even the eval after pipe | is not working for me | eval DAY= dayofwk(1) . I get the same error. Even tried the same query which you mentioned above and it doesn't work ... View more

I'm configuring it through WEB, and yes "Use eval-based definition?" is checked. Is it because I want to substitute this even before first pipe "|" and you are doing it in eval in your search query? does that matter? I want to filter this before first pipe | ... View more

Splunk replaces rising column itself, you need not specify it explicitly in the query. Try below. SELECT DISTINCT PRQ.RPT_QUEUE_ID, LRF.FORM_DESC,CU.USER_FULLNAME AS "Scheduled_By", PRQ.SCHEDULED_ON, PRQ.EXECUTION_DATE, MAX(PRS.TOTAL) AS "Total_Case_Count" , ROUND((MAX(PRS.END_DATE) - MIN(PRS.START_DATE)) * 3600,2) AS "Run_Time_in_Sec" FROM ARGUS_APP.PER_RPT_QUEUE PRQ, ARGUS_APP.PER_RPT_STATUS PRS, ARGUS_APP.LM_REPORT_FORMS LRF, ARGUS_APP.CFG_USERS CU {{ WHERE $rising_column$ > ?}} And specify your rising column in the field provided below the SQL query "Rising Column*" ... View more

you can use ...| dedup ID if you want to restrict your search to recent values of the same ID ... View more

The lookup file goes on to the search head.. More details here docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsfromexternaldatasources ... View more

In the past we tried something similar to the above solution and Splunk complained rising column CD doesn't exist. Is the above approach tested and worked? I'll test when I find some time.. ... View more

Check if the below thread helps http://answers.splunk.com/answers/153045/what-is-the-best-way-to-remove-leading-0s-from-a-field ... View more

You can try converting your time to epoch time and subtracting 604800 (604800 is number of seconds in a week) ... View more

You can try Sideviewutils - Gate module to achieve same page drill down http://sideviewapps.com/apps/sideview-utils/ OR If you are running Splunk 6.x you can make use of web framework to develop interactive views. You can download Web Framework Tool Kit examples from apps.splunk.com http://apps.splunk.com/app/1613/ ... View more

You're welcome 🙂 ... View more

if you want only one event per day, then try using something like this ... | dedup USERID, date_mday | stats count as LoginCount by USERID Running the above search for a 7 day period should give you what you are expecting ... View more

Check if this helps.. ... | dedup field1, field2 | stats list(field1) by field2 ... View more

Can you post some of the values of url? One more way would be filtering out the results where the url contains "zip" prior to your extraction url=*.zip ... View more

Check if this works (?i)portid=\"(?P .*?\d+)\W ... View more

Below post should get your started http://answers.splunk.com/answers/150509/how-to-get-events-around-identified-event ... View more

Thank you.. ... View more

You are welcome 🙂 ... View more

How does your event data look like when a user performs addition or deletion? Provide some sample data and what you are expecting out of it.. ... View more