Your data contains multiple timestamps. Let's try to clean up the field a bit:   | eval Sent_At=TRIM(MVINDEX(Sent_At,0)) | eval event_time=strftime((Sent_At/1000),"%m/%d/%Y %H:%M:%S")   ... View more

Here are 2 ways to skin this cat.   | eval combined_state=TRIM(state_A)."-".TRIM(state_B)."-".TRIM(state_C) | eval global_state=IF(combined_state="ok-ok-ok", "done", "issue")   | foreach state_* [| eval combined_state=MVAPPEND(combined_state, TRIM(<<FIELD>>))] | eval combined_state=MVDEDUP(combined_state) | eval global_state=IF(MVCOUNT(combined_state)==1 AND combined_state="ok", "done", "issue") ... View more

Could you post what your current search looks like? ... View more

Splunk assumes the UNIX time value is in seconds and your value is in milliseconds. When this happens, simply divide by 1000.   | makeresults | eval timestamp="1641294227243" | eval event_time=strftime((timestamp/1000),"%m/%d/%Y %H:%M:%S")   ... View more

Try this: MySearch | eval combined=mvzip(mvzip(event, risk, "|"), date, "|") | mvexpand combined | rex field=combined "^(?<date>[^|]*)\|(?<event>[^|]*)\|(?<risk>[^|]*)" | table ip date event risk   If your data contains "|", you can use a different delimiter like ";".   ... View more

Splunk will sort the column name as an ASCII string rather than a number. You can manipulate this behavior by making the hours as 2 digits, 00, 01, 02, etc, or padding single digits with a leading space. In this case, the quick and dirty way is just manually specify the order: | table _time 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23       ... View more

Assuming that the both data sources are indexed around the same time, we can try using streamstats to filter out traceid not found in both sourcetype during say a 1m window. Also you want to optimize the regex throw out non matching events as soon as possible. Did not test but you can try something like this: index=vap (sourcetype=nns_all OR sourcetype=pi_ngxgw_access) ("nationalnavigation.SymphoniWebException: Event Not Found" OR "responseStatus=404") | rex "^\d+[^\[]*\[[^\[]*\[(?<traceId>\-\d+)" | streamstats dc(sourcetype) AS dc_sourcetype by traceId time_window=1m | where dc_sourcetype=2   If you want to keep all the nns_all events: | where dc_sourcetype=2 OR sourcetype="nns_all"   ... View more

Just want to see the size of the resultset we're talking about. Could you run this: index=vap sourcetype=nns_all OR sourcetype=pi_ngxgw_access "nationalnavigation.SymphoniWebException: Event Not Found" OR "responseStatus=404" earliest=-1h@h | stats count as event_count by sourcetype ... View more

Use stats and combine the searches whenever possible since its much more efficient. Here's a possible way to skinning it: (sourcetype="ST1" OR sourcetype="ST2") | fields _time id title _raw | rex field=_raw "^(?<event_id>\d+)\s\"(?<event_type>[^\s]*)\s(?<base_url>[^\?]*)(\?(?<params>[^\"]*))?" | eval id=COALESCE(id, event_id) | stats values(event_id) AS event_id values(base_url) AS base_url values(params) AS params max(title) AS title values(event_type) AS event_type max(_time) AS _time by id | table _time id title event_type base_url params   ... View more

There are probably better ways, here's my stab at it:   | makeresults | eval _raw="event_time=12/01/2021 actionid=actionid1 status=start, event_time=12/02/2021 actionid=actionid2 status=start, event_time=12/06/2021 actionid=actionid1 status=sent, event_time=12/06/2021 actionid=actionid2 status=sent, event_time=12/09/2021 actionid=actionid1 status=done, event_time=12/10/2021 actionid=actionid2 status=done" | eval events=SPLIT(_raw, ",") | mvexpand events | rex field=events "event_time=(?<event_time>[^\s]*)\sactionid=(?<actionid>[^\s]*)\sstatus=(?<status>[^\s]*)" | eval _time=strptime(event_time, "%m/%d/%Y") | bucket _time span=1d | eval epoch_time=_time | append [| makeresults | eval date_range=mvrange(relative_time(now(), "-365d"), relative_time(now(), "-0d"), 86400) | mvexpand date_range | eval _time=date_range | bucket _time span=1d | table _time] | eventstats min(epoch_time) AS start_time max(epoch_time) AS end_time | where _time>=start_time AND _time<=end_time | eval {status}=1 | eval start=IF(sent=1, sent * -1, start) | eval sent=IF(done=1, done * -1, sent) | sort 0 _time | fillnull value=0 start sent done | streamstats min(_time) AS min_time max(_time) AS max(_time) sum(start) AS start sum(sent) AS sent sum(done) AS done | dedup _time | table _time start sent done   ... View more

I would consider the approach of normalizing your data -- either clean up the source or lookup products field to match the other. ... View more

Assuming your data is consistent and have the same number of comma seperated fields. | rex "(?:[^,]*,){5}(?<event_type>[^,]*)\,(?<event_message>[^,]*),(?<event_code>[^,]*),(?<event_status>[^,]*)" | table _time event_type event_message event_code event_status ... View more

Yep but he asked for this format "2021-12-14 12:55:25.258  - 2021-12-14 12:55:03.339" ... View more

Here's a possible solution:   | sort 0 -_time | streamstats last(_time) AS end_epoch current=f | eval end_time=strftime(end_epoch, "%Y-%m-%d %H:%M:%S") | eval start_time=strftime(_time, "%Y-%m-%d %H:%M:%S") | eval time_range=start_time." - ".end_time | eval duration_sec=end_epoch-_time | sort 0 _time   ... View more

Keep in mind that your largest value is 294 so your chart will be in a range of 0-400 or so. The value of 28% = 0.28 in decimal. It is so small that you can't see it. What you can do is click on the "Chart Overlay" and add the "401 percentage" on its own Axis/range. ... View more

It works. I told you to adjust the dedup according to cardinality of your data. In this case, change the dedup to 100. | makeresults | eval _raw="Duration_in_min website ExtraColumn 10 x.com A 15 x.com A 2 x.com B 2 x.com AA 3 x.com C 4 x.com ABC 15 Y.com BB 10 Y.com XY 1 Y.com CAV 1 Y.com XY 1 Y.com CAV 1 Y.com XY 1 Y.com CAV 1 Y.com XY 1 Y.com CAV 1 Y.com XY 1 Y.com CAV 1 Y.com XY 1 Y.com CAVH 1 Y.com XYF 1 Y.com CAVF 1 Y.com XYF 1 Y.com CAVD 1 Y.com XYD 1 Y.com CAV 1 Y.com CAV 1 Y.com CXY 1 Y.com CCAV 1 Y.com XCY 1 Y.com CAV 1 Y.com XY 1 Y.com CAV 1 Y.com XY 3 Y.com A 4 Y.com B 5 Y.com BB" | multikv forceheader=1 | table Duration_in_min website ExtraColumn | sort 0 Duration_in_min website | dedup 100 website | eval Duration_in_min=ROUND(Duration_in_min, 1) | eventstats list(Duration_in_min) AS duration_list by website | eval duration_list=MVDEDUP(duration_list) | eval duration_3rd=IF(MVCOUNT(duration_list)>3, MVINDEX(duration_list, 2), MVINDEX(duration_list, -1)) | where Duration_in_min<=duration_3rd | sort 0 -website Duration_in_min | table Duration_in_min website ExtraColumn ... View more

When you generate the hour range, convert 1 digit hour to 2 digit, e.g. 00-01, 01-02, etc. ... View more

Yep. How many websites are in this data set? ... View more

Try to isolate the issue and rule out things like your browser and addons. Try from a different browser, and if you are using chrome, try from incognito.   ... View more

Since you're looking for the bottom 3, we can try deduping and keeping 10 lowest duration record for each site which makes it easier downstream -- you can adjust that number up or down depending on your data. Bit of a hack, here's my attempt.   | makeresults | eval _raw="Duration_in_min website ExtraColumn 10 x.com A 2 x.com B 2 x.com AA 3 x.com C 4 x.com ABC 15 Y.com BB 1 Y.com CAV 1 Y.com XY 3 Y.com A 4 Y.com B 5 Y.com BB" | multikv forceheader=1 | eval Duration_in_min=ROUND(Duration_in_min, 1) | table Duration_in_min website ExtraColumn | sort 0 Duration_in_min website | dedup 10 website | eval Duration_in_min=ROUND(Duration_in_min, 1) | eventstats list(Duration_in_min) AS duration_list by website | eval duration_list=MVDEDUP(duration_list) | eval duration_3rd=IF(MVCOUNT(duration_list)>3, MVINDEX(duration_list, 2), MVINDEX(duration_list, -1)) | where Duration_in_min<=duration_3rd | sort 0 -website Duration_in_min | table Duration_in_min website ExtraColumn   ... View more