Hello Everyone I hope you are safe and sound, I'm extracting values from events that come in a Json format and after that I want to create a Table were I can see each ID and the product thy bought from the store but I am always getting within a single cell the same value repeated two times and when I try to do a stats count then... it is also count twice... This is my code: index=purchase_store_x1 | rex mode=sed "s/^(?i)(?:(?!{).)+//g" | spath | search BodyJson.name="pdone.ok" | rename BodyJson.product.ID as PRODUCT | rename BodyJson.ID.CX.Unique as ID | table ID PRODUCT | sort -ID and so instead of getting the ID asociaed with the product purchased I get something like this: ID PRODUCT 31254 31254 XUI45 XUI45 54581 54581 XUI8 XUI45 47851 47851 XUIE58 XUI45 How can I just a normal table without having the same value repeated twice in the cell? THANK YOU SO MUCH for your help, ... View more

Hello Friends,  I'm trying to generate a table that summarizes the total count of events A, B and C as follows   search 1 | fields A | stats count(A) as Net | eval stage="A" | append [ search search 2 | fields B | stats count(B) as Net | eval stage="B"] | append [ search search 3 | fields C | stats count(C) as Net | eval stage="C"] | table stage, Net   But I cannot seem to find a way to the create a field named "conv" that will compute the follow opeacion: take the value of the current Net count subtract the previous value and then devide it by the previous value, in other words find the percentage of conversion between stages, BUT for thw first row it will be zero something like this: Stage Net conv A 100 0 B 80 (80- 100)/100  = -0.2   C 70 (70-80) /80 = -0.125  I was thinking about a way to calculate something with a for loop? but I dont know how ti access the indexes of the table... Thank you so much to everyone that can help me like THANK YOU SO MUCH ... View more

Hello friends!   I am faced with a challenge I will be uploading two CSV files to splunk which represents two different table of information Table A: Has the information of purchases in a clothing store with the variables: name of client, date of purchase, agent and product purchased during a period of time t. NAME PRODUCT AGENT DATE_PURCHASE Karen M_14 X_1 8-25-20021 18:21:28 Jean M_78 X_3 8-26-20021 18:11:06 Jean M_71 X_4 8-26-20021 18:21:01 Jean M_64 X_4 8-27-20021 20:21:59 Keith M_57 X_4 8-27-20021 20:21:02 Alba M_50 X_1 8-28-20021 20:21:03 Alba M_43 X_3 8-29-20021 20:21:04 Alex M_36 X_2 8-25-20021 20:21:05 Table B: Has the information of clients who have called the CX SERVICE line of the company during a period of time t and stores the variables name of client, date of call, and type of call. NAME TYPE DATE_OF_CALL DATE_PURCHASE Karen COMPLAIN 8-26-20021 18:21:28 8-25-20021 18:21:28 Jean CX_SERVICE 8-27-20021 18:11:06 8-26-20021 18:11:06 Jean COMPLAIN 8-28-20021 18:21:01 8-26-20021 18:21:01 Jean CX_SERVICE 8-29-20021 20:21:59 8-27-20021 20:21:59 Keith CX_SERVICE 8-29-20021 20:21:02 8-27-20021 20:21:02 Alba COMPLAIN 8-30-20021 20:21:03 8-28-20021 20:21:03 Alex CX_SERVICE 8-25-20021 21:21:05 8-29-20021 20:21:04   I have to build a table in which It will be shown by NAME what was the very last product purchased by the customer prior to their very last call to the customer service line and it should include the variables: NAME ,LAST_PRODUCT_PURCHASED, AGENT, DATE_PURCHASE, TYPE, DATE_OF_CALL that table should look something like this: RESULTS NAME LAST_PRODUCT_PURCHASED AGENT DATE_PURCHASE TYPE DATE_OF_CALL Karen M_14 X_1 8-25-20021 18:21:28 COMPLAIN 8-26-20021 18:21:28 Jean M_64 X_4 8-27-20021 20:21:59 CX_SERVICE 8-29-20021 20:21:59 Keith M_57 X_4 8-27-20021 20:21:02 CX_SERVICE 8-29-20021 20:21:02 Alba M_43 X_3 8-29-20021 20:21:04 COMPLAIN 8-30-20021 20:21:03 Alex M_36 X_2 8-25-20021 20:21:05 CX_SERVICE 8-25-20021 21:21:05   For example: The second raw shows the desired result as the very last product purchased by Jean was M-78 and her very last call on the line was a TYPE= CX_SERVICE with date 8-29-20021 20:21:59 I have been trying to come up with a solution but I finding myself needing of help. I kindly thank you for your assitance or tips, or reference to documentation that can help me achive my results. Thank you so much. PD: What if we would try to add a column that counts how many time the custumer (NAME) has called prior to their most recent call on the line. Thank you so MUCH! thanks a lot   ... View more

Hello Talented People of the wordl! I hope you are having a great day, I wish to know if there is a way to have a YES or NOT output of the number of digits in each row is greater than a  certain limit, for example: I want the column MET equal to true if the number of digits in the raws of the field ID is greater than 9 .. kind of like this: ID MET 123456789 NOT 548554569362 YES 14521421 NOT 1254 NOT 4858466358475248 YES   lets say that my search begings as follows:  index="medic_dni" ID=* | field ID ####################################################################### STAGE 2= I would wonder how would the code would have to look like if the column ID would show some values witha string followed by the (-) sign and then a string of  numbers something like this:  ID-47855478554 OR IDUSA-47854785545 or something like this: IDSPAIN-7854545454 How can I obtain the following table ID ID_ONLY_NUMBERS NUMBERS_GREATER_THAN_9 ID-47855478554841 47855478554 YES IDUSA-47854785545521972 47854785545 YES IDSPAIN-785454545474588 7854545454 YES THANK YOU SO  SO MUCH TO ANYONE WHO WOULD LIKE TO HELP I TRULLY FROM THE BOTTOM OF MY HEART THANK YOU  ... View more

Hello guys I am trying to download a CVS file from a query that comes after a | stats values(field) command, thus this function organizes the data in a single row and when I open my cvs file all hell breaks loose... can you please teach me how to have the values shown in an inidivual row please? thank you ... View more