Give this a try: (index=abc host=xyz) OR index=aaa | eval session_id=coalesce(session, session_id) | stats values(System) AS System BY session_id ... View more

Do all the potential values for computerdisconnected get formatted like that? If so, this might work: your base search NOT "[bob*" OR "[tube*" So that's literally whatever you're searching for right now followed immediately by NOT "[bob*" OR "[tube*" . The opening square brackets matter, I believe. ... View more

What you are describing is the expected behavior of the command you provided. Let's look at the stats command: | stats avg(TotalTime) BY TotalTime This doesn't really make sense as a command. Roughly translated to English, it says: "For each value of TotalTime, find all other events with the same value for TotalTime, and take the average of TotalTime." So if you have five events that each contain the TotalTime=12 , then Splunk will take all five events, sum up 12+12+12+12+12 and divide the total by the number of events (5) and return the average: 12 . And so on for every value of TotalTime that Splunk finds. So the command | stats avg(TotalTime) BY TotalTime will always yield two columns: avg(TotalTime) and TotalTime , and they will always have the same value. Follow that up with a table command that includes TotalTime but doesn't include avg(TotalTime) , and you'll only have values for TotalTime. That brings us to the second part of the issue at hand with the stats call: if you don't specify a field in the stats call, it won't pass through that part of the query. So no matter how many fields you had before you called | stats avg(TotalTime) by TotalTime , you will only be left with two fields afterwards: TotalTime and avg(TotalTime) . If you remove the table command from the end of your search, you'll see that. I'm not sure what quite what your intent is with the stats call, but I think you want the average of all TotalTime values as a column. If so, this might get you there: index="jenkins-cicd-*" source="**/ctest-metrics-summary.json" | rex max_match=0 field=_raw "(?<lineData>[^\n]+)" | mvexpand lineData | spath input=lineData path=env output=singleEnv | spath input=singleEnv | spath input=lineData | eval status=mvindex(status,1) | eval testRunStartTime=mvindex(testRunStartTime,1) | eval testRunEndTime=mvindex(testRunEndTime,1) | eval testFileName=mvindex(testFileName,1) | eval testCaseName=mvindex(testCaseName,1) | eval testCaseId=mvindex(testCaseId,1) | eval TotalTime = strftime(strptime(testRunEndTime , "%Y-%m-%dT%H:%M:%S.%3N") - strptime(testRunStartTime, "%Y-%m-%dT%H:%M:%S.%3N"), "%Mm %Ss %2Nms") | eventstats avg(TotalTime) AS AverageTime | table status testRunStartTime testRunEndTime testFileName testCaseName testCaseId TotalTime AverageTime ... View more

How about this: index=xyz host=server1 OR host=server2 OR host=server3 OR host=server4 | stats values(host) AS host, count, avg(time_taken) AS avg_time_taken BY cs_uri_stem | eval Silo=case(host="server1" OR host="server3", "Silo1", host="server2" OR host="server4", "Silo2", 1=1, "SILO NOT FOUND") | eval avg_time_taken=round(avg_time_taken, 2) | table cs_uri_stem count avg_time_taken Silo ... View more

My recommendation is to not convert the _time field with an eval but instead to use the command fieldformat to change how the value is displayed while retaining the original epoch string, which is easily sortable. That search would look like this: your base search that filters down to events in the desired time range | bucket _time span=1h | stats count(id) as "Unsuccessful Logins" by _time | sort _time | fieldformat _time=strftime(_time, "%b %d, %Y %I:%M:%S %p") ... View more

I'll assume that second lookup table is called my_lookup . You could meet your goals with a search structured like this: base search that creates the first table | search [| inputlookup my_lookup | eval search="Unit_Production".Operator.Unit_Production | fields Location Company search | format | rex mode=sed field=search "s/ \"([^ ]+)\" / \1 /"] The eval line is creating a field called search , which Splunk will preserve without the field name when it passes through the format command. You can read more about that here: https://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Changetheformatofsubsearchresults The final rex command is to get rid of the quotes around "Unit_Production>50", because Splunk will treat the quoted version as a string search (looking in your logs for the literal string sequence "Unit_Production>50" rather than events with the field Unit_Production with a value greater than 50. ... View more