Unicode punctuation characters U+2000 to U+206f seem to make Splunk want to put the requirement for Simplified Chinese fonts in exported PDFs, so I want to convert these characters to ASCII equivalents. I can add the following to the search command rex field=Course mode=sed "s/(‘|’)/'/g" where the replacement chars above are U+2018 and U+2019 and they are replaced with 0x27, but I want to put something in props.conf to force it to happen always. How would I do this? ... View more

I am doing some online course completion analysis and am trying to get a report which seems to me to be quite difficult to achieve. I have data from 2 sources, one containing the learners in the system and which company they belong to and the other a list of courses completed by those learners. A simplified example of a learners record is userid,name,learner_type,company, and course completions is course,userid,name,completed There are 3 different learner types, "Direct sales", "Indirect sales", "Other" and I want to ignore Other in this report. I have 2 sourcetypes, learners completions What I want to get out is a report that shows Course Company Number of passes Total number of learners in the company Percentage complete as total learners by # passes It needs to group the report by course, so the course name is only reported once and there is a line for each of the companies with the 3 additional columns of data. I have got as far as two types of splunk command, each of which goes part way to solve the problem. The first sourcetype=completions learner_type!="other" | stats count(learner_type) as Passed by course, company | chart list(company) AS Company, list(Passed) as Passed by course That gives me the courses and within each course there are 2 columns, 1 the company and 2, the number of courses passed for that company. Cool, but not enough... The second uses transaction to group by course sourcetype=completions learner_type!="other" | transaction course | sort course | table course, company That gives me a table with course and companies, with just a single line for course. So, the first is missing the count of learners for each company, which must somehow come from the learners source_type as well as the % complete. The second is missing most stuff, but is an example of partially achieving what I wanted with the transaction command, which I had not used before. I feel like I need to do an initial count of the learners for each company and pass that onto the rest of the search pipeline, but am now stuck on how to progress... Any help much appreciated. ... View more