Hi, I have a requirement to calculate backlog over weeks Backlog Current Week (Backlog1) = Current Backlog Backlog Previous Week (Backlog2) = Backlog1+ (Open - Closed) Backlog Previous Week (Backlog3) = Backlog2 + (Open - Closed) current open count - current backlog index=idx earliest=-23w latest=now | dedup ticket_number | fillnull value="Not Defined" problem_mapping system_user asset_id auto_sub_cat3 work_queue owner_name ticket_source state | itsm_ticketanalysis_to_time(time_submitted,Time,source) |search ticket_type="incident" Project="*" | bin Time span=1w|chart count(eval(State="Opened")) as open_count count(eval(State="Completed")) as closed_count by Time |eval backlog = closed_count - open_count|eval Time=strftime(relative_time(Time,"@w0"),"%d %b %y") I tried this. but i could not grab previous week values dynamically. How to do this considering previous week? please provide any leads ... View more

I have to set earliest to @d for the custom time stamp query.. | dedup EMPLOYEE_ID |fields EMPLOYEE_ID STORE_NUMBER STATE REGION PUNCH_OUT_TIME|where PUNCH_OUT_TIME!= " "|eval punch_time= strptime(PUNCH_OUT_TIME,"%d/%m/%Y %H")|bin punch_time span=1h|stats count by REGION punch_time|eval punch_time = strftime(punch_time,"%d/%m/%Y %H %p")|xyseries punch_time REGION count|addtotals|eventstats avg(Total) as Average|rename Total as "Total Punched"|rename Average as "Average Punched"| rename punch_time as PUNCH_OUT_TIME This query shows hour wise details for all dates. but I need only for current date.. I could not set earliest and latest here. How to do that? please help ... View more

Hi All, I need an urgent help. Need to check if the webservice call is hitting and getting success message. How to do that Web service call: - http://server-host1/wfc/XmlService - I have power shell script with post request . How to call it in splunk and get success or failure message. ... View more

I'm facing issue with formatting sparkine as bar chart for multiple sparklines index=xxx counter="% Idle time" OR counter="% User Time" |stats sparkline(avg(Value),1h) as Trend avg(Value) as "Avg_Value" by host counter|eval Avg_Value=round(Avg_Value,2)."%"|xyseries host counter "Avg_Value" Trend I could see sparkline trend values as "Trend:% Idle time" "Trend:% User Time". How to specify this in format tag Tried this <code> <format field= "Trend:% Idle time" type="sparkline"> <option name="type">bar</option> </format> </code> This is not working.. can someone please help ... View more

Hi, I have data extracted from windows perfmon logs Query I used index=perfmon_cpu counter="% Idle time" OR counter="% User Time" OR counter="% Processor Time"|stats latest(Value) as "Percent" by host counter Here I get all the hosts, with counter and %. I want all the counters to be column with Values as %for hosts. If I use transpose - hosts are also getting as columns. I don't want that. Any idea to retain hosts and changing counters and their values in columns. Counters are idle time, user time and processor time. Values are in %. Please help ... View more