Hi, I think the median calculation is incorrect when the total amount of values is an even number. An example: 359 282 224 150 60 52 8 1 0 0 Splunk tells me the median is 60, but it should be 56. In this case there is a pair of middle numbers and the median should be calcualted by median=(60+52)/2 Am I correct? BR Heinz ... View more

Hi, I would like to convert a crosstable into a list. Date | A | B 01.01.2014| 5 | 2 02.01.2014| 5 | 2 03.01.2014| 8 | 9 The output should be: col1 |col2| col3 01.01.2014 | A | 5 01.01.2014 | B | 2 02.01.2014 | A | 5 02.01.2014 | B | 2 03.01.2014 | A | 8 03.01.2014 | B | 9 Is there an easy way to do this? I tried out the transpose command, but without success. BR Heinz ... View more

Hi, for some reason I'm not able to read uploaded csv files (in this case lookupA.csv) in the Lookup File Editor. The app never completes "Loading lookup file". Using | inputlookup lookupA.csv in a search works fine. For lookup files created during a search, the Lookup File Editor works. So I tried out | inputlookup lookupA.csv | outputlookup lookupB.csv After this it is possible to open lookupB.csv in the Editor... BR Heinz ... View more

Hi, there are 4 text inputs in my form dashboard: input1 input2 input3 input4 Is it possible to rearrange them (force a "new line" after input2)? input1 input2 input3 input4 ... View more

Hi, I would like to flag events in specific time ranges, e.g. all events between 01.08.2014 14:00:00 and 01.08.2014 15:00:00. My current approach is to use the case command, but this seems to be very uncomfortable: | eval flag=case(_time>=strptime("01.08.2014 14:00:00", "%d.%m.%Y %H:%M:%S") AND _time<=strptime("01.08.2014 15:00:00", "%d.%m.%Y %H:%M:%S") , "flag1", _time>=strptime("03.03.2014 22:00:00", "%d.%m.%Y %H:%M:%S") AND _time<=strptime("03.03.2014 23:00:00", "%d.%m.%Y %H:%M:%S"), "flag2", _time>=strptime("05.04.2014 01:00:00", "%d.%m.%Y %H:%M:%S") AND _time<=strptime("05.04.2014 05:00:00", "%d.%m.%Y %H:%M:%S"), "flag3") Is there a better way to achieve my goal, perhaps by using a lookup? BR Heinz ... View more

Hi, I would like to save a custom time range, that can be used in reports. settings -> user interface -> time ranges: Name: Test Label Test Earliest time: 1406851200 Latest time: @d Submenu: Other Spunk complains about the "invalid time: 1406851200". How can I set the earliest time to a specific date? I've already done something like this, but I can't remember how to avoid this error... BR Heinz ... View more