Please check if your data is not throttled at the source, what i mean by that is the event might have happened 2 minutes back but since it could not be indexed at the right time, your alert search didnt find it at that time because it was never indexed. But when you run the alert search you could have seen more number of events because by that time it was already indexed. Splunk finds _time from the events itself. Lets say the event happened at 10:00 AM and was written to the log file with the same time stamp, but due to some issues on the forwarder or network it didnt reach the indexer you Alert trigger will not find it in last 5 minutes data set. Then lets say at 10:06 that event made it to the indexer, so it will be backfiled in the indexer as it finds _time as 10:00 AM . Hope you got what i am trying to say. Check the difference in _time and _index_time to see if there is any lag. if yes then that is the issue. Because if both SNOW and lookup are not getting the events, then chances are likely that your index didnt get it on time. ... View more

Can you paste some sample events here ? I do similar thing in my env, calculating the difference between two similar events. I can help you with this one. ... View more

Your line 4 is a problem, You need to split the Account_Name in order to use the mvindex . I tried with a dummy data set. Let me know if it works. | makeresults | eval EventCode="4624 4634" | eval host=host1 | makemv delim=" " EventCode | mvexpand EventCode | eval Account_Name="Agustina.Sanabria" | regex Account_Name!=".*\$" | eval day=strftime(_time,"%d/%m/%Y") | eval User=if(EventCode="4624",mvindex(split(Account_Name,"."),1),Account_Name) | stats earliest(_time) as PrimerLogin, latest(_time) as UltimoLogoff by User EventCode day host | eval PrimerLogin=strftime(PrimerLogin,"%d/%m/%Y %H.%M.%S"), UltimoLogoff=strftime(UltimoLogoff,"%d/%m/%Y %H.%M.%S") | sort User ... View more

Do you need average response time by a field in the events or average of all response times in entire data set ? because if you ultimately require table of raw data(json) and average response time then it should be by some field in your events. You can do like this : your base search | rex "response_Time\=\"(?<response_time>\d+)\"" | table _raw response_time | eventstats avg(response_time) as average You can add any field after the by clause. Let me know if it works, i can help further. ... View more

Can you show the trigger search that you already have, i do the similar stuff in our environment. The logic is to mark each event after timechart as greater than 5 or not . and then finally calculating the number of events where you have yes. Below is the sample search, let us know if it works for you. I can help further. | makeresults count=10 | eval count=1 | timechart span=5m count | eval server_count_gt_1=if(count>5,"Yes","No") | timechart span=10m count(eval(server_count_gt_1="Yes")) as count_more_than2 ... View more

The idea here is to append the additional result set you have, Here is the sample search which is in line with what others have mentioned : | makeresults | eval DATA="1.10 5 0,1.11 1 3,1.9 0 2" | makemv DATA delim="," | mvexpand DATA | eval Version=mvindex(split(DATA," "),0) | eval P1=mvindex(split(DATA," "),1) | eval P2=mvindex(split(DATA," "),2) | append [| makeresults | eval DATA="1.12 0 0 0" | makemv DATA delim=" " | eval Version=mvindex(DATA,0) | eval P1=mvindex(DATA,1) | eval P2=mvindex(DATA,2) ] | fields - DATA ... View more

As per @FrankVl , you have to capture the named groups in the regex. Looks like you are not doing it. And test your regex at www.regex101.com , its a great site. ... View more

If you already have the criteria then you can simple apply that and exclude from your search results and then calculate the total using addtotals like this. base search | search field!="Criteria" | addtotals col=t labelfield=change_name label=ALL ... View more

What is the criteria of ignoring the row from calculating the total ? when you say to ignore % row, do you mean to exclude the nth row from the calculation ? ... View more

Can you accept the answer if it worked for you ? ... View more

try this : | makeresults | eval Date="4/2/2018" | eval timestamp=strftime(strptime(Date, "%m/%d/%Y"),"%m/%d/%Y") | eval _time=timestamp ... View more

you missed the by clause in your stats command. ... View more

Then you can write another regex on Name to separate names or use splunk makemv delim="," Name kind of command set. ... View more

That might be because you didnt put your lookup. I tested this in my environment and it worked like a charm. ... View more

As stated below you will have to use the transaction command , if you can post any sample data apart from the above screenshot , we can help more. streamstats can also be helpful but i am not sure yet. ... View more

Replace the search above table command with your main search. ... View more

Try this : | makeresults | eval Text="a,purchase,25" | eval index=mvindex(split(Text,","),0) | eval type=mvindex(split(Text,","),1) | eval productid=mvindex(split(Text,","),2) | table _time productid type index | map search="| inputlookup yourlookup.csv where ProductStart< "$productid$" AND ProductEnd > "$productid$"" ... View more

Below is the search i created taking dummy data as per your requirement : | makeresults | eval Text="X:2018-11-01:NULL:NULL,Y:NULL:2018-11-03:2018-12-02,Z:NULL:2018-12-05:NULL,W:NULL:NULL:2018-12-10" | makemv Text delim="," | mvexpand Text | eval field_Name=mvindex(split(Text,":"),0) | rex field=Text "(X|Y|Z|W)\:(?<date>.*)" | makemv date delim=":" | mvexpand date | table _time date field_Name | eval Month=strptime(date,"%Y-%m-%d") | eval Month=strftime(Month,"%b") | fillnull Month value=0 | chart count(field_Name) as count over Month by field_Name | search Month!=0 Let us know if it works. ... View more

Based on your data, i created a dummy search which might be useful to you: | makeresults | eval Text="User-name=JG,srcIP=10.0.0.1:User-name=JG,file=jg.docx:User-name=JG,dstIP=10.1.1.0:User-name=JG,[email protected]:User-name=AB,srcIP=10.0.0.2:User-name=AB,file=AB.docx:User-name=AB,dstIP=10.2.2.0:User-name=AB,[email protected]" | makemv Text delim=":" | mvexpand Text | makemv Text delim=" " | eval Username=mvindex(split(Text,","),0) | eval field2=mvindex(split(Text,","),1) | table _time Username field2 | makemv Username delim="=" | eval Username=mvindex(Username,1) | makemv field2 delim="=" | eval fieldname=mvindex(field2,0) | eval fieldvalue=mvindex(field2,1) | table _time Username fieldname fieldvalue | chart values(fieldvalue) over Username by fieldname ... View more

question: why you are deduping at the end ? ... View more

Try this search, replace the base search as per your data : | makeresults | eval Data="testName:MobileExp,experience:FetchOn;testName:MobileExp,experience:FetchOff;testName:ProductDesign,experience:A;testName:ProductDesign,experience:C;testName:ProductDesign,experience:B;testName:ProductDesign,experience:B" | makemv delim=";" Data | mvexpand Data | eval Split1=mvindex(split(Data,","),0) | eval Split2=mvindex(split(Data,","),1) | eval testName=mvindex(split(Split1,":"),1) | eval experience=mvindex(split(Split2,":"),1) | table _time testName experience | eventstats count as test_count by testName experience | eventstats sum(test_count) as Total by testName | eval perc=(test_count/Total*100) ... View more

The logic here is to club similar events ( same host and c_ip ) by _time and then calculate the difference between _time and c_time(previous event's _time) ... View more

First of all you should table your desired fields after the first pipe and then sort ip web_destination and time. To your question about streamstats not taking the current and then how it is getting the previous time, Since you are already calculating last(c_time) by src_ip host . It will look at the last value of c_time in the previous result , thats where your sorting of host and src_ip comes handy. Otherwise last(c_time) will give you wrong results. To help you i am putting the search i use to calculate the time difference between two events coming from the same sources : index=advance_logs sourcetype=advanced_iis | eval ctime=_time | table _time c_ip s_ip host ctime | sort 0 c_ip s_ip host _time | streamstats count AS RecordNumber by c_ip s_ip reset_on_change=true | streamstats current=f last(_time) as LastTime last(RecordNumber) As previousRecord | eval eventchange = if(RecordNumber-previousRecord!=1,"Yes","No") | eval pause=if(eventchange="No",(_time-LastTime),"None") | fillnull pause Value="None" ... View more