Hi, I'm trying to create report, where I am extracting data from two different sources. This data being extracted from both sources share the same item number value. So the structure is something like this: ITEM | src1 Field 1 | src1 Field 2 | src2 Field 1 | src2 Field 2 11111 0 0 0 0 12121 8 8 8 8 13222 7 7 7 7 Essentially, what I want to do is extract data from both sources for the relevant fields for a specific ITEM. Can someone suggest what I can do to achieve this? EDIT: Apologies, I haven't been able to seperate the values for each fields. Basically, Each src field has only on Integer value. ... View more

Hi, I'm trying to count the number of rows in a field that have a non-zero value. I've used replace to do that, but I get the feeling that Splunk is counting the rows that have zero values, which is not what I want it to do. I know it's not working because I'm running two searches that have the same query, BUT, the source is different. Upon running, I'm getting identical results i.e. the number of rows for both sourcetype is the same. Query: 1 index=xxx sourcetype=xxx source=yyy | table ITEM, DEPT, *_2017, *_2018 | replace "0" WITH "" IN 03_DEC_2017 | replace "0" WITH "" IN 04_DEC_2017 | replace "0" WITH "" IN 05_DEC_2017 | stats count(*_2017) by DEPT Query2: index=xxx sourcetype=xxx source=xxx| table ITEM, DEPT, *_2017, *_2018 | replace "0" WITH "" IN 03_DEC_2017 | replace "0" WITH "" IN 04_DEC_2017 | replace "0" WITH "" IN 05_DEC_2017 | stats count(*_2017) by DEPT I need to find way of counting rows that are NOT "" OR ideally NOT 0. Please help! ... View more

Hi, I'm trying to extract the date from a filename without having to configure the config.file, i want to be able to achieve this through the search panel. This is my file name: name_name_20171130.txt This is the regular expression I've found that is the closest to helping me achieve what I need: source="name_name_20171130.txt" host="xxx" | rex field= source="(?<date>[\d/]+)\s\w+" |table _raw ITEM, SOH_DIFF, field Alternatively, this expression: (?\d{8}) Please Help! ... View more

Hi, I'm trying to list data per field. I've used stats list which works partially, it lists all the data for both fields into a single field. This is what I want: USER ERROR ------------------------- user1 error1 error2 error3 ------------------------- user2 error4 error5 However, this is what I'm getting: USER ERROR ------------------------- user error1 error 2 error 3 error 4 error 5 ------------------------- user2 This is my query: index=xxx sourcetype=xxx host=n | fieldsummary | fields field,count | regex field="^([A-Z_]+)$" | rename count as Count_V8 | join field [search index=drv sourcetype=xxx host=N|fieldsummary | fields field,count | regex field="^([A-Z_]+)$" | rename count as Count_V14] | eval match=if(Count_V8==Count_V14, "match", "No Match") | eventstats max(Count_V14) AS maximum_V14| eval internal_diff=if(maximum_V14==Count_V14, "== Max Value", "<Max value") | eval All_Fields=if(internal_diff=="<Max value", field, "safe") | where All_Fields !="safe" | appendcols [search index=drv sourcetype=nl_loca_chain | where isnull(All_Fields) | rename _raw as Raw | stats list(Raw)] The appendcols subsearch bit is the most relevant bit. I've tried sticking "by field" after stats list(Raw) but it doesn't work. Please Help! ... View more