You could use a different representation if that fits your needs, eg: .....search | eval Type=case(like(publishId,"%U"),"unsubscribed",like(publishId,"%S"),"subscribed") | chart count over tile Type | addcoltotals More in spirit of the original representation maybe: .....search | eval Type=case(like(publishId,"%U"),"unsubscribed",like(publishId,"%S"),"subscribed") | stats count by tile Type | sort Type | stats list(Type) as Type list(count) as Count by tile | eventstats sum(Count) as Total by tile but there must be something more elegant. 🙂 ... View more

Maybe this gives you what you want? index=A sourcetype=A OR (index=B ...more filters) | chart count over memberID by index | where A=0 AND B>0 ... View more

It would be easier if you give a search as example. You might be able to get what you need by using the "return" function. In this example, result will be "ok", because the string "foo=\"something\" OR foo=\"whatever\"" will be turned into a boolean expression by return: | makeresults | eval foo="something" | eval result=if([|makeresults | eval string="foo=\"something\" OR foo=\"whatever\""|return $string],"ok","nok") So your lookup would go into the if clause, finished by a return. Hth, Kai. ... View more

You could use meta information in the forwarding config, but I think it's easier to just use a calculated field (if you haven't too many different sourcetypes). So just add a new calculated field per sourcetype named retention and enter the required retention time as integer in the "Eval expression" field. Hth, Kai. ... View more

If you only need the eventcount, then this should do the trick: index=foo sourcetype=A OR sourcetype=B Device_MAC_Address=* | eval isFromA=if(sourcetype=="A",1,0) | eval isFromB=if(sourcetype=="B",1,0) | stats sum(isFromA) as A sum(isFromB) as eventcount by Device_MAC_Address | search A>0 eventcount>0 | fields - A You may wanna watch this presentation, it gives you a good start in questions like this: http://conf.splunk.com/sessions/2016-sessions.html#search=Let%20Stats%20Sort%20Them%20Out& Hth, -Kai. ... View more

What about <your search> | rex field=starttime "\S{10}\s(?<Hour>\d\d)" | stats count by Hour, Category Regards, Kai. ... View more

Works as well. I think I prefer your first solution though, makes dealing with different component names a tad bit easier. There is no "Accept" Button to mark your solution as correct? Regards, Kai. ... View more

Thanks, that does exactly what I asked for with real data. Although now that leaves me to additional problems, I'll see what I can do about those. Anyway, your solution is correct for me! ... View more

What about using a radio button to switch? This is an example that runs fine: <form> <label>Toggle Scale Example</label> <description>(Of course the radio button could also be global and used for several charts in parallel.)</description> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="radio" token="chartstyle" searchWhenChanged="true"> <label>chart scale</label> <choice value="linear">linear</choice> <choice value="log">logarithmic</choice> <default>linear</default> </input> <chart> <search> <query>index=_internal | timechart span=5s count by source</query> <earliest>-2m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">$chartstyle$</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> </form> ... View more

I can see calculating percentage diff per msg between appVersion if I tilt the table. I cannot really tilt it back afterwards, but maybe you can live with that? <your search> | eval appVersion="v_"+appVersion | eventstats count as total by appVersion | eventstats count as splitcount by appVersion msg | eval percent=round(splitcount/total*100,2) | chart values(percent) over msg by appVersion | eval diff =v_21.30 - v_21.33 (I don't know if we need to append v_ to the appVersion for doing the diff calc later), That's still not really good because I guess you don't want the appVersion hardcoded, right? ... View more

Hi, You can autogenerate the monthly names as well, they would be ordered in reverse chronological order. Also, you can already calculate the end for the search as well in that search. This is a working example, it should be rather close to what you are looking for: <form> <label></label> <fieldset submitButton="false" autoRun="false"> <input type="dropdown" token="begin" searchWhenChanged="true"> <label>Month</label> <fieldForLabel>month</fieldForLabel> <fieldForValue>begin</fieldForValue> <search> <query>| makeresults | timechart span=1mon count | eval month=strftime(_time,"%B %Y")| eval begin=_time| eval end=relative_time(_time,"+1mon")</query> <earliest>-12mon@mon</earliest> <latest>@mon</latest> </search> <change> <set token="end">$row.end$</set> </change> </input> </fieldset> <row> <panel> <chart> <search> <query>index=_internal | timechart span=1d count</query> <earliest>$begin$</earliest> <latest>$end$</latest> </search> </chart> </panel> </row> </form> Hth, -Kai. ... View more

Now I think I nailed it. I uploaded a .csv with this content: allowed domain1.com domain2.com domain4.com and created a lookup called "allowed" with that (I should have better chosen names for lookup and field, I was confused by that later myself). This is used in a query like this: | makeresults | eval recipient="user@domain1.com,user@domain2.com-user@domain1.com-user@domain1.com,user@domain3.com-user@domain2.com-user1@domain2.com,user2@domain2.com-bla@domain4.com-bla@domain4.com,user@domain3.com-user@domain4.com,user@domain1.com" | makemv delim="-" recipient | mvexpand recipient | eval orig_to=recipient | makemv delim="," recipient | rex field=recipient "^[^@]+@(?<domains>.+)$" | eval domains=mvdedup(domains) | lookup allowed allowed as domains OUTPUT allowed AS matched | eval result=if(mvcount(domains)=mvcount(matched),"included","excluded") | fields - domains matched And the result looks fine to me, I hope I got all cases covered: I went through some terrible iterations, but I hope this one is correct. 🙂 ... View more

And then again, it works as expected when I do it the other way round, start with the inputlookup for the whole table, then add the count for things that are found, then fill count with 0. I got no more duplicated ids then, as the count is correct for the ids found, 0 for non found. No appendcols, just append... | inputlookup your_lookup | append [ search sourcetype=serverevents [| inputlookup your_lookup | fields servername ] |stats count by servername] | stats first(*) as * by servername | fillnull count I double checked the result of that now within my data sets, this should be fine. ... View more

Well, I honestly tried that out with one of our own lookup files, where I have ~100 lines in the lookup. I got a count > 0 for like 20 of those on a limited data set without the appendcols, and adding the appendcols added the unused entries with count=0 as well. Don't know why it doesn't work for you, Sorry. 🙂 edit: actually, I shut up on this one. I didn't check my ids reappearing, and that even makes sense. So yeah, I am wrong. 🙂 ... View more

Can you try |u to escape URL special chars? I usually set me a token with my drilldown search, so something in the spirit of this: <drilldown target="_blank"> <set token="drill">search?q=index=* host=* sourcetype="*" user="*" useradd "new user:"| rex "^[^=\n]*=(?P<userOfInterest>\w+)"&amp;earliest=-24h@h&amp;latest=now</set> <link>$drill|u$</link> </drilldown> ... View more

If the session and order fields are exclusively used on the source where you want to count them, you can simply combine your searches: (index="SessionController" host = "abc01*") OR (index="CompleteSale" host = "xyz*") | stats distinct_count(session) distinct_count(order) by date_hour ... View more

Yes, and that is totally fine. Consider this example with 3 events in 2 hours: 16:00 field=123 16:01 field=234 17:01 field=123 If you do a dc(field) for first hour, you get 2 as result, because you have 2 different values for field. If you do a dc(field) for the the second hour alone, you get 1 as result, because there is only one value of course. that doesn't mean though, that you get 3 as result if you do a dc(field) for the whole time. The result is 2, there are still only two distinct values for field. So having the sum of dc() first hour and dc() second hour which is 3 is different than the dc() over the whole time range. That is perfectly fine. Your example tells us that 9 field values happened both in the first and the second hour, the rest were distinct for each hour. ... View more