Oh, don't bother with the makeresults example. That should just be a oneliner to show how map works: It doesn't add events or statistics to your existing data, it's like a new search where you provided the input parameters. You will often answers here that work with makeresults to provide a cut & paste example that works everywhere, just for conveniance. Since we all don't share a common data set, we often generate artificial data for a search, and makeresults comes in handy to execute the search. If you need the fields that were available before the map command, I guess you could just add them inside the map like eval Measurement=Measurement/304.8, StartTime=$StartTime$, EndTime=$EndTime$, WorkOrderNumber=$WorkOrderNumber$... ... View more

Yeah, you don't want to use join . Let's pretend your sourcetypes are "msglog" and "infolog": (index=A sourcetype=msglog) OR (index=B sourcetype=infolog) | eval id=case(sourcetype="msglog",clID,sourcetype="infolog",httpSessionId) | stats values(userId) as userId values(method) as method by id should get be pretty close to what you want. Tip: Look up the "Let stats sort them out" session recording by Nick Mealy at .conf2016 🙂 Hth, -Kai. ... View more

I think this is one of the few cases where I'd actually look into the transaction command. Something like: <your base search> | transaction startswith=Value>90 endswith=Value<=90 | stats values(collection) values(instance) values(duration) by _time should work for you. Look at the docs for transaction, there are more advanced paramters that might help you as well. Hth, -Kai. ... View more

For one thing, I am pretty sure StartTime EndTime WorkOrderNumber MaterialName are empty after your mapped search. See: | makeresults | eval foo="1;2;3" | makemv delim=";" foo | mvexpand foo | map search="makeresults | eval bar=$foo$" - you'll only have bar in the end, not the field foo defined before the mapped search. The other thing, playing with it and data that does not correlate to your specific use case at all, I noticed I had an empty EndTime in my first row of the input table to the map command, preventing it to run at all. After I added where EndTime>StartTime before the map command, I at least got a table with Measurement calculated. Hth, -Kai. ... View more

If this is cut and paste from your actual query, lose the space between field= and Scores. 🙂 ... View more

Uh, sorry for that. We have a very large setup, and I didn't notice that issue. ... View more

I wasn't even aware that "search" seems to be a reserved field name for an inner search used this way. And yes, it only seems to give back the first result, not the whole table, as search input for the base search. So the rexed msgid is part of the "to" field? Then try this maybe: index=email [search index=email from=bad_email_address | rex mode=sed field=msgid "s/[<>]//g" | eval to="*".msgid."*" | fields to ] Thats will resolve to index=email (to=*msgid1*) OR (to=msgid2) OR (to=... etc You are limited to 50000 msgids that with that. ... View more

I'd actually avoid append here. index=int source="HK" OR source="SG" FUNCTION=* | chart sum(PERCENT90) over FUNCTION by source should be faster... ... View more

It would be helpful to see what you are doing with the data, other than "table". Maybe your use case can be done with sourcetype=A OR sourcetype=B | rename your.very.long.field.name as rid | eval request_id=coalesce(req, rid) | stats <your logic> by request_id | table your result ... View more

So you are using the search on "asset-list" to get a list of hosts to use as filter for event in sourcetype="alert-lists"? Then you can do it like this: sourcetype="alerts-list" [ | inputlookup "asset-list" | SEARCH PROD_CAT_2="Database" PROD_CAT_3="SQL Server" STATUS="Deployed" | rex field=NAME "(?<Hostname>[^\\\]+)" | fields Hostname ] | table AlertName, _time, AlertDescription, ServerName, ServerRole That is, if you have less than 50,000 hosts as result from your inputlookup search. ... View more

Well, this should work already for any list. The filter is "(\/[^\/]+){3}/*" regardless of the directory names, I just filtered for anything that has at least three leading sections with "/...". ... View more

You could filter with the regex command maybe. run all example: | makeresults | eval Listdir="/opt/test/class/#/opt/#/opt/test/learn/#/opt/test/class/file/#/opt/#/opt/test/class/file/location/users/" | makemv delim="#" Listdir | mvexpand Listdir | regex Listdir="(\/[^\/]+){3}/*" So the last line is the actual filter, the rest was to test it. 🙂 Hth, -Kai. ... View more

"makeresults" is what is being used a lot here to generate artificial result sets, since people don't have the same raw data as other people. So you could cut and paste my last answer without any additional base search to play around with it. Sorry, I took that for granted. So what about sourcetype="Raccess" (host="AVOP" OR host="BVOP") date_wday!=saturday AND date_wday !=sunday | rex field=_raw "^(?<ips>\S+)\s\|\s(?<protocol>\S+)\s\|\s(?<id>i\S+)\s\|\s([^\|]+\|\s){8}(?<id_no>\S+)" | stats values(id_no) Doesn't that work? If not, then your raw data doesn't probably exactly match what you posted here, or I may be misunderstanding something. It happens, I am so used to using Splunk in a certain way with certain data sets and questions, that I automatically misunderstand in my own way. 🙂 ... View more

Would you mind putting your code into code blocks? 🙂 Well, it wasn't meant to be used as rex command, I thought of field extraction on the sourcetype in question, and then doing a search with that. That being said, in my test it works with rex. If you insist on not extracting the field on i* (I just discarded those events with the NOT like() clause), you could do that directly in rex as well, eg rex field=input "^(?<ips>\S+)\s\|\s(?<protocol>\S+)\s\|\s(?<id>i\S+)\s\|\s([^\|]+\|\s){8}(?<id_no>\S+)" will only extract when id starts with "i", and then you can lose the "where NOT". At least this works when I pipe your example through, like | makeresults | eval input="40.156.209.1 | ssh | i*4RAGZLx404x22840423x1 | JG25721 | 2018-06-20 06:44:51,219 | SSH - git-upload-pack '/dga/dgiodbatc.git' | - | 0 | 4 | 1911 | cache:miss, refs, ssh:user:id:126642 | 2140 | 1hgs9dp |" | rex field=input "^(?<ips>\S+)\s\|\s(?<protocol>\S+)\s\|\s(?<id>i\S+)\s\|\s([^\|]+\|\s){8}(?<id_no>\S+)" | stats values(id_no) if I change the input on that to id=o*...., you don't get anything, but you get 2140 as is. ... View more

Hmm, I just played with base search | makemv delim="," rl | stats sum(rl) as total values(answertime) as answertime values(whateverIwanttokeep) as whatever by _raw | fields - _raw That might be faster than my eventstats approach. A simple function to evaluate a string with math in it does not seem to exist. 🙂 ... View more

Hmm, I can't make your result work in a real search. I don't have the value data in inner search right? Ok, sometimes I speak gibberish. Back: my events have a string field, let's keep it short, "rl". This contains either one integer or a list of comma separated integers. I want to calculate the total of that list for each event and keep other fields of the event as well. Since I can convert the comma separated "1,2,3,4,5..." with rex or replace into "1+2+3+4+5+6...." I was wondering if there is a simple way to feed that string into a function to get the total. ... View more

Does your base search return anything without the timechart? I am just wondering, as you use field1="*License threshold*" in your search, when it is called "licthreshkey" in your field extraction. ... View more

You are clearing it here: | stats count by src_ip,dest_ip - after that, you only have count, src_ip and dest_ip Regards, -Kai. ... View more

I understood it like he wants to have a weekly rolling dc(user.id) over the last 3 months, so the time ranges always overlap. And if that's the case, I'd really go with a summary index, having a weekly search over the last 3 months. Easy to use, and depending on the amount of data a hell of lot faster to display in the end, when you just pull the precalculated results for each week. ... View more