So you have: FW on Windows -> UF -> Indexer? What type of Forwarder is on the Windows box? Heavy or Universa? ... View more

You do realize all those eval statements work event by event, right? So for any given event there is only 1 y value. So not sure how you expect to get different results from those case statements. Since your data already has timestamps, why are you evaluating x like this? You have data where x is a (rounded) timestamp, and y is the value you are looking for, right? And you want (in the end) to find those y values where x is either equal to current time (now()) or equal to 40 seconds ago? To me that sounds like something that would look like this: ...your search that returns data with timestamp in x and data value in y... | eval mytime=now() | eval mytime2=now()-40 | where x=mytime OR x=mytime2 | table x,y Which will return only those lines from your data where the timestamp in field x is equal to now() or now()-40. ... View more

As @493669 already mentions above: if you set x=round(_time), how will it ever match anything else then mytime (which you also set to round(_time). And eval result=case... stores the content of y1 or y2 (depending on which case is true) in the result field. So if y1 and y2 are empty, of course that gives no result. I think two things are making it hard to answer this properly: 1: your explanation of exactly what data you have and what you want as a result remains vague. 2: people still try to help you along with examples, but you don't fully understand some of the commands suggested, which causes you to glue examples together in ways that don't make much sense, which only adds to the confusion. So: Please be more clear in describing what data you have and what you want to achieve AND when someone presents an example, check the Splunk search reference documentation and make sure you understand what the commands do and how to use them, so you know how to apply it to your use case. Sorry for perhaps being a bit direct on this, but in the end that is the way you will take the most out of such discussions and really improve your Splunk search skills 🙂 ... View more

I'm a bit puzzled at what your (functional) end goal is here. Might be good to explain that (perhaps also rethink it yourself), to get some good suggestions on how to accomplish it. Glueing tables together like this does not make a whole lot of sense to me. But if you really need that, we would at least need a definition of how the tables should be glued together. In other words: how should splunk decide which rows from one table to merge with rows from the other table? ... View more

What is the data that you used for this test? Specifically: do fields y1 and y2 actually exist? It would really help if you're a bit more clear in exactly what you are trying and what you expect as the outcome. ... View more

You might want to sanitize your screenshot, looks like that contains some data that may not be suitable for sharing publicly 🙂 ... View more

And the question is why the config you have isn't working, I assume? Don't think that regex is correct: ^ matches start of string . matches a single character (any character) HealthMailbox matches the word you want to detect . matches again a single character $ matches end of string So your regex only matches lines that exist of only your keyword, with just 1 character in front of it and 1 character behind. You would need to replace the . with .*, to make the regex match the whole lines. For the filtering to work, you don't need to write a regex that matches the whole line though, just write a regex that matches the relevant part will already cause it to trigger. So just put your keyword in the regex: REGEX="HealthMailbox" That should do the trick, I think. ... View more

If you just want to display the totals, you can simply drop the by-clause. I think he still wants to see the detailed stacked bars though, but wants to show the numeric values only for the totals overlay. @johnward4 correct me if I'm wrong on that. I had a quick look at the available visualization settings but can't really find a way to do that. Only options seem to be not display any numbers, display only overall min/max and display all values. ... View more

I think it will revert to the DS version already upon the first next handshake between forwarder and DS, not only after a reload. If an app is deployed from DS, you should edit it there and then push it out. ... View more

Are you deploying this on a single instance deployment? If not, on what type of splunk instance did you deploy this in you distributed environment? What does the respective inputs.conf look like, what does the data look like and what does "didn't work properly" mean? Did you get some results but incorrect, or no extractions at all? Regarding the props.conf: why do you have that empty DATETIME_CONFIG setting in there, maybe that breaks things? Does splunkd.log on this instance report any issues after restarting? (did you even restart after deploying this app?) ... View more

I'd expect that to be visible in _audit index. Just try creating one and changing / deleting it, to see what it looks like in _audit, so you can build some alerts on that. Edit: Had a quick look at it and cannot find obvious traces in _audit. _internal does show some clues though, events with method=POST for changes of reports/alerts and events with method=DELETE for deletes of alerts/reports. ... View more

You're welcome 🙂 I've changed what I think was my key comment to an answer, so you can mark that as accepted if it indeed worked now 🙂 ... View more

That's a single event. When you scroll through the entries over time, I guess you should also be able to manually check if there is a line that should have matched the if statement. But I guess the milliseconds in the _time (and mytime) fields prevent that match. Can you try eval mytime=round(_time) and see if you then can get a match between mytime and now-45 or whatever? ... View more

It's starting to get a bit confusing to be honest. Can you perhaps add some proper search code examples to your original question post as well as screenshots / copies of what the data looks like (especially the relevant fields). Based on your description, the suggestions from @somesoni2 and myself should work, but apparently we are missing something specific from your situation. ... View more

That's just how _time automatically get's presented, under the hood, it is still a UNIX timestamp value. So you can simply do: | eval mytime=_time ... View more

shouldn't that be eval x=now() ? Or just put the now() in the if clause: | eval y=if(_time=now(),sum,null()) ... View more

I don't think SED commands can reference fields to build the replacement string. What is your goal with this? Replacing a timestamp in the raw event with the content of _time? What is _time populated from and why would you want to override the raw event contents like this? ... View more

...your search here... | eventstats sum(NumberCompleted) as total | eval PercentageCompleted=(NumberCompleted/total)*100 Eventstats will append a field "total" to each row, with the total of the Number column. That can then be used in an eval to calculate the completion per row. ... View more

You need to apply fieldformat to the pindex field itself, rather than a fresh, not existing field. ... View more

If the actual data is as straight forward as your example, then you can just add a calculated field to table B with the truncated hostname and use that to join? But given that you are asking for a like(hostB,"%"+hostA+"%") that seems to imply the actual case is more complex than your example? ... View more

Wouldn't this be a good case to use fieldformat instead of eval? That changes the appearance of the field, but not the underlying value. Don't have a splunk instance at hand to confirm that also works for charting and drilldowns, but should be easy enough to try. ... View more

But the string replacing worked. Did you add that eval statement in your original search in the exact place that was suggested? Given your comment it seems that you might have added the eval statement to fix the OS name after the stats count by operatingSystem line? ... View more

Why not create 3 separate monitor inputs, one for job-info, one for error and one for heartbeat? [monitor:///abc/common/job-info.*log] disabled = false index = infra_job [monitor:///abc/common/heartbeat/job-heartbeat.*log] disabled = false index = infra_job [monitor:///abc/common/error/job-error.*log] disabled = false index = infra_job ... View more