A simplistic replace might be ok for you - | eval new_Asset_Name = replace(Asset_Name,".ews.int","") ... View more

Like this (as I said in other answer): ... | rex field=Host_Name mode=sed "s/\.[^.]*$//" ... View more

i have outputlookup csv file. which contains Computernames which I want. This is one search which runs everyday at 9AM. I wanted to write another queryw hich looks this csv file and next day when the outputlookup is run, it does not contain sameComputernames from first csv. Eg:Lets say my search query results with 5 computernames....this result is got from today's search which I have exportted to output lookup abc.csv.... Tomorrow the sae query when run at 9AM, I wanted to ensure it would compare the first csv file to check Computernames if present , dont show that in next day search. Second day csv file should only have new Computernames which are not present in first csv. ... View more

I have updated an image along with the query,so that you have a better idea of the query,I want the timediff for each uri for its corresponding request and reponse time ... View more

Take A bow MuS,that was awesome,I have done a small change in the query according to my requirement and it worked..You are the GURU,...Thanks a ton ... View more

I see now, give this a try. your search | rename ENDPOINT_LOG{}.* as * | eval temporal=mvzip(EML_REQUEST_TIME,EML_RESPONSE_TIME,"##") | table temporal | mvexpand temporal | rex field=temporal "(?<EML_REQUEST_TIME>.*)##(?<EML_RESPONSE_TIME>.*)" | eval average_response_time= strptime(EML_REQUEST_TIME , "%Y-%m-%d %H:%M:%S.%3N") - strptime(EML_RESPONSE_TIME , "%Y-%m-%d%H:%M:%S.%3N") | table EML_REQUEST_TIME EML_RESPONSE_TIME average_response_time ... View more

This should've worked. Can you post the query you tried? ... View more

Hi Test the following xml code <dashboard> <label>my_title</label> <row> <panel> <chart> <title>Field colors example</title> <search> <query> ................................................ | chart count(eval(SRC_ID="G")) as ER count(eval(SRC_ID="N")) as WA count(eval(SRC_ID="U")) as INF by SRC_ID </query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="charting.axisY.scale">log</option> <option name="charting.chart">column</option> <option name="charting.fieldColors"> {"G": 0xFF0000, "N": 0xFF9900,"U": 0xFFAAF0} </option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> </dashboard> ... View more

Thanks for the reply somesh...I tried in another way I first gave a table command and then filled the null with zero and just gave the rest of the query ... View more

Thanks vrmandadi, I see that you sent me also points. You could also do it by just vote has left my response ... View more

Thanks richgalloway ... View more

I tried using the same UI sourcetype with CLI ,but it did not work,If you could help me with the sourcetype for CLI that would be great ... View more

Somesh Thank You so much will try this and let you know ... View more

thank You for the quick response but my question is different actually i have two fields request time and initial time request time=2016-01-19 15:44:07.858 +00:00 initial time= 2016-01-19 15:44:07.793 +00:00 I want to get the average time by ( request_time-initial_ time) / 2 ..so 858-793= 65 and 65 divided by 2 is 32.5 ... View more

Your original question did not include how to get the fields; that's really a different question. But you could add this to props.conf TRANSFORMS-ef1=extract_message_fields Then create the transforms.conf file [extract_message_fields] REGEX =^(?m-s)(?<_KEY_1>\w+):(?<_VAL_1>\w+)$ MV_ADD = true CLEAN_KEYS=true This should extract all the fields in the event. However, only the most common fields will show up in the interesting fields list. ... View more

@larmesto want to jump in here? ... View more

in splunk web when you onboard the file you will have option for selecting the sourcetype...i think in web structured section you have _json...if you select that particular type splunk automatically breaks the events ... View more

There's a pretty good answer over here: http://answers.splunk.com/answering/295317/view.html ... View more

Be sure to close out the question by pickimg the answer that you like the best and clicking "Accept". ... View more

will try the above and let you know..thank you so much ... View more

You can create custom dropdown to have just the dates (you can fix some range like like up to last 1 year) for the range and custom fixed Hour dropdown. The complexity will come on how these dropdown values will be used, and that depends upon your queries. Can you post what type of queries you're going to use? ... View more

thank You. ... View more

Agreed, sorry for the typo it should be -- 0 3,15 * * * -- for 3am and 3pm everyday of every month. -- 0 */12 * * * -- which means every 12 hours. ... View more

If your problem is solved, please accept the answer. ... View more

Looks like a filesystem permissions issue. Make sure that that file exists, and that the user splunk is running as can read the file. ... View more