Not all IPs information will be available on the 3rd party databases: https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Iplocation Extracts location information from IP addresses by using 3rd-party databases. The IP address that you specify in the ip-address-fieldname argument, is looked up in the database. Fields from that database that contain location information are added to each event. The setting used for the allfields argument determines which fields are added to the events. Because all the information might not be available for each IP address, an event can have empty field values. ... View more

Do an eval to and feed us back if the result of the isnull is true or false sourcetype=xxxx RUNID=* StartTime=* EndTime=* TaskStart=* Process=* | eval Process=substr('source',1,5) | stats values(TaskStart) as StartTime, values(TaskEnd) as EndTime by RunID, Process | table RunID, StartTime, EndTime, Process | eval mvc_EndTime=mvcount(EndTime), mvc_StartTime=mvcount(StartTime) | where mvc_EndTime==1 AND mvc_StartTime==1 | eval isnullRunID=if(isnull(RunID),1,0), isnullStartTime=if(isnull(StartTime),1,0) ... View more

@niketnilay solution for the first part is better: sourcetype=xxxx RUNID=* StartTime=* EndTime=* TaskStart=* Process=* | eval Process=substr('source',1,5) | stats values(TaskStart) as StartTime, values(TaskEnd) as EndTime by RunID, Process | table RunID, StartTime, EndTime, Process | eval mvc_EndTime=mvcount(EndTime), mvc_StartTime=mvcount(StartTime) | where mvc_EndTime==1 AND mvc_StartTime==1 ... View more

I think there may be some confusion between a field with multiple values with multivalued field. What your image result.jpg is showing are fields with multiple values, one value per row. What your the-fields-i-do-not-need.jpg is showing is multivalued fields. Many values for the same row! For instance, in the-fields-i-do-not-need.jpg, your row of process CS02 has dozens of values in StartTime and EndTime. If you don't want that row, I guarantee you that excluding mvcount>1 will eliminate them. In the question you asked "I need only the rows where all the 4 fields have values and all of them are single values, how do I retrieve that?" Using mvcount>1 will most definitely exclude rows with multivalued fields. More, after removing the rows with multivalued fields, the remaining ones (with single valued fields only), will now be ready to be excluded with the isnotnull, so maybe it should be done backwards and to all the fields sourcetype=xxxx | eval Process=substr('source',1,5) | stats values(TaskStart) as StartTime, values(TaskEnd) as EndTime by RunID, Process | table RunID, StartTime, EndTime, Process | eval mvc_EndTime=mvcount(EndTime), mvc_StartTime=mvcount(StartTime) | where mvc_EndTime==1 AND mvc_StartTime==1 | where isnotnull(RunID) AND isnotnull(StartTime) ... View more

According to your image "the-fields-i-do-not-need.jpg", those mvcount can't be 1 as it is clearly seen that you have multivalued fields there. Are we talking about some other fields? Because StartTime and EndTime have definitely mvcount greater than 0 in your snapshot ... View more

Can you give me the mvcount results ? ... View more

Have you checked if those IPs you are talking about are PRIVATE IPs? Those like 127.0.0.1 won't show you any geographical data ... View more

Well one of the option is definitely outputlookup your current "index made of lookups" and the use the lookup command to enrich other data with it. If you really want to stick with the index format, I'd suggest you to take a look at the join command: https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Join ... View more

I think you could filter those right away instead of getting all events and the filter, like this: index="<some_index>" [| makeresults | eval date_wday="saturday" | append [| makeresults | eval date_wday="sunday"] | return 2 date_wday] ... View more

To force Splunk to have a new indexed field, you need to do that on your sourcetype. Follow this doc to do that: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Configureindex-timefieldextraction As collect indexes data in a summary index, you should take a look here to find out how to configure the summary index to have your fields there: http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Configuresummaryindexes ... View more

Hey Consider first eliminate the null values of the RunID and StartTime and then remove the rows with mv sourcetype=xxxx | eval Process=substr('source',1,5) | stats values(TaskStart) as StartTime, values(TaskEnd) as EndTime by RunID, Process | table RunID, StartTime, EndTime, Process | where isnotnull(RunID) AND isnotnull(StartTime) | eval mvc_RunID=mvcount(RunID), mvc_StartTime=mvcount(StartTime) | where mvc_RunID==1 AND mvc_StartTime==1 ... View more

Hey You just need to start monitoring your file: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Monitorfilesanddirectories ... View more

You need to create a lookup definition on that csv lookup. For that follow this: http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/ConfigureCSVlookups After you have created a lookup definition, let's say you named it ldslookup, | dbxquery connection="gg" query="SELECT * from idstudio" | lookup Id Idslookup OUTPUT <whatever field you want form the lookup> ... View more

More, if you did not specify a sourcetype when you did the collect command, the sourcetype is stash, and with KV_MODE=none, you will get no search time extractions. Only the metadata fields are shown (index, source, sourcetype, host, _time) ... View more

I just copied your entire lookup in the image and tried this myself by creating a .csv. I don't have zeros in all rows and so it seems that your csv is not well formatted. Can you try what I just did? Create a csv in a plaintext file: _time,image_name,os_name 10/01/2018, azure1, CentOS7 10/02/2018, azure1, CentOS7 15/02/2018, azure1, CentOS7 20/02/2018, azure3, CentOS7 10/03/2018, azure3, CentOS7 11/03/2018, azure2, CentOS7 12/03/2018, azure2, CentOS7 Save it like this and to csv_timechart.csv, put it in the lookup folder of the app you are using, and run the command I told you. Feed us back please ... View more

Have you tried how faster the query above runs? ... View more

Hey You can use JS to pass tokens (form ones) specified in one dashboard to another one, like this: function clickhandler(e,split_token) { svc_drilldown = "/app/ESI/service_explorer"+"?&form.time.earliest="+earliest+"&form.time.latest="+latest+"&form.serviceName="+e.name2+"&form.host="+'\"'+"*"+'\"'+"&form.cluster="+cluster; window.open(svc_drilldown); } ... View more

Hey Please try this option: | inputlookup csv_timechart.csv | eval _time=strptime(_time,"%m/%d/%Y") | timechart count by image_name ... View more

If your query is accurate, then you don't need to use stats, you can just use tstats, which is 1000x faster: | tstats count(host) where index=abc AND earliest=$time_tok.earliest$- $days_selected$ AND latest=$time_tok.earliest$ by source | join type=left source [| tstats count(host) as C2 where index=_internal AND earliest=$time_tok.earliest$ AND latest=$time_tok.latest$ by source ] ... View more