@mmodestino I am so grateful for your help! We have a Splunk application owner who manages the solution, but I do have admin capabilities. I believe this particular data set is ingested constantly through forwarders. Where do I need to input the props code you created? ... View more

I must apologize for my lack of knowledge; I'm very new to Splunk. Where can I find the raw csv files or the props.conf? ... View more

Where do I find that? ... View more

@mmodestino Thank you so much!! Here are the first eight events in list form: 7/10/17 12:40:28.000 AM Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,China,7/4/17 0:56,7/4/17 0:56 host = BDC-ESSSPLK01 source = G:\AutoIndex\webex_sentiment\WebEx Sentiment Survey2_Responses 7.4.17.csv sourcetype = csv 7/10/17 12:40:28.000 AM Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,China,7/4/17 0:04,7/4/17 0:04 host = BDC-ESSSPLK01 source = G:\AutoIndex\webex_sentiment\WebEx Sentiment Survey2_Responses 7.4.17.csv sourcetype = csv 7/10/17 12:37:39.000 AM Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,Philippines,6/29/17 0:32,6/29/17 0:32 host = BDC-ESSSPLK01 source = G:\AutoIndex\webex_sentiment\WebEx Sentiment Survey2_Responses 6.29.17.csv sourcetype = csv 7/10/17 12:37:39.000 AM Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,Philippines,6/29/17 0:10,6/29/17 0:10 host = BDC-ESSSPLK01 source = G:\AutoIndex\webex_sentiment\WebEx Sentiment Survey2_Responses 6.29.17.csv sourcetype = csv 7/10/17 12:37:34.000 AM Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,China,6/28/17 0:45,6/28/17 0:45 host = BDC-ESSSPLK01 source = G:\AutoIndex\webex_sentiment\WebEx Sentiment Survey2_Responses 6.28.17.csv sourcetype = csv 7/10/17 12:37:34.000 AM Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,Japan,6/28/17 0:36,6/28/17 0:36 host = BDC-ESSSPLK01 source = G:\AutoIndex\webex_sentiment\WebEx Sentiment Survey2_Responses 6.28.17.csv sourcetype = csv 7/10/17 12:37:34.000 AM Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,China,6/28/17 0:08,6/28/17 0:08 host = BDC-ESSSPLK01 source = G:\AutoIndex\webex_sentiment\WebEx Sentiment Survey2_Responses 6.28.17.csv sourcetype = csv 7/10/17 12:37:28.000 AM Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,Taiwan,6/27/17 0:08,6/27/17 0:08 host = BDC-ESSSPLK01 source = G:\AutoIndex\webex_sentiment\WebEx Sentiment Survey2_Responses 6.27.17.csv sourcetype = csv Here are those same eight events in raw form: Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,China,7/4/17 0:56,7/4/17 0:56 Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,China,7/4/17 0:04,7/4/17 0:04 Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,Philippines,6/29/17 0:32,6/29/17 0:32 Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,Philippines,6/29/17 0:10,6/29/17 0:10 Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,China,6/28/17 0:45,6/28/17 0:45 Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,Japan,6/28/17 0:36,6/28/17 0:36 Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,China,6/28/17 0:08,6/28/17 0:08 Very Satisfied,5,,,,,,,,,,,,,,,,,,,,,,Taiwan,6/27/17 0:08,6/27/17 0:08 ... View more

@DalJeanis Thanks for the response. I input your suggestion like this: index = webex_sentiment | eval surveyDate = strptime(Started,"%m/%d/%Y %H:%M") | eval YearWeek=strftime(surveyDate,"%Y-%U") | search YearWeek!="2016-00" | bin _time span=1d | stats count as daycount by country _time | eventstats avg(daycount) as avgcount stdev(daycount) as stdevcount by country | where daycount> avgcount + 3*stdevcount | chart count(Rating) as NumberRatings by YearWeek | search YearWeek > 2016-12 I received these events back: http://imgur.com/a/8XYvW However, there is no subset by country visualization: http://imgur.com/a/pNIuu I'm unclear what exactly you mean by a field that displays which call it was on. Could you clarify? Best, Matthew ... View more

@anand_singh17 What do you propose? I believe the problem is duplicate events ... View more

@mmodestino I followed your instructions and I believe that the issue is duplicate events. Here is my query with "Format Timeline" : http://imgur.com/a/MEJJv With this visual, you can see the truly see the data spike: http://imgur.com/a/Q4DxY April 5 has 1,239 events April 18 has 1,418 events April 19 has 1,500 events April 20 has 1,380 events April 26 has 1,398 events April 27 has 1,329 events April 28 has 1,029 events Outside of these few weeks in April, there are no days that come anywhere near to 1,000 events. I drilled down to the individual hours per your suggestion, and found what appears to be a multitude of duplicate events: http://imgur.com/a/laaWD What should be my next steps from here? ... View more

@cmerriman How do I split by YearWeek with trellis? ... View more

@woodcock Thanks so much! For anyone interested, here is the graph I was looking for: http://imgur.com/a/jTe7Q ... View more

@woodcock How do I do that? Best, Matthew ... View more

@Iguinn Thanks so much for your help. I input your code, but my search did not return any results. Here is the job inspection: http://imgur.com/a/JMv3T I believe the error may have something to do with the time range, but I'm not positive. Best, Matthew ... View more

asdfasdfdsfas ... View more

asdfasdfdsafdsfsdaf ... View more

asdfasfdsfasdfdsaf ... View more

asdfadsfdsfadsfdasfd ... View more

asdfasdfsdf ... View more

asdfadsfsdafadsfsdfdasf ... View more

asdfasfdsafadsfa ... View more

asdfasfasfsdfasdf ... View more

asdfasfasdf ... View more

12345678910 ... View more

I'll give 100 karma to the right answer 🙂 ... View more

No problem! ... View more