Looks like an issue with iOS version. I tried with the same scenario using Android App and works perfectly. ... View more

Hi @roym. Same issue here, any update to fix? Thanks! ... View more

Solved! Thanks! ... | eval datePublished=_time | eval datePublished=strftime(datePublished,"%Y/%m/%d %H:%M:%S") | eval dateClosed=_time+duration | eval dateClosed=strftime(dateClosed,"%Y/%m/%d %H:%M:%S") | eval totalFixTime=duration | eval totalFixTime=totalFixTime/(60*60*24) | table ORDERID, datePublished, dateClosed, totalFixTime, eventcount | where eventcount>=2 | fields - eventcount ... View more

Again, fixed: | eval DateTimePublished=strftime(DateTimePublished,"%Y/%m/%d %H:%M:%S") | eval DateTimeAnswered=strftime(DateTimeAnswered,"%Y/%m/%d %H:%M:%S") About your point #5, how i can show Tickets pending (no answered)? Thanks again! ... View more

Hi. Fixed with as Events . Now, my problem is that ... | eval DateTimePublished=strftime(publishedTime,"%Y/%m/%d %H:%M:%S") | eval DateTimeAnswered=strftime(closedTime,"%Y/%m/%d %H:%M:%S") Doesn't format the dates. Other suggestion? ... View more

Thank you! I have an syntax error near to line 2: Error in 'stats' command: The argument 'Events' is invalid. Any idea? ... View more

Great, thanks. Dates and fixtime are in EPOC or seconds, how i can convert to human? ... View more

Anybody? Please help me. ... View more

Thanks @sideview, @niketnilay . I need the join , some context to understand: Each sourcetype has: index=first sourcetype=anysourcetype => Executed tasks index=second sourcetype=othersrc => To execute tasks. Then, the join returns to me the REAL executed tasks with some details about it. The field FIELD1 is originally present at index=second sourcetype=othersrc , so after join, i have the list of REAL executed and the value with states like type1, type2, type3, etc (included in FIELD1 ). I need to show the list of NOT EXECUTED tasks classified by FIELD1 . Thanks! ... View more

Thanks! If my searches are: index=first sourcetype=anysourcetype | join ID [search index=second sourcetype=othersrt] index=second sourcetype=othersrt Any suggestion? ... View more

Works great. if my searches are: index=first sourcetype=anysourcetype | join ID [search index=second sourcetype=othersrt] and index=second sourcetype=othersrt How i can obtain the same calculation? Thanks! ... View more

Thanks. I need something like: index="first" OR index="second" | table EVENTSCOUNTINSOURCETYPEDATA1, field5, field3 ... View more

Thanks for the advice! ... View more

Solved, problem with accents into IP_TYPE strings. ... View more

Thanks. You mean: sourcetype=temp | eval RESULTING_FIELD = case((IP_TYPE1="MODEL NUMBER 1" OR IP_TYPE2="MODEL NUMBER 1" OR IP_TYPE3="MODEL NUMBER 1" OR IP_TYPE4="MODEL NUMBER 1" OR IP_TYPE5="MODEL NUMBER 1") AND IP_KIND="BTT", "SUBTYPE1", (IP_TYPE1="MODEL NUMBER 2" OR IP_TYPE2="MODEL NUMBER 2" OR IP_TYPE3="MODEL NUMBER 2" OR IP_TYPE4="MODEL NUMBER 2" OR IP_TYPE5="MODEL NUMBER 2") AND IP_KIND="CTT", "SUBTYPE2", (IP_TYPE1="MODEL NUMBER 3" OR IP_TYPE2="MODEL NUMBER 3" OR IP_TYPE3="MODEL NUMBER 3" OR IP_TYPE4="MODEL NUMBER 3" OR IP_TYPE5="MODEL NUMBER 3") AND IP_KIND="RTT", "SUBTYPE3", (IP_TYPE1="MODEL NUMBER 4" OR IP_TYPE2="MODEL NUMBER 4" OR IP_TYPE3="MODEL NUMBER 4" OR IP_TYPE4="MODEL NUMBER 4" OR IP_TYPE5="MODEL NUMBER 4") AND IP_KIND="PTT", "SUBTYPE4", true(),"OTHER") My resulting field only shows OTHER, any idea? ... View more

Thanks. I tried with the first option, no luck. 10-25-2016 20:49:12.981 -0500 WARN DateParserVerbose - A possible timestamp match (Sun Feb 16 15:29:36 2003) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::/files/splunk/201610191212/log1|host::Splunk|log1|120 10-25-2016 20:49:12.981 -0500 WARN DateParserVerbose - A possible timestamp match (Sun Jun 2 02:06:31 2002) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::/files/splunk/201610191212/log1|host::Splunk|log1|120 10-25-2016 20:49:12.981 -0500 INFO IndexWriter - idx=cod-analisis Creating hot bucket=hot_v1_12, given event timestamped=1477446552 Using epoc in the folder name is not an option for now 😞 ... View more

I tried with year, month, day and: 10-25-2016 15:43:21.027 -0500 WARN DateParserVerbose - A possible timestamp match (Thu Jun 13 05:47:54 2002) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::/files/splunk/201610151212/log1|host::Splunk|log1|122 10-25-2016 15:43:21.027 -0500 WARN DateParserVerbose - A possible timestamp match (Wed Aug 28 07:14:46 2002) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::/files/splunk/201610151212/log1|host::Splunk|log1|122 10-25-2016 15:43:21.027 -0500 WARN DateParserVerbose - A possible timestamp match (Thu Aug 12 17:16:19 2004) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::/files/splunk/201610151212/log1|host::Splunk|log1|122 10-25-2016 15:43:21.027 -0500 WARN DateParserVerbose - A possible timestamp match (Sat Oct 5 01:54:52 2002) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::/files/splunk/201610151212/log1|host::Splunk|log1|122 10-25-2016 15:43:21.027 -0500 WARN DateParserVerbose - A possible timestamp match (Wed Mar 13 00:20:38 2002) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::/files/splunk/201610151212/log1|host::Splunk|log1|122 10-25-2016 15:43:21.027 -0500 WARN DateParserVerbose - A possible timestamp match (Wed Jan 30 10:23:20 2002) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::/files/splunk/201610151212/log1|host::Splunk|log1|122 10-25-2016 15:43:21.027 -0500 WARN DateParserVerbose - A possible timestamp match (Tue Jan 29 16:15:06 2002) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::/files/splunk/201610151212/log1|host::Splunk|log1|122 The example folder was: /files/splunk/201610151212 My files: <define name="_masheddate3" extract="year, month, day"> <text><![CDATA[(?:^|source::)\/files\/splunk\/(\d{4})(\d{2})(\d{2})\/]]></text> </define> <datePatterns> ... <use name="_masheddate3"/> ... </datePatterns> 😞 ... View more