What exactly are you going to use new_var for because you can export extracted name and number fields directly from the UI as JSON? A hacky way to convert the entire quoted string of names and numbers into JSON is to essentially extract it wholesale and apply several rex commands to shape it into the correct form: Field test : "Name:John"="21","Name:Sam"="29","Name:Jim"="40" Search: | rex field=test mode=sed "s/(\"Name:)|(\")//g" | rex field=test mode=sed "s/=/:/g" | rex field=test mode=sed "s/^/{/" | rex field=test mode=sed "s/$/}/g" Full example: | stats count | eval test="\"Name:John\"=\"21\",\"Name:Sam\"=\"29\",\"Name:Jim\"=\"40\"" | rex field=test mode=sed "s/(\"Name:)|(\")//g" | rex field=test mode=sed "s/=/:/g" | rex field=test mode=sed "s/^/{/" | rex field=test mode=sed "s/$/}/g" Output: {John:21,Sam:29,Jim:40} ... View more

Try this: <search that produces the table above> | eventstats min(TaskID) as min_task min(RequestID) as min_req by Project | where (RequestID=min_req AND TaskID=min_task) | fields - min* ... View more

You'll need an eval-based macro for that. And tonumber() is not the right function, you'll need tostring(). Create a Macro that has the eval-based definition checked (in Advanced Search | Macros) Call it in your search before the first pipe Macro Name: toHex(1) Macro Definition: tostring("\"".tostring($idDecimal$, "hex")."\"") Usage: index=xx sourcetype=xx `toHex(22)` In your form obviously you'd need to substitue 22 above with the userId token. ... View more

One quick way is to add another "| stats count" at the end of that search and alert when count=2 ... View more

Try: ... | eval type=if(match(useragent, ".*bot.*"), "BOT", "NOT")|stats count by type ... View more

This should probably work: | stats count by zipcode gender | eventstats sum(count) as cz by zipcode | sort 20 -cz or the chart version: | stats count by zipcode gender | eventstats sum(count) as cz by zipcode | sort 20 -cz | chart max(count) over zipcode by gender | fillnull value=0 ... View more

Which index is your CloudTrail data going to, aws-cloudtrail or another? If not aws-cloudtrail, then you need to modify macros.conf in Splunk App for AWS to correspond to the right index. ... View more