EDIT: Does not work. It does split them by service_desc but doesnt stack the avgs. Close but no cigar. Timechart doesnt allow for multi series unfortunately so you have to jump through a few hoops to get this setup. Basing on the docs the below code should do it sourcetype=service_perfdata service_desc="traffic-dc-asa-fw-*" |rex field=inBandwidth "(?<in_kbps>\d+\.\d+)Kbs" |rex field=outBandwidth "(?<out_kbps>\d+\.\d+)Kbs" |eval in_kbps=in_kbps/1024|eval out_kbps=out_kbps/1024 |stats avg(in_kbps) as AvgIn avg(out_kbps) as AvgOut by _time,service_desc | eval merge="in_kbps out_kbps" | makemv merge | mvexpand merge | eval YAxis=case(merge=="in_kbps", AvgIn,merge=="out_kbps",AvgOut) | eval SeriesName=service_desc+":"+merge | xyseries _time,SeriesName,YAxis ... View more

chart count(name) over date by name useother=f to force all series to be shown. ... View more

.. | stats count(name) by date, name | transpose ... View more

Can you add a sample of your input data and what the output should look like so that we get a better idea what you are trying to achieve. ... View more

index=app_win source=service State=Stopped StartMode (Auto OR Manual) (Name="*IBM*" OR Description="*IBM*" OR DisplayName="*IBM*") | stats count by DisplayName StartMode host Description | rename DisplayName as "Service Name" Try with the or's bracketed. ... View more

Actually he can use a subsearch in the eval statement as long as he is trying to return only 1 record back to eval. He is getting the error message because he has the by name added which then tried to return multiple records to the base query which causes the issue. A join, i thought, would be a simpler solution in this case. ... View more

score source=scores.py latest=-20160m | stats count as previous by name | join name [search score source=scores.py | stats count as current by name] | eval difference = current-previous untested, but the logic should be ok. however this will ignore users which dont have a match in the subquery. If you dont want that, use type=outer on the join command ... View more

Can you change the endin to fields row,_time, src_ip, dest_ip, action, url ... View more

Use the fields command to specify which fields you want to see. Use transaction for grouping events PS: its not a phone number but the time in unix time format. ... View more

index=* action!=blocked dest_ip=< ip's > action!=blocked | dedup src_ip | table _time, src_ip, dest_ip, action, url | streamstats count as row | fields row * ... View more

You can only show percentages along with labels but not the counts <option name="charting.chart.showPercent">true</option> ... View more

Ah sorry, that comment was well before I had my morning coffee so it wasnt very useful. Since it isnt possible to set tokens via eval, it is probably the best to create two additional column in your source dashboard table to create a values for "2015-02-04 00:00:00" and "2015-02-04 00:00:00" and then pass those values to the destination dashboard. You can simply eval et=_time." 00:00:00" | eval lt=_time." 23:59:59" to create two fields which have the required offset and then pass the $row.et$ and $row.lt$ tokens on to the destination dashboard. ... View more

Can you add an example of how you would like the output to look like? The solution provided by MuS would give you the output without any double quotes, but its not really clear if thats what your intention is or if you would like to create a multivalue field with all the different OS's added. ... View more

AFAIK there isnt a straightforward way to achieve that. The only way I can think of is to have a hidden query on the taget dashboard which accepts this row date as a token and then using eval statements to create the 00:00:00 earliest and 23:59:59 time for latest property on the time dropdown. ... View more

Aah.. excellent point. I didn't parse the string before commenting.. Looks like a bug in that case, it seems to ignore the UTC offset in the calculation. You might want to add a tag for bug to see if someone can help. I tried locally with the below code which should have worked but no dice.. | gentimes start=-1 | eval time="1970-01-01T10:00:00+1000" | eval timestamp=strptime(time,"%Y-%m-%dT%H:%M:%S%z") | eval timelocal=strftime(timestamp,"%Y-%m-%dT%H:%M:%S%z")| table time,timestamp,timelocal ... View more

Splunk only processes time beyond the unix epoch event i.e. 1/1/1970 so 1969 and earlier wont work for you ... View more

ADESS_FANALL_(\d{2})(\d{2})20(\d{2}) might help. ... View more

Refer to Dashboard example You will have to define a color for every hour on the X-Axis in the options. ... View more

?form.testtime_tok.earliest=$row._time$&form.testtime_tok.latest=$row._time$ should do the trick. ... View more