Oops thanks @ITWhisperer pointing out the typo ... View more

As it doesn't appear to be correctly quoted JSON, spath won't work, so try | rex field=properties "appname.:.(?<appname>[^']*).*levelId.:[^\d]*(?<levelId>\d+)" Not particularly robust, but should work in this example   ... View more

Here is how | makeresults | eval Age=split("2 years 3 months 2 days,3 months 4 days,2 days", ",") | mvexpand Age | rex field=Age "((?<years>\d+)\s+years[^\d]*)?((?<months>\d+)\s+months[^\d]*)?((?<days>\d+)\s+days)?" | fillnull years months days | eval d_age=(years*365)+(months*30)+days | table Age d_age years months days I assume your 457 for the first was assuming 1 year...   ... View more

Can you provide the query you are using? What happens when you tried what you tried? ... View more

How are you passing the date? Is this part of a dashboard query where the date comes from a token? In your example it looks like your macro starts with 'index=...' so implies it's the start of a search or a subsearch, so I am assuming your date is coming from a token. If so, then there's probably a different way to do this, by setting the earliest to be 4000 seconds prior to the latest Can you share more  about the context or your SPL   ... View more

exact() is an eval operation, so you can't use that as part of what looks like your search query, it has to be done in an | eval .... statement Can you give an example of how you are using the macro and at what point in the search? Where is your original time variable parameter coming from that you are passing in.   ... View more

@amask38 @PickleRick There is actually a reference in the docs about subsearches and the 'search' and 'query' field names here https://docs.splunk.com/Documentation/Splunk/latest/Search/Changetheformatofsubsearchresults and a couple of really old community posts from 2010 https://community.splunk.com/t5/Splunk-Search/Subsearch-fields-quot-query-quot-quot-search-quot-How-do-I-know/m-p/62422 https://community.splunk.com/t5/Splunk-Search/Can-a-subsearch-return-only-the-value-without-the-fieldname/m-p/11212   ... View more

A typical way to do this is to have a hidden search (in this example I put it in a visible panel) that will do calculations based on the timepicker value - as you can see from the search it uses addinfo command to get the info_min_time and info_max_time values and then makes tokens based on those so it handles the case where someone creates a strange time range in the picker. Save this example as a dashboard and you can see that whatever you select in the time picker, the timechart will show a week prior to that also. <form> <label>Time Picker</label> <init> <set token="earliest">-24h</set> <set token="latest">now</set> </init> <fieldset submitButton="false"> <input type="time" token="TimePicker"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Simple pie covering $pie_range$</title> <chart> <search> <query>index=_audit | stats count by user</query> <earliest>$TimePicker.earliest$</earliest> <latest>$TimePicker.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">none</option> </chart> </panel> <panel> <title>Simple timechart covering $tc_range$</title> <chart> <search> <query>index=_audit | timechart span=1d count by user</query> <earliest>$earliest$</earliest> <latest>$TimePicker.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>Calculation panel that determines 7 days prior to TimePicker value</title> <table> <search> <done> <set token="earliest">$result.earliest$</set> <set token="pie_range">$result.PieRange$</set> <set token="tc_range">$result.TCRange$</set> </done> <query>| makeresults | addinfo | eval earliest=info_min_time - 604800 | eval PieRange=strftime(info_min_time, "%F %T")."-".strftime(info_max_time, "%F %T") | eval TCRange=strftime(earliest, "%F %T")."-".strftime(info_max_time, "%F %T") | table earliest PieRange TCRange</query> <earliest>$TimePicker.earliest$</earliest> <latest>$TimePicker.latest$</latest> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   ... View more

Pretty sure you can combine some of the examples to get where you want to get to - using tokens from button clicks - there is a button click/token set example - and the expansion example should help you get there.   ... View more

@yuanliu It wasn't a script, just a curl command (webtools app) in the SPL where the API supports a format parameter. I realise I could have made the whole thing script based and used the REST API, but wanted to avoid that - most things are possible in SPL, so was looking for an SPL specific solution.   ... View more

Nice @ITWhisperer I was wondering how to push the titles down so I didn't have to hard code the mvindex offsets. I rarely use filldown, but this is a perfect use case. Here's a sample of the data when collecting it as CSV, not tab delimeted. I will need to validate whether I am ever using commas in the data and maybe revisit the tab variant.  (EDIT: Yes I am but the created lookup contains quoted field data, so commas are not treated as field delimeters) Neat technique for row association with the streamstats to anchor the data before the mvepand. Thanks!   \"iNote\",\"iWine\",\"Type\",\"iUser\",\"Vintage\",\"Wine\",\"SortWine\",\"Locale\",\"Producer\",\"Varietal\",\"MasterVarietal\",\"Designation\",\"Vineyard\",\"Country\",\"Region\",\"SubRegion\",\"Appellation\",\"TastingDate\",\"Defective\",\"fAllowComments\",\"Views\",\"Name\",\"fHelpful\",\"fFavorite\",\"Rating\",\"EventLocation\",\"EventTitle\",\"iEvent\",\"EventDate\",\"EventEndDate\",\"TastingNotes\",\"fLikeIt\",\"CNotes\",\"CScore\",\"LikeVotes\",\"LikePercent\",\"Votes\",\"Comments\",\"cLabels\" \"9537078\",\"1519682\",\"Red\",\"94404\",\"2012\",\"Wolf Blass Black Label\",\"Wolf Blass Black Label\",\"Australia, South Australia\",\"Wolf Blass\",\"Cabernet-Shiraz Blend\",\"Red Blend\",\"Black Label\",\"Unknown\",\"Australia\",\"South Australia\",\"Unknown\",\"Unknown\",\"27/11/2021\",\"False\",\"True\",\"17\",\"username\",\"\",\"0\",\"93\",\"\",\"\",\"\",\"\",\"\",\"\",\"True\",\"4\",\"92\",\"2\",\"1\",\"0\",\"0\",\"237\" \"9537066\",\"2452851\",\"White\",\"94404\",\"2014\",\"Xanadu Chardonnay Reserve Margaret River\",\"Xanadu Chardonnay Reserve Margaret River\",\"Australia, Western Australia, South West Australia, Margaret River\",\"Xanadu\",\"Chardonnay\",\"Chardonnay\",\"Reserve\",\"Unknown\",\"Australia\",\"Western Australia\",\"South West Australia\",\"Margaret River\",\"3/11/2021\",\"False\",\"True\",\"23\",\"username\",\"\",\"0\",\"95\",\"\",\"\",\"\",\"\",\"\",\"Seems to be improving. A perfect accompaniment to prosciutto\",\"True\",\"6\",\"92.8333333333333\",\"6\",\"1\",\"0\",\"0\",\"35\" \"9516281\",\"2778467\",\"White\",\"94404\",\"2016\",\"Weingut Thörle Saulheimer Hölle Riesling trocken\",\"Thörle, Weingut Saulheimer Hölle Riesling trocken\",\"Germany, Rheinhessen\",\"Weingut Thörle\",\"Riesling\",\"Riesling\",\"trocken\",\"Saulheimer Hölle\",\"Germany\",\"Rheinhessen\",\"Unknown\",\"Unknown\",\"28/11/2021\",\"False\",\"True\",\"138\",\"username\",\"\",\"0\",\"93\",\"\",\"\",\"\",\"\",\"\",\"Paired well with Barramundi and sweet potato fries Colour: Pale gold Nose: Medium P: Lemon rind, peach, orange S: cream T: honey Palate: Dry, high acidity, medium alcohol, full bodied, pronounced flavour, medium finish P: pear, peach, lemon S: bread T: nutmeg, caramel B: 1 L: .5 I: .5 C: 1 Very good wine\",\"True\",\"5\",\"91\",\"3\",\"1\",\"0\",\"0\",\"45\" \"9478838\",\"1973540\",\"White - Sweet/Dessert\",\"94404\",\"2008\",\"Telmo Rodríguez Moscatel Málaga Molino Real\",\"Rodríguez, Telmo Moscatel Málaga Molino Real\",\"Spain, Andalucía, Málaga\",\"Telmo Rodríguez\",\"Moscatel\",\"Muscat\",\"Molino Real\",\"Unknown\",\"Spain\",\"Andalucía\",\"Unknown\",\"Málaga\",\"14/11/2021\",\"False\",\"True\",\"47\",\"username\",\"\",\"0\",\"91\",\"\",\"\",\"\",\"\",\"\",\"Beautiful colour. As LUXURYSOTOGRANDE says, great with meringue. Eaten with Eton mess - great pairing. ^ Colour: Medium amber Nose: Pronounced Primary: Floral, honey, sultanas, dried fruit Tertiary: honey Palate: Sweetness: Medium Acid: Medium Alcohol: Medium Body: Full Intensity: Pronounced Primary: Secondary: Tertiary: Finish: long BLIC:1+1+1+.5=3.5(very good)\",\"True\",\"3\",\"92.3333333333333\",\"3\",\"1\",\"0\",\"0\",\"27\" \"9431031\",\"3300231\",\"Red\",\"94404\",\"2017\",\"Girolamo Russo Etna 'a Rina\",\"Girolamo Russo Etna 'a Rina\",\"Italy, Sicily, Etna DOC\",\"Girolamo Russo\",\"Nerello Blend\",\"Nerello Mascalese\",\"'a Rina\",\"Unknown\",\"Italy\",\"Sicily\",\"Unknown\",\"Etna DOC\",\"2/10/2021\",\"False\",\"True\",\"65\",\"username\",\"\",\"0\",\"93\",\"\",\"\",\"\",\"\",\"\",\"\",\"True\",\"50\",\"90.2888888888889\",\"28\",\"0.964285714285714\",\"0\",\"0\",\"378\" \"9431029\",\"2748345\",\"Red\",\"94404\",\"2013\",\"Vasarelli Cabernet Franc Family Reserve\",\"Vasarelli Cabernet Franc Family Reserve\",\"Australia, South Australia, Fleurieu, McLaren Vale\",\"Vasarelli\",\"Cabernet Franc\",\"Cabernet Franc\",\"Family Reserve\",\"Unknown\",\"Australia\",\"South Australia\",\"Fleurieu\",\"McLaren Vale\",\"9/10/2021\",\"False\",\"True\",\"30\",\"username\",\"\",\"0\",\"93\",\"\",\"\",\"\",\"\",\"\",\"This was a real surprise, having languished in the cellar, but it really benefited from the bottle age. Wish I had more e\",\"True\",\"3\",\"91.6666666666667\",\"2\",\"1\",\"0\",\"0\",\"1\" \"9430768\",\"2665536\",\"Red\",\"94404\",\"2016\",\"Bass Phillip Gamay\",\"Bass Phillip Gamay\",\"Australia, Victoria, Gippsland\",\"Bass Phillip\",\"Gamay\",\"Gamay\",\"Unknown\",\"Unknown\",\"Australia\",\"Victoria\",\"Gippsland\",\"Gippsland\",\"23/09/2021\",\"False\",\"True\",\"42\",\"username\",\"\",\"0\",\"92\",\"\",\"\",\"\",\"\",\"\",\"Medium garnet Nose: Medium, cranberry, red cherry, blackberry Tertiary: wet leaves and leather Palate: Dry, medium tannin, medium alcohol, medium body, pronounced flavour intensity, high acidity Cranberry, sour cherry, spice, blackberry Tertiary cigar box Very good\",\"\",\"3\",\"92.6666666666667\",\"1\",\"1\",\"0\",\"0\",\"9\" \"9403764\",\"2624186\",\"Red\",\"94404\",\"2014\",\"Elderton Shiraz Single Vineyard Command\",\"Elderton Shiraz Single Vineyard Command\",\"Australia, South Australia, Barossa\",\"Elderton\",\"Shiraz\",\"Syrah\",\"Single Vineyard\",\"Command\",\"Australia\",\"South Australia\",\"Barossa\",\"Barossa\",\"2/10/2021\",\"False\",\"True\",\"229\",\"username\",\"\",\"0\",\"93\",\"\",\"\",\"\",\"\",\"\",\"Deep garnet Nose Pronounced intensity Primary Black pepper, black fruit, eucalyptus Secondary Leather Tertiary Espresso Palate Dry, medium tannins, medium bodied, pronounced flavour, high acidity. Primary Blackberry, black cherry Tertiary Chocolate Leather Long finish Balance 1 Length 1 Intensity 1 Complexity 1 Outstanding wine Great with a beef/cheese/bacon burger\",\"True\",\"9\",\"91\",\"6\",\"1\",\"0\",\"0\",\"455\" \"9351221\",\"2446705\",\"Red - Sparkling\",\"94404\",\"1001\",\"Robert Stein Shiraz Sparkling Shiraz\",\"Robert Stein Shiraz Sparkling Shiraz\",\"Australia, New South Wales, Central Ranges, Mudgee\",\"Robert Stein\",\"Shiraz\",\"Syrah\",\"Sparkling Shiraz\",\"Unknown\",\"Australia\",\"New South Wales\",\"Central Ranges\",\"Mudgee\",\"3/09/2021\",\"False\",\"True\",\"98\",\"username\",\"\",\"0\",\"92\",\"\",\"\",\"\",\"\",\"\",\"Smooth, round, soft bubbles and full mouth. Sweet, with a long finish\",\"True\",\"2\",\"92\",\"1\",\"1\",\"0\",\"0\",\"5\"     ... View more

OK, I think I figured it out - it was original a tab delimited input, but I changed it to csv and used this | rex field=curl_message max_match=0 "(?<row>(\"[^\"]*\",?){39})" | fields row | mvexpand row | rex field=row max_match=0 "(?s)\"(?<x>[^\"]*)\",?" | fields x | eval iNote=mvindex(x,0,0), iWine=mvindex(x,1,1), ... using mvindex for each of the 39 fields. Any other suggestions welcome   ... View more

Yes @PickleRick - totally agree about subsearches ... View more

Have you looked at the Splunk Dashboard Examples app - it gives lots of examples of how to do things in dashboards, either through standard techniques or Javascript. https://splunkbase.splunk.com/app/1603/   ... View more

If your CSV looks like this and it's in a file called events.csv, then all you need is this query | inputlookup events.csv | eval Date=strptime(Date."-01","%B %Y-%d") | sort 0 Date | table Date * You don't need to use the timechart as your data is already in the format a timechart would create @ITWhisperer 's solution is perfectly good for your data as it stands, so unless it makes sense for you to change the data, just use his solution. If you are going to use the data in many places, just create a macro that would do all the initial load and transpose so your query just uses the macro to keep it clean. If you change your data format you just change the macro and everything will continue to work.   ... View more

Transpose the CSV, so the rows are months and the columns are categories. That is how the timechart command will work to produce data for a time based chart where date is on the X axis.   ... View more

If I understand you correctly, you are getting the sum of "ofAField" in a 15 minute period. In that case, what exactly should the average show for that 15 minute period - I am assuming you are looking for a flat line of the average across your time range. In that case, you would do this | makeresults count=1000 | streamstats c | eval _time=_time-(c*10) | eval task=mvindex(split("taskA,taskB,taskC,taskD", ","), random() % 4) | eval ofAfield=random() % 100 | timechart span=15m sum(ofAfield) as sumofAfield by task | eventstats avg(*) as avg_* The last two lines are what you want, i.e. you first take the sum of 'ofAfield" and then use eventstats to compute the average Then using a bar chart with an overlay of the average fields you can produce this sort of output - is this what you wanted?   ... View more

@kirti_gupta12  See this example dashboard that has a time picker and 2 panels. The first panel is a simple search that does a count on events. The second panel shows you how you can manage the user's time selection. You don't need to have this second panel visible, you can either hide it using <panel depends="$hidden$"> or you can just take the <search> fragment and put it at the root of your dashboard. The idea is that the real search uses time selection based on tokens that are calculated by the second panel rather than the time picker. The second panel DOES use the time picker values and then does the 30 day check and controls as required. <form> <label>Time Picker Control</label> <init> <set token="earliest">-24h</set> <set token="latest">now</set> </init> <fieldset submitButton="false"> <input type="time" token="time_range"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> <change> <eval token="earliest">if(relative_time</eval> </change> </input> </fieldset> <row> <panel> <title>Simple timechart</title> <chart> <title>$ranges$</title> <search> <query>index=_audit | timechart span=1h count</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> </chart> </panel> <panel> <title>Calculation panel that limits historical range</title> <table> <search> <done> <set token="earliest">$result.earliest$</set> <set token="latest">$result.info_max_time$</set> <set token="ranges">$result.ranges$</set> </done> <query>| makeresults | addinfo | eval min_time=now()-(30*86400) | eval earliest=if(info_min_time &lt; min_time, min_time, info_min_time) | eval initial_range="Time Picker range: ".strftime(info_min_time, "%F %T")." to ".strftime(info_max_time, "%F %T") | eval limited_range="Search range ".strftime(earliest, "%F %T")." to ".strftime(info_max_time, "%F %T") | eval ranges=mvappend(initial_range, limited_range) | table ranges earliest info_min_time info_max_time</query> <earliest>$time_range.earliest$</earliest> <latest>$time_range.latest$</latest> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> Hope this helps By the way using  | timechart span=1h count by _time is not correct.  You do not need 'by _time' with timechart as that is what it does anyway. ... View more

You need to grab the fields from your ST2 data row with rex, e.g. try this example | makeresults | eval x=split("id=1 title=one,id=2 title=two,id=3 title=three", ",") | mvexpand x | eval _raw=x | extract | table id title _raw | append [ | makeresults | eval _raw="1 \"GET https://www.example.com?q1=one\" 2 \"GET https://www.example.com?q1=test&q2=test2\" 3 \"GET https://www.example.com?q3=thr\"" | multikv noheader=t | table _raw ] | rex field=_raw "^(?<id>\d+).*\?(?<params>.*)" | stats values(*) as * by id | table id title params  Note that the rex statement must only grab the id and params from the ST2 sourcetypes, so this relies on _raw from ST1 NOT matching the rex pattern, so that id from the ST1 is not overwritten by an extraction.   ... View more

@arusoft  Note that using eventstats is not the fastest operation and if you have a clustered index environment, will cause the data to be pushed to the search head for the operation to run there. I couldn't immediately think of a way to avoid that, that would avoid some more complex logic involving creating complex fields and using mvexpand after a normal stats. Anyway, test as needed. One thing you should do before using eventstats is to use the fields command to minimise the data that will end up going to the search head. In the above, you would do | fields - EmailX EmailY DateLogin before the eventstats. ... View more