You have to provide sample data to be helped. Thanks! ... View more

Use the CLI To add a search peer, run this command from the search head: splunk add search-server ://: -auth : -remoteUsername -remotePassword Note the following: is the URI scheme: "http" or "https". is the host name or IP address of the search peer's host machine. is the management port of the search peer. Use the -auth flag to provide credentials for the search head. Use the -remoteUsername and -remotePassword flags for the credentials for the search peer. The remote credentials must be for an admin-level user on the search peer. For example: splunk add search-server https://192.168.1.1:8089 -auth admin:password -remoteUsername admin -remotePassword passremote You must run this command for each search peer that you want to add. https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/Configuredistributedsearch You can refer to the above link. Hope this help, Thanks ! ... View more

Yes.. Please accept the answer as I gave you the correct SPL to solve your problem.. ... View more

Thanks for your response. What I'm looking for is different. I want a stats count of URL, but I want to group count with this format /shop/buy-family/product/ as one and without that as a single URL. Here is an example: url field data: /fr/shop/buy-phone/LG/v20-%0gsgwwguwfwrwwygswiswosubwbwi-nwsiwuhs/ /Ind/shop/buy-phone/LG/v30-%hxeuteiehiexhi/ /US/shop/buy-phone/Apple/iphone-4s /ch/shop/buy-phone/LG/v60 /us/shop/buy-laptop/Mac/ /pk/shop/buy-laptop/Mac-pro/ /gr/shop/buy-laptop/Samsung/ /shop/browse/user/ /browse/user/laptop/ I want stats to be: /shop/buy-phone/LG/ - 3 /shop/buy-phone/Apple/ - 1 /shop/buy-laptop/Mac/ -1 /shop/buy-laptop/Mac-pro/ -1 /shop/buy-laptop/Samsung/ -1 /shop/browse/user/. - 1 /browse/user/laptop/ - 1 ... View more

I have a similar use case hope this works for you as well. (index=A) |rename A_field_match as B_field_match | fields B_field_match | join B_field_match [ search index=B ] | table A_interesting_field_1 A_interesting_field_2 A_interesting_field_3 A_interesting_field_4 B_interesting_field_1 B_interesting_field_2 B_interesting_field_3 B_interesting_field_4 As you are using two indexes, use give as many filters as possible like source type or source and run it on a small-time range to check the results. Thanks. ... View more

try something like this | your search | rex field=`some_field` "(?<=\/shop)(?<uri>[a-zA-Z-0-9.\/-]+)" | table uri ... View more

Check out this amazing Q&A (and links): https://answers.splunk.com/answers/511894/how-to-use-the-timewrap-command-and-set-an-alert-f.html ... View more

| rex field=mess.uri "^(?.+?)\?" Here is the rex I am using. ... View more

oops, sorry. ... View more

In that case all you need to do is include an extra check to insure that the orderid is in both indices : (index=core a=BuilderService AND "decision.received" "Overrides" NOT "ItemOverrides=()" NOT commitCode=null) OR (index=transaction "mileStoneId"=SESSION_CREATE) OR (index=transaction "mileStoneId"="ORDER_RELEASE") |rename data.Orderid as Orderid, data.webOrderNumber as webOrderNumber |eval CommitCodeAtSessionCreate=if(mileStoneId="SESSION_CREATE",mileStoneId,null()) |eval CommitCodeAtWebOrderRelease=if(mileStoneId="ORDER_RELEASE",mileStoneId,null()) |stats dc(index) as condition values(CommitCodeAtSessionCreate) as CommitCodeAtSessionCreate values(commitCode) as commitCode values(CommitCodeAtWebOrderRelease) as CommitCodeAtWebOrderRelease values(webOrderNumber) as webOrderNumber by Orderid |where condition >1 ... View more

@sandeepmakkena, please let me know if the answer was helpful and if you need further help. ... View more

Hello @sandeepmakkena, please find below the query that results in a table containing the number of partNumber per qty. |makeresults|eval _raw="{ \"app\": { \"foo1\": \"bar1\" }, \"dtm\": \"2019-09-16 11:21:30.780 PDT\", \"logger\": \"transaction.com.WEB_ORDER_CREATE\", \"msg\": { \"data\": { \"cartId\": \"00000000-784f-642d-d000-0000784f142d\", \"casId\": \"a493ff7e-2d87-416c-ba08-0663107e958c\", \"clientSubType\": \"web.common\", \"clientType\": \"web\", \"cosId\": \"80f1a259-7187-4f01-9c85-acd7e054233d\", \"deliveryGroup\": \"SINGLE_ADDRESS\", \"features\": [\"crd\"], \"fraudDecision\": \"NF\", \"lineItems\": [{ \"commitCode\": 0, \"deliveryDate\": \"Wed, Sep 18\", \"deliveryType\": \"STH\", \"partNumber\": \"MRYR2LL/A\", \"product\": \"Phone 64GB Black\", \"qty\": 2, \"resolvedDate\": \"Wed, Sep 18\", \"shipMethodCode\": \"E2\" }, { \"commitCode\": 0, \"deliveryDate\": \"Within 5 days after shipping\", \"deliveryType\": \"STH\", \"partNumber\": \"MRW62ZM/A\", \"product\": \"Phone Case\", \"qty\": 1, \"resolvedDate\": \"In Stock\", \"shipMethodCode\": \"UG\" } ], \"ops.response\": \"SUCCEEDED\", \"orderType\": \"order\", \"payments\": [{ \"foo2\": \"bar2\" }], \"pssId\": \"Wb90d652a55994842b0474288ba0dea76\", \"remoteHost\": \"17.123.345\", \"storeFront\": { \"foo3\": \"bar3\" }, \"webOrderNumber\": \"W12345678\" }, \"headerData\": { \"foo4\": \"bar4\" } } }"|spath |rename msg.data.lineItems{}.partNumber as partNumber msg.data.lineItems{}.qty as qty |table partNumber, qty| eval x=mvzip(partNumber, qty)|table x |mvexpand x | eval x = split(x,",")|eval partNumber = mvindex(x,0)|eval qty=mvindex(x,1)|table partNumber,qty ... View more

Thank you. ... View more

This should get you started. <your search that meets the given condition> | stats values(*) as * by StartId | table StartId, commitCode, sectionID, WebOrderID, Ccode ... View more

Hello @sandeepmakkena, here is the way to go : | makeresults | eval _raw="{\"Items\": [ {\"commitCode\": 2, \"deliveryType\":\"\",\"partNumber\": \"P123\",\"product\": \"3 Wireless Phone\",\"promos\": [ \"Auto dependency\"], \"qty\": 10,\"resolvedDate\": \"04/04/04\", \"shipMethodCode\": \"A8\"}, { \"commitCode\": 2, \"deliveryType\": \"th\", \"partNumber\": \"P345\",\"product\": \"Pen\",\"promos\": [],\"qty\": 1,\"resolvedDate\": \"04/04/04\",\"shipMethodCode\": \"A8\"}]}" | spath | rename Items{}.qty as qty Items{}.product as product | table qty product | eval tmp=mvzip(product,qty) | mvexpand tmp | eval tmp = split(tmp,",") | eval product=mvindex(tmp,0) | eval qty=mvindex(tmp,1) | stats sum(qty) as nb by product ... View more

I think you'll need something like the following <base search> | stats latest(mileStoneId) as mileStoneId, latest(_time) as _time by pddID | eval stash_interval=now()-_time | eval interval_bucket=case(stash_interval<60,"< 1min", stash_interval<180,"1-3min", stash_interval<300,"3-5min",1==1,">5mins")` | stats count by interval_bucket, mileStoneId First, get all the data you need as part of your base search. Then get the latest mileStoneID and _time for each pddID. Assuming that the _time of the event is correct, you could calculate the how long it has been in that state by doing eval stash_interval=now()-_time . Next, you can calculate what interval "bucket" you want to put it in, with eval interval_bucket=case(stash_interval<60,"< 1min", stash_interval<180,"1-3min", stash_interval<300,"3-5min",1==1,">5mins") Once you have that data, you can do a stats count by mileStoneId, interval bucket , and you should end up with the table you are after. Good luck! ... View more

Just use sum(qty) instead of count in your timechart. The count is just for counting number of result. ... View more

I alredy tried that but, the problem is when displaying as chart it is including total in the chart. I just want it to be used for sorting. ... View more

Verify the service names are correct and the field name 'service' is legit. If that all checks out, try this alternative: ... | eval sorter = case(like(service,"CartService"), 1, like(service,"OrderBuildService"), like(service,"CheckoutOfferService"), like(service,"ShippingService"), like(service,"Web_Order_release"), 1==1, "unknown") | stats count values(service) as service by sorter | streamstats window=2 range(count) as dropoff | table service count dropoff ... View more

Hey Sandeepmakkena, I've used the sample data you provided to try explain how you can accomplish this. Copy and paste this into a Splunk instance: | makeresults count=2 | eval _raw = "[2019-07-19 10:13:49,210] package=com.ABCDpay,class=PostingServices,service=ProcessAccountingInstruction,component=CBIS,category=business,code=\"11001\",message=\"Accounting entry posted to core system - SUCCESS\",serviceCallUUID=\"97f5cb97-2bbb-46e1-a6ed-392b2db7fc24\",eventDateTime=\"2019-07-19T14:13:49.210Z\",severity=\"INFO\",eventCode=\"CBIS_11001\",eventName=\"POSTING:SUCCEEDED\",entityType=\"ACCOUNTING_ENTRY\",entityId=\"Fine_B/TID220000063/1/2\",accountIdType=\"BBAN\",Id=\"01234\",supplementaryData=\"{externalReferenceId='24200145',actualDestination='12345678',master='8764433222',originalDestination='0987654321',entryAmount='USD100.00',debitOrCredit='C',valueDate='2019-07-19T00:00:00.000Z',postingDate='2019-07-19T04:00:00.000Z',coreReferenceId='445445',businessReversalFlag=false,duplicateDetectedFlag=false}\"" | table _time _raw | kv | rex field=entryAmount "\'USD(?<Amount>[^\']+)" | rex field=entityId "\/(?<Transaction>TID[^\/]+)" | table _time Transaction Amount | addcoltotals labelfield=_time label=Total Amount I've used to kv command to extract your fields. This should make working with them easier! In order to work with currency, you'll need to remove the "USD" portion from your data. After that, you should be able to work with the values like normal numbers. The addcoltotals command will add up all the numbers in the "Amount" fields, and give you a total. I hope this is what you were trying to accomplish! If it isn't, or if you run into problems, let me know and I'll try to help. ... View more

Tried and was unsuccessful ! 😞 ... View more