Hello, You can use the transaction command. So essentially a search like (sourcetype=SourceType_A "Some str 1") OR (sourcetype=SourceType_B "Some str 2") will get the events in the same search. You can then use the transaction command based on whats common among the events and use the maxspan option to specify the time gap you want. Here is the documentation for the transaction command https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Transaction ... View more

I have installed it as per my OS. I'm using Splunk Machine Learning Toolkit version 3.4.0 and Python for Scientific Computing version 1.13. ... View more

Hi niketnilay, Yes i have completed all steps before Try out the visualization and also visualization_source.js has the required code as per the documentation. ... View more

@niketnilay can you please help? ... View more

So, what i understand is, you are going to have 4 variables (A,B,C and D) and you wantthe results for F=0 where F = A AND B AND C AND D. could you maybe run a search like this? | where (A=1 OR B=1 OR C=1 OR D=1) instead of searching for F=0 | makeresults | eval A = 1 | eval B = 0 | eval C= 0 | eval D=1 | eval F=if(A==0 OR B==0 OR C==0 OR D==0,0,1) ... View more

Hello! Can you please provide sample data? Also, what inputs are A and B, that you'll be getting more than 4 combinations? ... View more

you can use append to join both the tables https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Append ... View more

Hello! Is all the data in one index? Or are they spread across multiple? ... View more

Hello! You could use something like this | transaction message_id Let me know if this works ... View more

Hello! Try this run anywhere command | makeresults | eval opened_at = "9/01/2018 12:23:35" | eval created_at=strptime(opened_at,"%d/%m/%Y %H:%M:%S") | eval Month=strftime(created_at,"%b/%Y") | eval date_month=strftime(created_at,"%m") | eval date_year=strftime(created_at,"%Y") | eval epoch = strptime(opened_at,"%d/%m/%Y %H:%M:%S") | eval week=strftime(created_at, "%w") | eval diff = (now() - epoch)/60 | where diff < 131400 | stats count(eval(u_service_req="true")) as "Number of SRs", count(eval(u_service_req!="true")) as "No. of Incidents", count(ticket_number) as "Total" by week Month date_month date_year | sort+ date_year date_month | fields- date_year date_month Hope this helps! ... View more

Hello! Try this rex field=_raw "sourceTransactionTime\:(?<sourceTransactionTime>[^\\n]+)" ... View more

Hello! You can try using earliest=-1w for exactly seven days. So if you check on Wednesday 12 p.m. it will show you from the previous wednesday 12 p.m. or earliest=-1w@d For the entire day. So if you check on Wednesday - irrespective of the time, it will show you the results of the whole day. Here's the documentation, for you to understand this better https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/SearchTimeModifiers ... View more

Hello! Try replacing the last - stats part of your query with this | stats count by dst_port ... View more

For this, you need to use max_match=0 in the rex expression. Use this query rex field=_raw max_match=0 "(?<java>(\S+|)java.\w+.*Exception)" ... View more

Try this | rex field=A "(?<a1>\w+\s\w+\s\w+\s.+)" | rex field=A "(?<a2>\w+-\w+-\w+\s.{7,8})" | eval A1 = strptime(a1,"%b %d %Y %I:%M %p") | eval A2 = strptime(a2, "%Y-%m-%d %H:%M:%S") | eval Total = mvappend(A1,A2) ... View more

Can you please send me one full event? Also, please send the search query you're using. ... View more

Try this run anywhere search | makeresults | eval _raw="null\n\njava.lang.IllegalArgumentException : java.util.concurrent.ExecutionException.. ( java.util.concurrent.ExecutionException) \" java.util.concurrent.ExecutionException\"" | rex field=_raw max_match=0 "(?<java>(\S+|)java.\w+.*Exception)" ... View more

I edited my answer. did you check? Also, if its not correct can you elaborate by giving sample inputs and what output you want ... View more

Hello! Try this run anywhere search | makeresults | eval _raw="null\n\njava.lang.IllegalArgumentException : java.util.concurrent.ExecutionException.. ( java.util.concurrent.ExecutionException) \" java.util.concurrent.ExecutionException\"" | rex field=_raw max_match=0 "(?<javaexception>java?.[.\w]+Exception)" You can try something like this | rex field=_raw (?<javaexception>java?.[.\w]+Exception) OR | rex field=_raw (?<javaexception>java.*Exception) ... View more

You can try this . You can add the regex and extract the fields Settings » Fields » Field extractions » Add new | rex field=A "(?\w+\s\w+\s\w+\s.+)" | rex field=A "(?\w+-\w+-\w+\s.{7,8})" | eval A1 = strptime(a1,"%b %d %Y %I:%M %p") | eval A2 = strptime(a2, "%Y-%m-%d %H:%M:%S") | eval Total = mvappend(A1,A2) ... View more

If the time formats are from different sources you can create, the calculated field based on the source like this let me know if this works! ... View more

Are the two different time formats coming from two different sources? ... View more