Can you try this: index=* sourcetype ="access_combined" clientip=* | iplocation clientip | bin _time span=1m | stats count AS perMin by _time, Country | bin _time span=1m | stats sum(perMin) AS Total by _time Country | predict Total as prediction algorithm=LLP future_timespan=5 holdback=0 | where prediction!="" AND Total!="" | eval residual = prediction - Total ... View more

@cruzcr, Can you try this please: index=IDX sourcetype=sct | rex field=URL "\*=(?<AirportCode >.*)\*" |lookup airports.csv AirportCode as URL ... View more

@ albinortiz , can you test this | makeresults | eval _raw="AV_DATE=Jan-1-2018"| extract kvdelim="=" OR | makeresults | eval field="AV_DATE=Jan-1-2018" | rex field=field "AV_DATE=(?<field>.*)" ... View more

can you try this: index=_internal | timechart count | eval _time=strftime(_time,"%m/%d") | outputcsv hola ... View more

can you please try by all time in place to 7 days and verifie its FileType not filetype ... View more

@cesarb, are you try by: index abc sourcetype = xyz country="USA" filetype=pdf OR fieltype=txt |stats count by filetype| sort -count 2000 can you share the result of this request please ... View more

@fzfeng, can you try | convert ctime(_time) please, that work for me: index=_internal | timechart span=1d count(eval(log_level=INFO)) as countInfo | convert ctime(_time) | outputcsv tst.csv ... View more

Response with lookup, in settings>lookups add lookup file For example i create the csv file version_servers_mapping.csv with content "servers","versions" "ServerEnv1","10.2.3,10.2.4,10.2.5a" "ServerEnv2","10.2.2" "ServerEnv3","10.2.3,10.2.4,10.2.5a,10.2.2" "ServerEnv4","10.2.3,10.2.4,10.2.5a,10.2.2" And, i used it in the dashboard like: <form> <label>test</label> <fieldset submitButton="false"> <input type="dropdown" token="tokServer" searchWhenChanged="true"> <label>Select Server</label> <fieldForLabel>servers</fieldForLabel> <fieldForValue>servers</fieldForValue> <search> <query> | inputlookup version_servers_mapping.csv | table servers </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="version" searchWhenChanged="true"> <label>Select Version</label> <fieldForLabel>versions</fieldForLabel> <fieldForValue>versions</fieldForValue> <search> <query>| inputlookup version_servers_mapping.csv |search servers="$tokServer$" | makemv delim="," versions| mvexpand versions </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset> </form> ... View more

For lookup, you can find example in this: https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/LookupexampleinSplunkWeb ... View more

@atulod1, can you try this please, <form> <label>test</label> <fieldset submitButton="false"> <input type="dropdown" token="tokServer" searchWhenChanged="true"> <label>Select Server</label> <fieldForLabel>servers</fieldForLabel> <fieldForValue>servers</fieldForValue> <search> <query/> <earliest>-24h@h</earliest> <latest>now</latest> </search> <choice value="ServerEnv1">ServerEnv1</choice> <choice value="ServerEnv2">ServerEnv2</choice> <choice value="ServerEnv3">ServerEnv3</choice> <choice value="ServerEnv4">ServerEnv4</choice> </input> <input type="dropdown" token="version" searchWhenChanged="true"> <label>Select Version</label> <fieldForLabel>field</fieldForLabel> <fieldForValue>field</fieldForValue> <search> <query>| makeresults| eval server="$tokServer$" | eval field=case(server="ServerEnv1","10.2.3,10.2.4,10.2.5a",server="ServerEnv2","10.2.2",server="ServerEnv3" OR server="ServerEnv4","10.2.3,10.2.4,10.2.5a,10.2.2") | makemv delim="," field| mvexpand field </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset> </form> ... View more

So try this | makeresults | eval _raw="{\"field1\": \"value1\", \"field2\": \"value2\", \"field3\": \"value3\", \"field4\": \"{\\\"subfield\\\":\\\"value1\\\",\\\"subfield\\\":\\\"value2\\\"}\", \"field\": \"value\"}" | extract | rex field=field4 "\"subfield\":\s*\"(?<subfield1>[^\"]+)\",\"subfield\":\s*\"(?<subfield2>[^\"]+)" ... View more

@soumyacharya91, can you try this: | makeresults | eval _raw="{\"field1\": \"value1\", \"field2\": \"value2\", \"field3\": \"value3\", \"field4\": \"{\\\"subfield\\\":\\\"value1\\\",\\\"subfield\\\":\\\"value2\\\"}\", \"field\": \"value\"}" | extract | rex field=field4 "\"subfield\":\s*\"(?<subfield1>[^\"]+)\",\"subfield\":\s*\"(?<subfield2>[^\"]+)" ... View more

Hello @alangularte, Can you try this: | rex "totalElapsedTime\^(?<totalElapsedTime>[\d.]*)" max_match=0 For example: | makeresults | eval _raw="2018-04-21 19:57:26,189 INFO - Sat Apr 21 19:57:26 CDT 2018 ID:<48949.1524358646183.0> xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ns=\"http://schemas.dell.com/services/isp/assetheadersearch/03/1.0\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:env=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully\">http://www.w3.org/2001/XMLSchema-instance\"/>^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully null" | rex "totalElapsedTime\^(?<totalElapsedTime>[\d.]*)" max_match=0 ... View more

Can You try this: | makeresults | eval test="road-car,a_road_car-ts,road-bus,a_road_bus-ts" | makemv delim="," test | mvexpand test | rex field=test "(?<test>road[-_][^-]*)" | replace *_* with *-* IN test In your request: <Your_searcg> | rex field=test "(?<test>road[-_][^-]*)" | replace *_* with *-* IN test ... View more

@baoamin, you can try this, you can paste all this request in your sarch bare, index=_internal | timechart span=1h count | eval day=strftime(_time,"%Y-%m-%d") | eventstats max(count) as max by day | where count=max | fields _time, count Try by this to test your request: index=mailog relay=10.204.0.0 | timechart span=1h count | eval day=strftime(_time,"%Y-%m-%d") | eventstats max(count) as max by day | appendcols [search index=mailog relay=10.203.0.0 | timechart span=1h count | eval day=strftime(_time,"%Y-%m-%d") | eventstats max(count) as max by day] ... View more

@sjafferali, you can use trim command to remove space, try this: index="dnr_ecc" jobname="*IC*HV_TREX" | eval runtime = tonumber(trim(total_run_time," ")) | table jobname total_run_time runtime ... View more

Good Observation, I modfied my proposition, can you test please ... View more

Hello, Try this | makeresults | eval field="{\"sid\": \"s1\", \"did\": \"d1\",\"lun\": \"l1\",\"readio\":\"10\",\"iocompletetime\":\"2\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s1\", \"did\": \"d1\",\"lun\": \"l2\",\"readio\":\"50\",\"iocompletetime\":\"10\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s1\", \"did\": \"d1\",\"lun\": \"l3\",\"readio\":\"5\",\"iocompletetime\":\"2\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s1\", \"did\": \"d1\",\"lun\": \"l4\",\"readio\":\"100\",\"iocompletetime\":\"20\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s1\", \"did\": \"d1\",\"lun\": \"l5\",\"readio\":\"1\",\"iocompletetime\":\"1\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s1\", \"did\": \"d1\",\"lun\": \"l6\",\"readio\":\"5\",\"iocompletetime\":\"2\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s2\", \"did\": \"d1\",\"lun\": \"l1\",\"readio\":\"15\",\"iocompletetime\":\"2\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s2\", \"did\": \"d1\",\"lun\": \"l2\",\"readio\":\"10\",\"iocompletetime\":\"2\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s2\", \"did\": \"d1\",\"lun\": \"l3\",\"readio\":\"10\",\"iocompletetime\":\"1\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s2\", \"did\": \"d1\",\"lun\": \"l4\",\"readio\":\"12\",\"iocompletetime\":\"2\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s3\", \"did\": \"d1\",\"lun\": \"l6\",\"readio\":\"19\",\"iocompletetime\":\"3\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s3\", \"did\": \"d1\",\"lun\": \"l7\",\"readio\":\"105\",\"iocompletetime\":\"25\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s3\", \"did\": \"d1\",\"lun\": \"l8\",\"readio\":\"66\",\"iocompletetime\":\"15\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s3\", \"did\": \"d1\",\"lun\": \"l9\",\"readio\":\"80\",\"iocompletetime\":\"20\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s1\", \"did\": \"d2\",\"lun\": \"l1\",\"readio\":\"200\",\"iocompletetime\":\"40\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s1\", \"did\": \"d2\",\"lun\": \"l2\",\"readio\":\"20\",\"iocompletetime\":\"5\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s1\", \"did\": \"d3\",\"lun\": \"l3\",\"readio\":\"25\",\"iocompletetime\":\"5\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s1\", \"did\": \"d3\",\"lun\": \"l4\",\"readio\":\"50\",\"iocompletetime\":\"8\",\"Timestamp\": \"2018-03-24 06:12:53\"};{\"sid\": \"s1\", \"did\": \"d3\",\"lun\": \"l5\",\"readio\":\"70\",\"iocompletetime\":\"6\",\"Timestamp\": \"2018-03-24 06:12:53\"}" | makemv field delim=";" | mvexpand field | rex field=field "\"sid\":\s+\"(?<sid>[^,]*)\",\s+\"did\":\s+\"(?<did>[^,]*)\",\"lun\":\s+\"(?<lun>[^,]*)\"" | rex field=field "\"Timestamp\":\"(?<_time>[^}]*)" | rex field=field "\"readio\":\"(?<readio>[^,]*)\"" | fields sid did lun readio | eval coutBy=sid." ".did." ".lun | eval res = readio / 1 | timechart avg(res) By combination ... View more

Hello, If you try this, | makeresults | eval _raw="{\"runDate\":\"2018-04-18T00:31:46 EDT\",\"dataDate\":\"20180319\",\"jobName\":\"experianCounters\",\"counterList\":[{\"counterName\":\"experian.input.recordCount\",\"counterValue\":[{\"subscriberCount\":1000100,\"distinctSubCount\":1000100}]},{\"counterName\":\"experian.output.recordCount\",\"counterValue\":[{\"subscriberCount\":1000100,\"distinctSubCount\":1000100}]},{\"counterName\":\"experian.output.subscriberCountByAge\",\"counterValue\":[{\"age\":\"\",\"count\":19953},{\"age\":\"18 - 24\",\"count\":30289},{\"age\":\"25 - 34\",\"count\":149793},{\"age\":\"35 - 44\",\"count\":349856},{\"age\":\"45 - 54\",\"count\":250509},{\"age\":\"55 - 64\",\"count\":149719},{\"age\":\"65 - 74\",\"count\":30008},{\"age\":\"75+\",\"count\":19973}]},{\"counterName\":\"experian.output.subscriberCountByGender\",\"counterValue\":[{\"gender\":\"\",\"count\":79725},{\"gender\":\"B\",\"count\":49954},{\"gender\":\"F\",\"count\":419773},{\"gender\":\"M\",\"count\":450648}]},{\"counterName\":\"experian.output.subscriberCountByIncome\",\"counterValue\":[{\"income\":\"\",\"count\":19813},{\"income\":\"$1,000 - $14,999\",\"count\":39982},{\"income\":\"$100,000 - $124,999\",\"count\":100406},{\"income\":\"$125,000 - $149,999\",\"count\":29909},{\"income\":\"$15,000 - $24,999\",\"count\":60021},{\"income\":\"$150,000 - $174,999\",\"count\":20067},{\"income\":\"$175,000 - $199,999\",\"count\":79649},{\"income\":\"$200,000 - $249,999\",\"count\":20042},{\"income\":\"$25,000 - $34,999\",\"count\":80456},{\"income\":\"$35,000 - $49,999\",\"count\":99999},{\"income\":\"$50,000 - $74,999\",\"count\":249983},{\"income\":\"$75,000 - $99,999\",\"count\":199773}]}],\"projectName\":\"RND\",\"releaseVersion\":\"1.4.0.RNN\"}" | rex mode=sed "s/(\"[^,]*\":)(\"\")/\1\"null\"/g" | spath | rename counterList{}.counterValue{}.age as age, counterList{}.counterValue{}.count as count, counterList{}.counterName as counterName, counterList{}.counterValue{}.distinctSubCount as distinctSubCount, counterList{}.counterValue{}.gender as gender, counterList{}.counterValue{}.income as income, counterList{}.counterValue{}.subscriberCount as subscriberCount | eval index=mvrange(0,mvcount(count))| mvexpand index| eval age=mvindex(age,index), count=mvindex(count,index), gender=mvindex(gender,index), income=mvindex(income,index), subscriberCount=mvindex(subscriberCount,index) | table age count gender income subscriberCount ... View more

Try This: <dashboard> <label>Table Formats</label> <row depends="$Hello$"> <panel> <html> <style> #sortIsAProblem tr:nth-child(3) td {background-color: grey;} #sortIsAProblem tr:nth-child(5) td {background-color: grey;} #sortIsAProblem tr:nth-child(6) td {background-color: grey;} #sortIsAProblem tr:nth-child(1) td {background-color: grey;} #sortIsAProblem tr:nth-child(9) td {background-color: grey;} #sortIsAProblem tr:nth-child(10) td {background-color: grey;} #sortIsAProblem tr:nth-child(18) td {background-color: grey;} #sortIsAProblem tr:nth-child(15) td {background-color: grey;} </style> </html> </panel> </row> <row> <panel> <table id="sortIsAProblem"> <search> <query>| makeresults |eval Service="SparkPay Webhook(enterpriseapi-6YS7IojKFla7SBqCPTkGKf4G) : gumbo - f086171f1a504f6984389cd188b9ce98;SparkPay Webhook(enterpriseapi-6YS7IojKFla7SBqCPTkGKf4G) : gumbo - f086171f1a504f6984389cd188b9ce98; NO-NAME(cb52a96eb25041659e889a9fe86408c6) : Account Subscription Inquiry - d6fb47ebc616401fb1684412b95085f0;Dynamic App (using DevEx GW)(03633fda819c4758822d51e541c859f9) : Branded Products Display Contents - 1324a6bd86cb42c3b75325b1c31778a7; ProcessApp(enterpriseapi-1XtCxMbaNNG9m0znInKWjkJl) : Application Fraud - d6ceca902b564e3891f3d17a8955cb59;Partnerships Transactions Summary; NO-NAME(3d543435bea44d498b37ad123a0a93f4) : ///dgw - 3cb2ebdcd846416a958a2a4973317354\";Service Lineage;\"Investment Full Service Accounts;NO-NAME(NONE) : oauth2 - oauth2;SparkPay Webhook(enterpriseapi-6YS7IojKFla7SBqCPTkGKf4G) : private-messagesystems-feedback - 10e30983788d4ed98032dee686403ed4;oauth2;NO-NAME(7b3b7e7ad85e44168d1adeeee8fc900e) : oauth2 - get-token;NO-NAME(NONE) : oauth2 - get-token;taxport-ws;Customer Promotion API - Private;customer-payment-cards_APP(cfd573cd77a54735a5520526baef6f6d) : Customer Promotion API - Private - a75d368234194b26b2a6f44f9519510a;NO-NAME(00bb0a453d3742c5aba74d884d3f9c27) : Credit Offers - edfc0660a37547ca987e592bb087a4e3" | makemv delim=";" Service | mvexpand Service | eval count=20 | sort Service</query> <earliest>0</earliest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard> ... View more

| makeresults | eval _raw="message:Receiving exp from: Long URL /Eex for account(s): 7293,7243BMKTL, 8987,5787JHR" | rex field=_raw "Eex for account(s):\s+(? .*)" | makemv delim="," accounts | mvexpand accounts | rex field=accounts "(?\d+)" ... View more

Yes, its easy this | makeresults | eval _raw="message:Receiving exp from: Long URL /Eex for account(s): 7293,7243BMKTL, 8987,5787JHR" | rex field=_raw "Eex for account\(s\):\s+(?<accounts>.*)" | makemv delim="," accounts | mvexpand accounts | rex field=accounts "(?\d+)" ... View more

Hello, To take a multivalues, you can use makemv and mvexpand command: | makeresults | eval _raw="message:Receiving exp from: Long URL /Eex for account(s): 7293,7243BMKTL, 8987,5787JHR" | rex field=_raw "Eex for account\(s\):\s+(?<accounts>.*)" | makemv delim="," accounts | mvexpand accounts If that'd work please accept the anwser to help another person with some problem ... View more

You can test directly in Splunk, that take only number not texte, copie and past all the request in Search bar ... View more

Hello, You can use a CSV lookup describe in: http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/ConfigureCSVlookups ... View more