I'm happy to try! Can you give me an example of what the results might be in the first panel and what you'd like to pass to the second panel? There is one very limiting condition for how this can be done with only SimpleXML, which is that the search event handler will only be able to access the first row of results. So if your first panel is returning a single row - then no problem. We just need to identify the field name of the value you'd like to pass, and it will be straightforward. But if your first panel is returning more than a single row of results, you'll need to use JavaScript to achieve this, I believe. If your first panel returns a single row of results and one field from that row is called model_name , and you'd like to pass that to the second panel, then the code above would change to this: <search>... <done> <condition match="$job.resultCount$ > 1"> <set token="show_panel">true</set> <set token="model_name">$result.model_name|s$</set> </condition> <condition> <unset token="show_panel"/> </condition> </done> </search> And then in your second panel's query, you'd reference model_name like this: index=something sourecetype=blah model="$model_name$" ... View more

Yes, it's possible to engineer a search to do what you're asking - search first for all the tickets observed in the last 30 days, find all their states, and then extend your search backwards for events whose creation was not found in the original time range. Possible to do, but unlikely to be the best approach. To help you brainstorm the actual best approach, can you define your goal? If you wanted to list the state of all tickets that were opened in the last 30 days, then searching back 30 days would suffice, because every state a ticket had been in would be contained in that window. But obviously that's not the case, so maybe you're searching for the history of all tickets that were closed in the last 30 days? That's a pretty different beast, since a ticket might have been opened 31 days ago or maybe 180 days ago, depending on the SLA for your tickets. If you can define your goal and describe any real-world limitations (e.g. "No ticket is allowed to exist in an open state for more than 45 days"), then I'm happy to help craft an appropriate search. ... View more

If you are consulting two lookup tables, it's unlikely that you need multisearch . You can string multiple lookup commands in a single query. Can you tell us more about what you're trying to do, and we can suggest a good approach? ... View more

Assuming you have an event containing (at least) two fields: sunrise_time="7:03 AM" and sunset_time="4:45 PM" , it would work like this: your base search | eval sunrise_time=sunrise_time." 2000-01-01", sunset_time=sunset_time." 2000-01-01" | eval sunrise_time=strptime(sunrise_time, "%I:%M %p %F"), sunset_time=strptime(sunset_time, "%I:%M %p %F") | eval daylight_time=(sunset_time-sunrise_time)/60/60 | timechart span=1d eval(round(avg(daylight_time),2)) by city ... View more

Sure thing. 🙂 In that case, your strptime will almost certainly function as expected if you append a static date to the timestamp. Any date will do, as long as you apply the same one to sunset and sunrise. So you could just choose a day like "1/1/2000" and always append that to your timestamp and then interpret the whole thing with strptime. ... View more

Also, you will get bugs if you are trying to interpret "16:45 PM" with "%I:%M %p", because 16 is not a valid value for %I. That would need to either be "4:45 PM" or it could just be "16:45" with a format string of "%H:%M" ... View more

Glad to hear it! ... View more

I'm guessing that your post is eating some characters, because this search command doesn't do anything at all, except throw an error: | rex field=_raw "(?.+)" and it makes even less sense to do it twice in a row. Can you edit your post and wrap the search queries in code blocks by highlighting the code and then clicking the 101010 button? ... View more

Given that you're only looking to preserve events where the "Ports Open" field contains a number (presumably), it might work to do this: | regex 'Ports Open'="/d+" I don't have access to Splunk at the moment, so that might need to be double-quotes around Ports Open . But that should filter you down to events where the value of Ports Open is a number. ... View more

The key won't display by default. If I want to view the key field, I add this to a search: | eval key=_key This will make it visible in tables/stats/etc. ... View more

You're welcome. Now that I'm looking back, I see I forgot the BY clause in the stats call. I'm going to update the post to fix that. ... View more

Fair enough! Thanks for running the experiments and sharing your results. I've definitely found with Splunk that it's worth the time to run experiments like this up front to tune my approaches, because what works well for one data set may not be as efficient for another. So you're very smart to set up these A/B tests and choose your final approach accordingly. ... View more

I want to help, but the screencaps are so limited in what they're displaying that I don't have much to work with here. Can you include the queries and the field headers? Or some sanitized version of the same? I just don't know what I'm seeing in those screencaps, sorry. ... View more

Hmm, I would expect that might be a default number of rows to be returned and wouldn't have thought it would limit the number of rows analyzed to produce the result, but you could certainly be right. ... View more

You can certainly test both approaches over your data set to see which completes more efficiently, but I'm pretty sure my approach is more efficient. Stats is almost always more efficient than eventstats, I believe, specifically because it discards extra fields immediately. ... View more

I think this query will get you the table you want: | stats values(Function) AS Function, count AS Count BY User, Machine ... View more

Glad to help! ... View more