Hi, my events can include a fieldname with a pattern like: product_type_a product_type_b product_type_c To group calculations by product type, I think about creating a new key-value pair like type=product_type_A. I could use a CASE command, but then I need to know all product_type_* that will appear in the future. Is there a way to use something like COALESCE in combination with a wildcard or LIKE, to grab the first appearing fieldname as value? Thanks in advance Heinz ... View more

Hi, I'm calculating the calenderweek with this: | eval calenderweek=strftime(_time,"%Y-%V") For some reason for 2017-01-01, the calenderweek is 2017-52, any ideas why? Date -> Calenderweek 2017-01-03 -> 2017-01 2017-01-02 -> 2017-01 2017-01-01 -> 2017-52 2016-12-31 -> 2016-52 2017-12-30 -> 2016-52 Thanks in advance, Heinz ... View more

Hi, In the events, I have different fields for the products. How can I easily sum all values for these fields when I don't know all exact names? productA= productB= productC= ... These examples are not working, but I hope it explains my need: | stats sum(product*) AS total_products Or to sum up all values per product | stats sum(product*) AS sum BY product* Thanks in advance Heinz ... View more

Hi, let's say we have a string with various tagged entries: "This {field1} is {delete_this} the example {tagged_element}" Is it possible to ignore all tagged elements, no matter how many of them exist? Here the result would be "This is the example" Thanks in advance Heinz ... View more

Hi, before Splunk 6.5.0 I used commands like this to split strings into separate fields. For fields like productId=abc_text_def | rex field=productId "(?<field1>.*)\_text_(?<field2>.*)" Since 6.5.0 this does not work anymore. The error is: Error in 'rex' command: Encountered the following error while compiling the regex '(?<field1>.*)\_text_(?<field2>.*): Regex: unrecognized character follows \ Can you help me to fix this? ... View more

Hi, I have events with a timestamp_value=1477043785561 We can filter like this: index=a sourcetype=logins timestampvalue<=1477008000 Is it possible to use a date format in the base search to filter? Of course the following does not work, but perhaps something similar is possible so that I don't have to translate every filter into epochtime. index=a sourcetype=logins timestampvalue<=2016-10-21 Best Heinz ... View more

Hi, I have a list of customers (ColA) and depending on the total amount of customers I want to "split" the list into equal groups (let's say steps of 10%) and flag these groups. So having 20 customers and using steps of 10%, the first 2 customers are grouped together and flagged in ColB as 10%. Customers 3-4 are grouped (20%), 5-6 (30%) are grouped etc. When this list increases to 100 customers it should group the first 20 customers (10%), 21-40 (20%) and so on. I'm expecting some form of the streamstats command here, but can't find the solution. Thanks in advance Heinz ... View more