The auto-help on contingency told me that you add "usetotals=F" as the last option will get rid of the TOTALS row. ... View more

Hi @woodcock, thank you for coming back to me with this, but unfortunately it didn't work properly. Although, this did group by the nino, it took away the correct values for the associated "activityList" and "selectList". Many thanks and kind regards Chris ... View more

Hi, thank you for coming back to me with this. I've tried the code you kindly provided so this part of my query is now: eval time= detail.SubmissionDate." ". detail.SubmissionTime | eval time = strptime(time, "%d-%m-%Y %H:%M") | eval time = strftime(time, "%Y-%m-%d %H:%M") But when I then try to use 'time' in my table the field is blank. This was the same issue when I used eval time= detail.SubmissionDate." ". detail.SubmissionTime | by itself. Many thanks and kind regards Chris ... View more

You'll need to escape the double quote, like this: rex field="detail.output-cid-response" "\"firstName\":\"(?P<field_name>.*?)\"" or rex field="detail.output-cid-response" "\"firstName\":\"(?P<field_name>[^\"]+)" ... View more

Ah, that's interesting, because I thought from something I read in the 'Splunk Cookbook' book I have that ''saved searches' update automatically every 10 minutes? In addition, I can use the saved search without the 'username' drop down menu and it is returning the information. Many thanks and kind regards Chris ... View more

Hi @Mus, thank you once more for taking the time to help me. This works perfectly. Many thanks and kind regards Chris ... View more

There is no doubt that it is possible but if you'd like to keep your original solution, that is up to you. The problem is that your original search implied some things about your dataset that clearly aren't true (else our solutions would have worked). Given this, it is likely that your original search is not doing exactly what you think it is doing either, so beware! It might be best if you back all the way up and show us some sample events including fields: ... | eval raw=_raw | table * ... View more

Hi @vincenteous, thank you very much for this it works a treat. Kind Regards Chris ... View more

Hi @ woodcock I re-visited this and with some alteration I was able to make this work by using the following: index=main auditSource=frontend auditType=ExitSurvey |replace/survey With "Manage List"| contingency tags.path detail.manageList | append [search index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "View Payments" |contingency tags.path detail.viewPayments ] |append [search index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "What Do You Think" |contingency tags.path detail.whatDoYouThink] | rename tags.path TO "Question" | fields Question, 1 2, 3, 4, 5 | fields - TOTAL | rename 1 TO "1 (HS)", 2 TO " 2 (HS)", 3 TO "3 (HS)", 4 TO "4 (HS)", 5 TO "5 (HS)" Many thanks for your help and kind regards Chris ... View more

Hi @woodcock, thank you very much for this it works great. I just wasn't too sure how to handle the spaces in my report name. Kind Regards chris ... View more

you can also use $token|s$ to have it capture the whitespace too. ... View more

Hi @afishkin, thank you very much for this. Many thanks and kind regards Chris ... View more

Hi @clorne, thank you very much for this it is greatly appreciated. Kind Regards Chris ... View more

Please accept the answer. ... View more

Hi @woodcock, thank you for taking the time to reply to my post. Your solution works great. Many thanks and kind regards Chris ... View more

Many thanks 🙂 ... View more

HeHe, so my answer would fit better because it shows both ways 😉 Never mind ... blop - ein Flens in Ehren 🙂 Ja, die gibt es hier auch 😉 ... View more

Yes, it speeds up search and offloads the indexers from having to perform line-breaking and timestamp recognition tasks too. ... View more

o/ It's true the flowchart was included in the docs based on a nearly identical flowchart that I made years ago. Needs some updating probably. Maybe even an expansion of scope beyond just row aggregation. It comes in most handy when you try to explain to relatively new splunkers why they really shouldn't use join or append. Somewhat early on join clicks with new users, particularly those with SQL experience and they think of it as a primary tool. It is not. It is an edge case tool, where stats and eval are the primary tools. Short Version: If you think you need to use join, go find this flow chart and it'll probably tell you there's a better way. ... View more

Hi @chanmi2, thank you once more for helping me out with this. It is greatly appreciated and works fine. Kind regards Chris ... View more

@chanmi2 Thank you very much for taking the time to reply to my post and for the guidance. Kind Regards Chris ... View more

Hi @Iguinn, thank you once more for taking the time to reply to my post and for the guidance. Many thanks and kind regards Chris ... View more

Hi Tom, I'm sorry to trouble you but I wonder whether you could help me please. You kindly provided me with the reason why there was a disparity between my two queries, and certainly the inclusion of the 'sort' solved the problem. But I inherited this query initially, so I'm a little unsure what the 'sort 0 detail.input-utr,-_time' actually does. Many thanks and kind regards Chris ... View more