Empty and null are different things. If the field is "" then it is not null, so I use | where len(company)>0 ... View more

As @tscroggins says, it's always important to get your ingest dates correctly extracted from the data in the first place. However, to extract a time from a field in the data you use the strptime() function, e.g. | eval _time=strptime(date_field, "format_string") which will overwrite the existing _time field with the time converted from your data field called date_field according to the format string you specify. Time format variables are documented here https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Commontimeformatvariables e, g. this example, which you can paste into your search bar will convert the string in my_date_field to _time. | makeresults | eval my_date_field="2023-11-13 08:01:02.123" | eval _time=strptime(my_date_field, "%F %T.%Q") Note that times are converted to epoch times, but the _time field is special in that it will show you the formatted date, rather than the epoch. ... View more

So a single event with two timestamps is easy | rex "time1=(?<t1>[^Z]*Z)" | rex "time2=(?<t2>[^Z]*Z)" | eval t1_t=strptime(t1, "%FT%TZ") | eval t2_t=strptime(t2, "%FT%TZ") | eval diff=t2_t-t1_t You can optimise that to make a single rex if you can guarantee the ordering of your _raw data ... View more

Good questions. You can't get the sorted order inside eventstats. The list(Score) will put them in the order they are found, so they will not be sorted, and mvsort will not sort numerically, so cannot be used, so the mvfind will not get the correct position.  The other issue with list(Score) is that it can only cope with 100 values, so it will fail at that point. As to whether there is an alternate solution, the following is probably a better option as it does not have the limitations of list() and does not require mvfind. It may be more efficient. | makeresults count=10 | fields - _time | streamstats c as Score | eval Student="Student ".(11 - Score) | table Student Score ``` Above simulates your data ``` ``` Generate list of scores and find position in results ``` | sort Score | streamstats count as pos | eventstats count ``` Now calculate ranks ``` | eval Rank_Inc=round((pos-1)/(count-1)*100, 0) | eval Rank_Exc=round((pos+0)/(count+1)*100, 0) | fields - Scores pos count You still have to sort the scores and it uses streamstats to identify position (rather than mvfind). I think there may be a difference in behaviour when there are multiple students with the same score. Using mvfind would always find the position as the first instance of that score, whereas using streamstats as above it would use the user's position. However, you could probably solve that issue. ... View more

Does the Splunk default _time field represent the time in the data or is it a different time? If it's a different time, then you need to extract those times (if not already extracted) and then just do the maths after the stats, e.g. something like   index=foo (source=foo1 OR source=foo2) (eventid=* OR event_id=*) | eval eventID = coalesce(eventid, event_id) | rex "time.:.(?<event1_time>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})" | rex "time:.(?<event2_time>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})" | stats values(*) as * by eventID | eval e1_t=strptime(event1_time, "%FT%T") | eval e2_t=strptime(event2_time, "%FT%T") | eval diff=e1_t-e2_t   You may need to adjust the rex statements - this also ignores subsecond values - not sure what 13 decimal places is for in the first time - if you want to include those you'll have to change it a bit. ... View more

Have you tried just index=xyz status=complete | fields dur | fields - _* | eventstats p95(dur) as p95Dur | where dur < p95Dur | stats count so you only have the dur field in the dataset - I believe that will be significantly faster without having to pull all the data to the search head. ... View more

@FelixLeh no - you are absolutely right and your suggestion looks fine, but @Anud was using append and a subsearch with inputlookup and not what you suggested... ... View more

OK, so a lot going on here... You have two searches that look similar - not sure if they are searching the same data set, but in order to diagnose this you should do a number of things. You are also using the transaction command that also has limitations and can cause data not to appear if you hit those limitations - and you will not know about it. I suggest you validate first search 1 and see how many results you expect and then run search 2 (the appended data) and determine how many you see then. If you do not see 1 + 2 in the combined search, you are hitting some memory issue. I suspect, but cannot say exactly, that you could remove both the append and the use of transaction and just use stats.  Are the two masked search data sets the same or different?   ... View more

Ho often do you want the alert to run. When you decide that, change the cron schedule accordingly. The time window should really be the same as the frequency - only you can decide what that is. When making these searches, it is normal to search for a window that is a little bit in the past, e.g. as I suggested in my previous post. If your frequency is 5 minutes, then your time window would be something like  earliest=-7m@m latest=-2m@m so you search a 5 minute window from -7 to -2 minutes ago. It's not clear from your original post what you mean by the incident coming in at 9:16 when the event is 8:20   ... View more

Add in the \r\n to the regex, i.e. | rex "Registrar:\s(?<registrar>.*?)\\\r\\\n Registrar IANA" Note 3 slashes I assume those \r\n are literal characters rather than CR/LF? ... View more

The problem is because you are using a change block which is run always and not on the submit button, so you are setting the token dependencies when you change the dropdown. You need to do it a bit differently, so that a search is run based when the submit button is clicked and that search has a <done> clause that will set/unset the panel triggers to show/hide the panels. Note that it uses eval statements to cause the tokens to be set/unset. See this <form> <label>Submit</label> <init> <set token="loadsummary"></set> </init> <fieldset submitButton="true" autoRun="false"> <input token="field1" type="time" searchWhenChanged="false"> <label>Time Picker</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="subsummary" depends="$loadsummary$" searchWhenChanged="false"> <label>Summary Selection</label> <choice value="FUNC">Function Summary</choice> <choice value="MQ">MQ Summary</choice> </input> </fieldset> <row depends="$funcsummaryMQ$"> <panel depends="$funcsummaryMQ$"> <title>ABC</title> <table> <search> <query>index="SAMPLE" </query> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> </table> </panel> </row> <row depends="$hidden$"> <panel> <table> <search> <query> | makeresults | eval ss=$subsummary|s$ </query> <done> <eval token="funcsummary">if($result.ss$="FUNC","true",null())</eval> <eval token="funcsummaryMQ">if($result.ss$="MQ","true",null())</eval> </done> </search> </table> </panel> </row> </form> ... View more

Your alert is searching for a 15 minute window but running every 5 minutes, so at 8:20 it will search 8:05 to 8:20 and at 8:25 it will search 8:10 to 8:25 and so on, so you will get duplicate alerts. If your event time is 8:20 but it is not getting indexed until 9:16, then you will not see that alert as when the search runs at 8:25 the data is not present and when the search runs at 9:20, the event time is 8:20, so not in the search window. If your events are arriving late, that needs to be checked with the how those events are being forwarded. You can look at event lag by adding | eval index_time=strftime(_indextime, "%F %T.%Q") before your table statement and then adding index_time field to your table statement, so you can see when that events was indexed. If you KNOW you have lag and there is nothing you can do about it, then you may need to adjust the time window of the search to something like earliest=-60m@m latest=--55m@m so that you are searching a 5 minute window 1 hour ago. The search window should generally match the frequency of the cron schedule.   ... View more

@Anud Your search is NOT doing what @FelixLeh suggested. The idea is that you load the SECOND lookup (fileB) first and then lookup the common field A to get the required field E from the FIRST lookup. Your example shows that fileB contains the data and fileA contains the missing field E (CAR/BUS) that is needed to enrich fileB data. Note that your actual search uses append with a subsearch - you should not do it that way, as inputlookup already has an append option and this method does not have the limitations of a subsearch, i.e. | inputlookup append=t file   ... View more

append and subsearches have limitations and limits defined in limits.conf, so you cannot override these, but that number seems an odd number.  What is your search - there are often alternatives to append and a subsearch. Can you share your search ... View more

What do you need to retain from those events? eventstats is a slow operation as it will run on the search head, so the amount of information you need should be minimised before using that, so use the fields command to limit only those fields you need beforehand. If that is still too slow, the subsearch approach may work for you    ... View more

What actually IS the problem here - you are showing me the list of events, but not the statistics tab, which is what the result is. You are searching in verbose mode, so you will see the events, but that is what happens in verbose mode - is there anything wrong with the result?     ... View more

You put the mvexpand in the wrong place - it should be before the where clause. Did this produce any results - there are none shown ... View more

I would suggest looking at ways of NOT using transaction, as it has limitations. stats can often solve the problem of transaction. Perhaps you can give an example of your data and say what you are trying to achieve - then the right solution may be clearer. You can use eval statements in starts and endswith, but before you go down that route, let's see what you're trying to get to   ... View more

Can you post a screenshot of your query and results - it's not easy to visualise what's going on with just the messages ... View more

You need to give more detail about your data - what do you want to occur when there are multiple IDs per event and you want to see averages for XYZ? In that example what does duration mean when there are two customer ids? If you add the extra mvexpand line after the | stats count values(duration) as duration values(id) as id by event_id | mvexpand id   ... View more

Run the query without the last line and you will see what the results are before the average ... View more

Not sure of how dashboard studio does it, but in Simple XML when you select a value in a radio, the $label$ token is set to the label, so you can use a <change> block to assign that to a token - maybe there is something similar in DS ... View more

You could externalise the versions to a lookup file and the query could get the versions from that lookup file and use those values in the query, e.g. if you had a lookup file with  version,date_from 3.10.0-1160.92.1.el7.x86_64,2023-11-06 then the query could use a subsearch to get the latest version based on date_from field in the lookup to use in the query. As for how to update that automatically, it would depend on where your data is coming from. You could use the REST api to perform actions on the Splunk server.  ... View more