoch>\d+)\_(?<earliest_epoch>\d+)\_" | eval latestEventInBucket=strftime(latest_epoch,"%m/%d/%y %H:%M:%S") | eval earliestEventInBucket=strftime(earliest_epoch,"%m/%d/%y %H:%M:%S") ... View more

Use quotations marks around it (See below). Also think about the time range you're searching, there might not be results for that ip in your time range. Also, check out this Search Tutorial for more useful tips: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchTutorial/WelcometotheSearchTutorial index=* "10.5.5.5" ... View more

Hi. I tried to solve this with some of the data I have in my lab. You could try using sub-searches and appending the results to the outer search. First, sub-search does a timechart with a span of 5 minutes for the pageName field. The second sub-search does the average for responseTime by _time (like your original search). And lastly the outer search takes care of the responseCode field with the codes you specified, also a timechart with span=5m. The results for the two sub-searches get appended to the results for the outer search. index="webprod" sourcetype=json_auto_timestamp serviceName="/api/more/auth" AND (responseCode=422 OR responseCode=500 OR responseCode=503 OR responseCode=504) | fields responseCode | timechart count(responseCode) span=5m by responseCode | appendcols [search index="webprod" sourcetype=json_auto_timestamp serviceName="/api/more/auth" AND (pageName="Error : API Failure" OR pageName="Device : Device Wall") | fields pageName | timechart span=5m count(pageName) by pageName] | appendcols [search index="webprod" sourcetype=json_auto_timestamp serviceName="/api/more/auth" | fields responseTime | bin _time span=5m | stats avg(responseTime) as RspTimeAvg by _time] ... View more

Splunk should be automatically extracting all those field for you because of the "=" delim? I just tested the two lines you sent and everything was extracted automatically. Either way, the rex command would be something like this: <your search> | rex field=_raw "\burl\b\=(?<url>[^ ]+)\s" ... View more

You can try converting it to epoch first then converting it to your desired format: | makeresults | eval time ="Fri Nov 22 03:37:15 UTC 2019" | eval nix= strptime(time , "%a %b %d %H:%M:%S UTC %Y") | eval newTime=strftime(nix, "%Y-%m-%d %H:%M:%S.%6Q") ... View more

Hi. you can try a subsearch to get the results from the previous week and then appending the results to the outer search for the current day. It's difficult not having the actual data but the search below might do the trick. index=abc source=item_count earliest=@d latest=now |dedup item |table item,count |sort item | rename count as TodayCount |appendcols [search index=abc source=item_count earliest=-7d@d latest=-6d@d |dedup item |table item,count |sort item | rename count as lastWeekCount | fields lastWeekCount] ... View more