Hi @imheejin , If you want to exclude all of those values that only exist today, then you can do something like this:   index=sec_sso sourcetype=sso_insa earliest=-1d@d | bin span=1d _time | eval Day=if(_time<relative_time(now(), "@d"), "Yesterday", "Today") | eventstats dc(_time) as count by EMINO DPRTM_NAME | search NOT (count=1 Day="Today") | table EMINO DPRTM_NAME Day   ... View more

Hi @ebs, Can you expand that search either with Ctrl+Shift+E (Cmd+Shift+E on Mac) or by going to the Job Inspector, scroll down to search properties, and locate the field eventSearch? Then paste any of those expanded searches in here. There must be something in your expanded search that is not working.   Thanks, J     ... View more

Hi, can you post a data sample. I still think the previous lines with that stats and dedup are causing the problem. Just run something like this and post a few lines if possible: ((index=71412-cli sourcetype=show_interface) OR (index=71412-np sourcetype=device_details)) deviceName ="BLV2-TI-SW_WAS18-01" | table deviceId interface deviceName adminStatus   ... View more

Hi @priyastalin, You could do something like this (not tested by the way): (index=71412-cli sourcetype=show_interface) OR (index=71412-np sourcetype=device_details) | stats values(*) as * by deviceId | search deviceName ="BLV2-TI-SW_WAS18-01" | dedup interface | table deviceId interface deviceName adminStatus | sort interface | stats count(interface) as "Total no of ports" count(eval(if(adminStatus="down", interface, null()))) as "Down ports" | eval percDownPorts = ('Down ports' /' Total no of ports' )* 100   Keep an eye on that previous stats and dedup you are performing though and ensure that is not removing valid events for your totals calculations.   Regards, J ... View more

Hi @msrama5, any news on this topic? Can we close it?   ... View more

Hi @msrama5, did you have any chance to review this? If so, did it work for you so that we can close this topic?   Thanks, J ... View more

Hi @msrama5,  Based on the queries you pasted above you could do something like: | union [| search earliest=-3d latest=-2d index=_* OR index=* sourcetype=OPENAPI_STARS_LOGS "Processing AwardStarsRequest complete" *prmen* | fields Star_TranID | rename Star_TranID as starid | eval query=1] [ | search earliest =-4d environment=test8 sourcetype=FEI_Utility Level=Information messagetype=transaction SessionM | eval MessageTemplate=replace(MessageTemplate,"\\\\\"","\"") | spath MessageTemplate | mvexpand MessageTemplate | rex field=MessageTemplate "message\":\"(?<msg>.*)" | search msg="*" | eval _raw=replace(msg,"\\\\\"","\"") | spath | table transaction.sourceTransactionId | rename transaction.sourceTransactionId as starid | eval query=2] [| search earliest =-4d environment=test8 sourcetype=FEI_Utility Level=Information *prmen* messagetype=accrual | spath MessageTemplate | mvexpand MessageTemplate | rex field=field3 "message\":\"(?<msg>.*)" | search msg="*" | eval _raw=replace(msg,"\\\\\"","\"") | spath | table "accrual.sourceTransactionId" | rename "accrual.sourceTransactionId" as starid | eval query=3] | stats values(query) as values, dc(query) as dc by starid | where dc=1 AND values=1   All I did was to merge your queries and run them with union, then last two lines read as: - Group by starid and show me the different values for query (1, 2, 3) and the distinct count of query. - If the distinct count of query is 1 and the value is 1, that particular starid is only present on query 1. You can easily replace that last line to match your logic   Keep in mind I am not reviewing the rest of the code, as all those spath and mvexpand in there could be problematic if the number of events is large. If your time range was the same in all your queries you could avoid the union command and just search across the 3 datasets with the first line, which should be faster to run and won't hit any limits.   ... View more

Hi, I think Monday is correct too. Look: ... View more

Ok, based on what you described I would do something like (PLEASE DOUBLE CHECK THE SYNTAX):   | eval start=strptime(reported_time,"%b %d %Y %H:%M:%S") | eval end=strptime(processed_time,"%b %d %Y %H:%M:%S") | eval startAt1pm = relative_time(start, "@d+13h") | eval endAt1am = relative_time(end, "@d+1h") | eval newStart = if(start > startAt1pm, start, startAt1pm) | eval newEnd = if(end < endAt1am, end, endAt1am) | eval durationInSecs = newEnd - newStart | eval durationHours = floor(durationInSecs/3600) | eval durationMins = floor((durationInSecs - (durationHours*3600))/60) | eval durationString = if(durationHours<10, "0" . toString(durationHours), toString(durationHours)) . ":" . if(durationMins<10, "0" . toString(durationMins), toString(durationMins)) | stats first(durationString) as durationString by ticket, reported_time, processed_time     If you also need seconds you can proceed with the same logic and build that into the durationString. Let me know if that works. ... View more

Ok, so assuming I understood your question correctly, this is what I would do: | eval start=strptime(reported_time,"%b %d %Y %H:%M:%S") | eval end=strptime(processed_time,"%b %d %Y %H:%M:%S") | eval startAt1pm = relative_time(start, "@d+13h") | eval newStart = if(start > startAt1pm, start, startAt1pm) | eval durationInHours = round((end - newStart)/3600) | stats first(durationInHours) asdurationInHours by ticket, reported_time, processed_time Lines 3 to 5 are basically creating a new time field rounded to 1pm, if the actual start time is greater than 1pm then use it, otherwise use the one that starts at 1pm. Then calculate the difference in seconds between the new start and end and round it to the hour.   Let me know if that works. It should also be a lot faster than the solution I proposed in 2016 for your particular use case. ... View more

Hi @Wheresmydata ,   First of all thank you for referencing one of my answers from ages ago. I probably need to review what I did first ha ha. In any case, while I'm reviewing your question, could edit the post and format the table accordingly as it is very hard to read otherwise?   Thanks, J ... View more

Hi @priyaramki16 ,   I made a typo on my answer as I didn't have a lab to check my syntax. See the answer above again. By the way, make sure your sort is working fine as there seems to be a trailing space in your query between "Calendar" and "Week" ... View more

Hi @shashank_24 , have you tried with append instead of appendpipe?   https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Appendpipe https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Append     ... View more

Hi @nesa246, sorry but I don't fully understand your last question. Could you try to reformat your code and tables and perhaps provide an example of what you are expecting VS what you are seeing? Thanks, J ... View more

Sorry what didn't get anything parsed? This? | makemv delim="\\\\n" yourfield What's your fieldname? Is it _raw? If so then use it like: | makemv delim="\\\\n" _raw You can also extract our JSON fields first with spath, as in the second screenshot, and then use makemv against the one containing the new lines (log in this case). In any case, it always helps if you paste query here. ... View more

Hmm, that's interesting. I have tested both your samples on regex101 and my regex works fine with them. Look: https://regex101.com/r/cjjSHZ/1 ... View more

Sure, good luck. By the way, do not forget accept the answer if it solved your problem so that others can benefit from it in the future. If not, please post what your remaining issue is and we'll try to help. Regards, J ... View more

Hi @mehrdad_2000, If you just want whatever is between square brackets but ensuring it only contains letters and not numbers, you can do something like: | rex max_match=1 "^\d{4}\-\d{2}\-\d{2} \d{2}:\d{2}:\d{2}\,\d{3} \w+ [\w\-\.]+ \[(?<myField>[a-zA-Z]+)\]" For instance, if I use your sample data: ... View more

Then you could do something like: | inputcsv test.csv | sort limit=0 time | streamstats reset_on_change=t count(eval(available="time_out")) as time_out_count by available | sort limit=0 - time | streamstats window=3 reset_on_change=t max(time_out_count) as time_out_max by available | eval isFailure = if(time_out_max >= 3, 1, 0) | stats count as total_count count(eval(isFailure=1)) as failure_count by DATABASE_NAME | eval success_count = total_count - failure_count | eval percentage=(success_count/(success_count+failure_count))*100 Or whichever filter expression you want to include within the stats eval. ... View more