You're modifying start and stop into patterns that don't work with the math you're trying to apply. Try this: index=cd source=jenkins pr_number=* | stats count as Total , earliest(_time) as start, latest(_time) as stop by pr_number name stage.steps{}.stage | eval newStart=strftime(start, "%d/%m/%y - %I:%M:%S:%p") | eval newStop=strftime(stop, "%d/%m/%y - %I:%M:%S:%p") | eval diffTime=stop - start This will give you diffTime in seconds, which you can do with what you want. ... View more

Nobody likes backslashes! | makeresults | eval _raw="{\"line\":\"2020-04-03T12:24:54.589Z LCS {\\\"customer\\\":5,\\\"channel\\\":\\\"sqs\\\",\\\"notificationId\\\":213546}" | rex "customer\\\\\":(?<customer>[^,]+),\\\\\"channel\\\\\":\\\\\"(?<channel>[^\\\]+)\\\\\"" ... View more

If a period is legal inside, but the line always has to end with a period, this might work for you: |rex field=username "username=(?<username>.+)\.$" ... View more

How are the 2 logs differentiated? By index, or by source, or by some other attribute? Whatever that is, your case statement needs to check for "true" coming from both of those logs, and then set the color to green. Your eventstats is summing all the events, and not differentiating. Can you please post a sample of events from both logs? ... View more

I'd love to see an answer as well, since I'm running the same at home. The hack I have so far is this, which is probably wrong: index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" | stats sum(b) AS bSum first(poolsz) AS poolSz by idx I imagine you can set up an alert when bSum is close to poolSz? ... View more

Here is one way to do it, using a Run Anywhere SPL: | makeresults | eval _raw="event k8s_jenkins_jenkins-16-mrlz4_tau-ops_eb099c1d-6d70-11ea-8ba8-001a4a160104_0 k8s_datadog-agent_datadog-agent-t4dlc_clusteradmin_dd5f238b-6a16-11ea-8ef9-566f4e1c0167_351 k8s_core-order-service_core-order-service-deployment-1-t9b29_fltc-ods-uit_b10cf94d-64b1-11ea-8ef9-566f4e1c0167_3513" | multikv forceheader=1 | fields _raw | rex "(.*?_){3}(?<container>[^_]+)" See regex101 ... View more

Here is one way to get a list of customers that have a start time but are missing end time: | gentimes start=02/07/2017:00:00:00 end=02/07/2017:00:06:00 increment=1m | rename starttime as _time | fields _time | appendcols [|makeresults|eval raw2=split("cust=Customer1 event=Start,cust=Customer1 event=End,cust=Customer2 event=Start,cust=Customer2 event=End,cust=Customer3 event=Start,cust=Customer9 event=Start",",") | mvexpand raw2 | eval _raw=raw2 | extract | fields - _raw raw2] | stats earliest(_time) as StartTime latest(_time) as EndTime by cust | where StartTime=EndTime | fields - StartTime EndTime This returns Customer3 and Customer9. All it does is check to see if the customer's max timestamp is the same as its min timestamp. It is a flexible way to avoid using the transaction command. Another method is to look for the number of events per customer ID. If there is only 1, it qualifies: | gentimes start=02/07/2017:00:00:00 end=02/07/2017:00:06:00 increment=1m | rename starttime as _time | fields _time | appendcols [|makeresults|eval raw2=split("cust=Customer1 event=Start,cust=Customer1 event=End,cust=Customer2 event=Start,cust=Customer2 event=End,cust=Customer3 event=Start,cust=Customer9 event=Start",",") | mvexpand raw2 | eval _raw=raw2 | extract | fields - _raw raw2] | stats count by cust | where count<2 ... View more

If you're looking to TRANSFORM your existing message_id field so that everything up to and including the @ (at-symbol) gets thrown away, then try this: | makeresults | eval raw2=split("[email protected] [email protected] _time=13:24:23:445,[email protected] [email protected] _time=12:34:13:1344,[email protected] [email protected] _time=12:12:53:1233",",") | mvexpand raw2 | eval _raw=raw2 | extract | fields - _raw raw2 | rex mode=sed field=message_id "s/.*@(.*)/\1/g" ... View more

Without more info, here is one potential solution, using "Run Anywhere" SPL: | makeresults | eval raw2=split("watt=5,watt=-15,watt=2,watt=-5,watt=3,watt=6,watt=138,watt=505,watt=-4,watt=-2,watt=15",",") | mvexpand raw2 | eval _raw=raw2 | extract | fields - _raw raw2 | table watt | autoregress watt p=1 | eval wattSum=watt+watt_p1 | eval appliance=if(wattSum>620 AND wattSum<680,"Probably heater","something else") This uses the autoregress command to enable nearby rows to be examined. Then using your criteria, indicate which one is probably your heater. The fields are shown in the output for completeness. ... View more

How do you know that the wattage reading belongs to a certain appliance? Also, what do the negative readings indicate? ... View more

When you say "at the same time" do you mean they have the same timestamps, or are you looking for processing time overlaps? ... View more

If you have text fields for both t_host and t_pod in your dashboard, this might help. It just shows the substitution. <form> <label>tjsnow</label> <fieldset submitButton="true" autoRun="false"> <input type="text" token="t_pod"> <label>t_pod</label> <default>default_t_pod</default> <initialValue>default_t_pod</initialValue> <change> <set token="t_pod">$value$</set> </change> </input> <input type="text" token="t_host"> <label>t_host</label> <default></default> <change> <set token="t_host">$value$</set> </change> </input> </fieldset> <row> <panel> <table> <search> <query>| makeresults | eval hostToken=if("$t_host$"=="","$t_pod$","$t_host$")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> In your example, you can then do something like this: index=MYINDEX subid=$t_submissionID$ msg=$t_messageType$ | eval hostToken=if("$t_host$"=="","$t_pod$","$t_host$") | where host=hostToken ... View more

This might get you close, using a Run Anywhere example: | makeresults | eval data="2019-12-26 15:35:49,5523111122221111,1,45.11111,122.11111; 2019-12-26 15:36:12,5523111122222222,1,45.22222,123.22222; 2019-12-26 15:36:40,5523111122223333,1,45.33333,123.33333; 2019-12-26 15:37:22,5523111122221111,10,,; 2019-12-26 15:43:03,5523111122225555,1,45.55555,123.55555; 2019-12-26 17:28:13,5523111122225555,10,," | makemv data delim=";" | mvexpand data | rex field=data "(\s|\n?)(?<data>.*)" | makemv data delim="," | eval _time=strptime(mvindex(data,0),"%Y-%m-%d %H:%M:%S"), ccNum=mvindex(data,1), statusId=mvindex(data,2), latitude=mvindex(data,3), longitude=mvindex(data,4) | fields _time ccNum statusId latitude longitude | eventstats first(latitude) AS firstLat first(longitude) AS firstLong first(_time) AS firstTimeStamp by ccNum | eval timeDiff=_time-firstTimeStamp | eval latitude=if(isnull(latitude) AND timeDiff<=3600,firstLat,latitude) | eval longitude=if(isnull(longitude) AND timeDiff<=3600,firstLong,longitude) If a CC has a status of 10 and is missing lat and long, and that same CC had been used within the past hour (3600 seconds), then those previous lat and long values are copied in. The last 2 lines show that those are NOT copied in if more than an hour has transpired. You can clean this up by removing the compute fields by adding this line to the end: | fields - firstLat firstLong firstTimeStamp timeDiff If you have something existing, just tack on the search starting with eventstats. If you need more refinement, just post here and I'm sure someone can help out. ... View more

I'll admit I don't have a clear picture of what you're trying to achieve. When I have challenges similar to yours, I found that creating a new field can sometimes help. For example: eventtype="*" "screen" OR "ui" OR "screen1" OR "ui1" | eval type=if(match(_raw, "screen") OR match(_raw, "ui"),"type1", "type2") | stats count AS TotalEvents by product,type Again, I'm not sure what you want to do with the values coming back, but if you try this on your events, the next steps may become clear to you. If you get stuck, post a sanitized sample of the output from the above, and I'm sure someone will be able to provide guidance. ETA: The advice posted by Rich is good, specifying fields and index is always a good way to get better performance and make your splunk admins happy. ... View more

The transaction command is not good for large volumes, and I have had issues with it. Some people will recommend using the stats command like this, assuming you have a unique identifier to group by: (your search here) | eval StartTime=if(match(_raw, "start_pattern"), _time, null()) | eval EndTime=if(match(_raw, "end_pattern"), _time, null()) | stats earliest(StartTime) as StartTime latest(EndTime) as EndTime by vpnID | eval elapsed=EndTime-StartTime At this point, you should be able to get a nice tabular view that can help with verifying your data, prior to moving on with concurrency . ... View more

One solution is to use the concurrency command. You'll need to calculate your duration. (your search) | eval duration=(VPN session duration in minutes) | eval new_start = _time - duration | concurrency start=new_start duration=duration output=overlap | timechart span=1h max(overlap) You can change your timechart span to fit your need. Here is the concurrency man page: https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Concurrency ... View more

I copied and pasted your sample, which has a leading space on every line, and it works in my Splunk. I did notice that the first line says | makeresults (with a leading space) but when I hit the search button, Splunk auto-removed just that line's leading space, left the others with a leading space, and ran fine. My browser is Vivaldi 2.10.1745.27 (Stable channel) (64-bit) and Splunk Enterprise is 7.2.8. Output: Source1_field2 Count dev 6 prod 5 uat 7 qa 8 ... View more

Another way to do it: | makeresults | fields - _time | eval a=1,b=2,c=3,d=4 | eval Total=a+b+c | table * Total Using the table command, you can force the field order. In this example, it is saying "list all the fields but put Total at the end." a b c d Total 1 2 3 4 6 ... View more

You can do quite a lot of what you're asking. | makeresults | eval raw="111.222.111.222:::192.168.1.1:::8.8.8.8:::008.008.008.008:::127.0.0.1" | makemv delim=":::" raw | mvexpand raw | rename raw AS _raw | fields - _time | eval raw2=_raw | rex field=raw2 mode=sed "s/\.//g" | rex field=_raw "(?<part1>\d+)\.(?<part2>\d+)\.(?<part3>\d+)\.(?<part4>\d+)" A word of caution. Take a look at what happens when you have an IP address that doesn't have each part consisting of 3 digits. If you remove the periods from 192.168.1.1 and get 19216811, could that mean 192.16.81.1 or maybe 192.16.8.11? ... View more

Check to see if it installed properly using dpkg -l | grep -i splunk When I installed it at home on Ubuntu 18.04, I followed these instructions: https://linoxide.com/linux-how-to/install-splunk-ubuntu/ Can you please post what you followed for the install? ... View more

Here is one way to do it, using a Run Anywhere example: | makeresults | eval raw="#4 MyApp\Framework\DB\Adapter\Pdo\Mysql->_query('SELECT `store_we...', array()) called at [vendor/myapp/framework/DB/Adapter/Pdo/Mysql.php:621]:::#5 MyApp\Framework\DB\Adapter\Pdo\Mysql->query(MyApp\Framework\DB\Select#b8e969b2c2d6#, array()) called at [vendor/myapp/zendframework1/library/Zend/Db/Adapter/Abstract.php:737]:::#6 Zend_Db_Adapter_Abstract->fetchAll(MyApp\Framework\DB\Select#b8e969b2c2d6#) called at [vendor/myapp/module-store/App/Config/Source/RuntimeConfigSource.php:87]" | makemv delim=":::" raw | mvexpand raw | rename raw AS _raw | rex field=_raw mode=sed "s/(#.+?#)([^#]+)(#.*)/\1StaticText\3/g" What this does is break up eligible events into 3 parts, substituting the second part with StaticText. You can see the regex here: Regex101 ... View more

What happens when you grab that search and run it on its own in the app, with the macro in its native location set as global? Same as above, but with the macro homed to the app you're running from? One test in each case is to expand all the macros with Control-Shift-E. Might take a minute. When I'm in app "A" and do Control-Shift-E on a macro from app "B" that is shared global (with Everyone=Read, Power=Write) it expands and works fine. Finally, check your App permissions (where the macro lives). Mine says Everyone=Read, Power=Write, and the bottom radio button is true. ... View more

Can you please post more of your XML? Are you trying to set some tokens based upon the result of a search, or when an input changes? ... View more