index=_internal source=*splunkd_ui_access.log uri="app uri" NOT (user="-") |search sourcetype=splunk_web_access | eval access_time =strftime(_time,"%Y-%d-%m %H:%M") | stats values(USER) by access_time ,user OR index=_internal source=web_access.log /app/ | rex "(?:[^/\n]*/){5}(?P[^/]+)[^/\n]*/(?P\w+\s+)" -----> this is for extracting appname and viewname (please modify this accordingly, not sure why app_name & view_name is not being printed after ?P here) | search app_name!="search" view_name!="search" app_name!="launcher" |search sourcetype=splunk_web_access | eval access_time =strftime(_time,"%Y-%d-%m %H:%M") | table access_time,user,app_name,view_name | rename app_name as "Application Name" view_name AS "Dashboard name" user as User | replace "-" with "No User" in User ... View more

Can you try the below,I think the below should work!! basequery| eval time=strftime(_time, "%Y-%m-%d")| stats count by time,EventCode And select the timerange for the last two days. OR basequery | bin _time span=1d | stats count by _time,EventCode ... View more

Can you try the below? I haven`t tested it though. index=myidx "Box Sales Job:" "Total number of boxes sold" earliest=-7d@d latest=@d | rex field=_raw "Total number of boxes sold:(?.+) for (?.+)" | table BoxType, BoxCount, _time | timechart span=1d sum(BoxCount) As BoxCount by BoxType ... View more

Hi @bollam, Try this run anywhere search.. | makeresults a=1 | eval Information="details-dist-Hyderabad,details-state-Telangana,others-info-testing,details-local-abc,others-testing-info" | append [ makeresults a1=1 |eval Information="details-state-Karnataka,details-dist-Bangalore,others-info-testing,others-testing-info,details-local-xyz" ] |rex max_match=0 field=Information "details-dist-(?P\w+)" |rex max_match=0 field=Information "details-state-(?P\w+)" |rex max_match=0 field=Information "details-local-(?P\w+)" |eval newField="details-dist-".dist.",details-state-".state.",details-local-".local |fields - dist,local,state ... View more