The conversion needs to be done as the time values is considered in seconds format. You can use eval start_time = strftime("2018-05-01", "%Y-%m-%d") | eval end_time=strftime("2018-06-01", "%Y-%m-%d")| where ( _time > start_time and _time < end_time) ... View more

Thank you! ... View more

Hi , It was mentioned earlier by Stephen Sorkin [Splunk] ♦ in one of his answers. I am just coping this remark on the same. i find it really useful In general, we recommend search-time extractions rather than index-time extractions. There are relatively few cases where index-time extractions are better, and they come at the cost of brittleness of configuration and an increase in index size (which in turn makes searches slower). The distinction in the UI of "uses transform" vs. inline doesn't have anything to do with search-time vs index-time. It is referring to where the regex itself is stored: in an EXTRACT- line in props.conf (for inline) as opposed to in a REPORT- line that refers to a stanza in transforms.conf (for uses transform). Index time extractions are also set in props.conf and transforms.conf by means of the TRANSFORM- line. Again, they should rarely be used. They are appropriate when the heuristic of search for the value of the field fails (either because the value is ubiquitous outside of cases where the field equals the value, or because the value isn't an indexed token) or when you commonly search for field!=value without other terms to constrain the search. Link of the answer : https://answers.splunk.com/answers/5817/search-time-versus-index-time-field-extractions.html ... View more

thanks a lot ... View more

I think you got bit by an issue Splunk has with using fields that include spaces in evals. A rename of the Destination Country Correct Translation to a field name with no spaces would have sorted it. index = "myindex" | rename "Destination Country Correct Translation" as Country | eval Country = case(Country=="A","A",Country=="B","B",Country=="C","C",Country=="D","D",Country=="E","E",true(),"Others") | stats sum("Declared Value _USD") as sales by Country | eventstats sum(sales) as total_sales | eval Percentage=sales/total_sales*100 | sort 0 - sales ... View more

try using the below stats commad- stats values(src) as src, values(dest) as dest, values(action) as action earliest(_time) as First, latest(_time) as Last by url ... View more

@thezen, If your problem is resolved, please accept an answer to help future readers. ... View more

Thank you very much! ... View more

The token looks like it's populating correctly based on the dashboard URL. I also tried removing the quotes, but it still doesn't provide any results. ... View more

Figured it out. | eval sort_field=case(Risk="High",1, Risk="Med",2, Risk="Low",3) | sort sort_field | fields Risk gt30 gt60 gt90 ... View more

Okay, here's how you make something like this work. First, you take your own userid, and search various indexes for your id for times you knew you were doing things you want to detect. this allows you to verify the format for the records, and what the exact field name is for the userid. Second, poke around and find all your own records across that same time frame. Search for records with the same IP address at the time you had it, for example. There may be various forms of your userid, or there may be record types that don't use the userid, but use some other identifying feature. Third, craft a single search that will find all your records that you discovered. Fourth, replace your id with someone else's and validate the search Fifth, build that into a dash, and validate that it still works on your target ids. ... View more

hi @hartcl1 Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting! ... View more

Try this index=datapower | rex field=_raw "URL\:\s(?<ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| stats count by ip|sort -count ... View more

In your stats command you can add Req in by clause, if that is what you want as output . See below- stats avg(RequestsPerSec) as AvgRequestsPerSec , max(RequestsPerSec) as MaxRequestsPerSec , p95(RequestsPerSec) as P95RequestsPerSec by Req host_type _time ... View more

hi @gdavid Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting! ... View more

Try below- it will convert epoch time in seconds into required readable format using strftime |eval ResponseTimestamp=strftime(ResponseTimestamp,"%H:%M:%S") ... View more

If you don't want to sort, then you can use tail before streamstats. By default 10 gives 10 event count, if you have an idea about the maximum number of events in that time frame you can use that (eg. tail 100000) ... View more

From what I understand is you want the transactions broken by customer_id, Date and Store. You can use rtl_loc_id in your by clause instead of list. | stats list(item_id) as item_id, list(description) as Description, list(quantity) as quantity, list(unit_price) as unit_price, sum(eval(unit_price*quantity)) as Transaction_Total by cust_party_id, rtl_loc_id ,business_date | rename rtl_loc_id are Store_ID , unit_price as Sales_Price | sort - quantity ... View more

Thanks @Vijeta ... View more

I think the problem is because the subsearch exceeds the 50000 value: [subsearch]: Search Processor: Subsearch produced 50000 results, truncating to maxout 50000. That's when filtering it with the url it works, because it returns less events. Is there a way to workaround this? ... View more

I get the following error =( Error in 'join' command: Usage: join ()? [subsearch] The search job has failed due to an error. You may be able view the job in the Job Inspector. ... View more

yes sorry missed the * while typing ... View more

kamlesh_vaghela, thanks for the input, thanks to you I have it working. But SourceA is not needed where it is. #2 SourceC is listed twice, and the 2nd time should be SourceA if it is removed from the beginning. The working command looks like this: [ search SourceB | dedup field1 | fields field1] OR [ search SourceB | dedup field1 | fields field1] | join field1 [ search SourceA | dedup field1 | fields field1] | table field1 | dedup field1 ... View more