Hi, I wondered whether someone may be able to help me please. I'm using the query below which works but contains duplicate id numbers under field "detail.ur" index=main auditSource=preferences-frontend auditType=TxSucceeded tags.transactionName="Show Print Preference Option" |eval Interstitpage=if('detail.journey'="Interstitial",1, 0 ) |eval AccountPage=if('detail.journey'="AccountDetails",1, 0 ) |timechart span=1d sum(Interstitpage) AS ShownInterstitial, sum(AccountPage) AS ShownAccountPage |reverse I'm trying to incorporate the "stats dc" command to remove these duplicates rather than the dedup because there are a lot of records involved and I know the dedup can be a little inefficient. I've tried incorporating the "stats dc" in multiple areas of the query but I just can't get this to work. I just wondered whether someone may be able to point me in the right direction so I may be able to get this to work. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm using the query below to extract a piece of data. index=main tags.transactionName=print-suppression | eval Date=substr(generatedAt, 1, 10) | stats dc(Date) by Date | eval verifiedButBounced=coalesce('detail.verifiedButBounced.count',0) | eval pendingVerificationOfChangedEmail=coalesce('detail.pendingVerificationOfChangedEmail.count', 0) | eval verifiedPendingVerificationOfChangedEmailAndBounced=coalesce('detail.verifiedPendingVerificationOfChangedEmailAndBounced.count', 0) | eval verifiedButBouncedPendingVerificationOfChangedEmail=coalesce('detail.verifiedButBouncedPendingVerificationOfChangedEmail.count', 0) | eval verifiedButBouncedPendingVerificationOfChangedEmailAndBounced=coalesce('detail.verifiedButBouncedPendingVerificationOfChangedEmailAndBounced.count', 0) | eval verifiedNotBounced=coalesce('detail.verifiedNotBounced.count', 0) | eval Verified=verifiedButBounced + pendingVerificationOfChangedEmail + verifiedPendingVerificationOfChangedEmailAndBounced + verifiedButBouncedPendingVerificationOfChangedEmail + verifiedButBouncedPendingVerificationOfChangedEmailAndBounced + verifiedNotBounced | rename detail.totalOfAllOptedIn.count AS Opted_In, detail.optedOut.count AS Opted_Out | table Date, Opted_In, Opted_Out, Verified, detail.verifiedButBounced.count, detail.verifiedNotBounced.count, detail.pendingVerificationOfChangedEmail The problem I have is that I want eliminate duplicate dates. Now I know that I can use 'dedup' which successfully removes the duplicates but I've been reading that stats dc or 'distinct count' is more efficient, but I'm a little unsure about how to incorporate this. I just wondered whether someone could possibly look at this please and offer some guidance on where I should incorporate the 'stats dc' command. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm starting to get to grips with the 'If' statements and understand the basics around these. But I'm using an existing query which contains the line as shown below. I would understand this if it didn't have the 1 at the end of the statement, but I just wondered whether someone could explain what the 1 actually does. |eval Interstitpage=if('detail.journey'="Interstitial",1, 0 ) In addition could someone tell me please would it more efficient to use the "searchmatch" I've read about, and if, could someone possibly explain I may incorporate it into this example. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. Although I've been using Splunk for a few months now, I'm still coming against statements I've not see before. One of which is this | eval verifiedButBounced=if('detail.verifiedButBounced'!="", 'detail.verifiedButBounced.count',0) Could someone possibly explain to me what this statement is actually doing and is there a more efficient way of writing this. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm trying to change the "apiStartTime" which is in the following format 'Sat Mar 5 00:00:00 2016' including the apostrophes to an epoch time so I can perform some date calculations. So I've been looking at the Splunk documentation here and I thought I'd understood the variables I need to use and then convert and I put together the following: |eval startTime=strptime(apiStartTime, "%a %m %d %H:%M:%S %Y")|convert timeformat="%d/%b/%Y" ctime(startTime) Unfortunately though this isn't working, and I'm not sure why. I just wondered whether someone could possibly look at this please and let me know where I've gone wrong. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I was using the query below to return details of all the searches performed which was great because I could extract the user, run time of the search and 'earliest' and 'latest' dates used in the query. |rest /services/search/jobs |search NOT (author="splunk-system-user" OR author="monitoring") |search title!="" The problem is, is that this doesn't give me the details for all the searches run. So I started using the following: index=_audit action="search" search=* | search NOT (user="splunk-system-user" OR user="monitoring") But the problem with this is that I can't retrieve all the 'earliest' and 'latest' dates, and so far I've been unable to find the run time audit event for the query. Could someone tell me please is there a query which returns all of the searches within a given time period which also provides the dates and run times I need. Many thanks and Kind Regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. The search I'm using correctly extract the information I need. index=main auditSource=filing auditType=FilingCompleted OR auditType=FilingSubmissionAcknowledged | dedup "detail.Filing ID" | table field1, field2, field3, field4 But to make this a little more efficient, I would like to change this to use the stats dc() command. I know how to use this instead of the 'dedup', but can't work out how to then incorporate this into a table to return all the fields I need to see. I just wondered whether someone could possibly look at this please and offer some guidance on how I may be able to achieve this. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm trying to put together a query which calculates the difference between the current date and a "Created Date". If you could have a look at the query below please, I've converted the "Created Date" to epoch time e.g. 1455700768.000000 but when I list the current date it's shown as 1456130889. So then when I try to find the difference, the query is extracting results such as 13+08:48:09.000000. index=_audit action=edit_user operation=edit OR operation=create | rename object as user | stats max(timestamp) as "created" by user | eval createddate=strptime(created, "%m-%d-%Y %H:%M:%S") | eval testtime=now() | eval diff = tostring((testtime - createddate), "duration") | fields createddate testtime diff Could someone possible look at this please and let me know where I've gone wrong and how I can calculate the difference in days between the current date and the "Created Date". Many thanks and kind regards Chris ... View more