I am looking to create a variable that contains a date X days in the past from now. How do I do this? This is a fixed date in the past: | eval mylimit=strptime("28 may 2013","%d %b %Y") | table mylimit | This then converts the above to a date format that I want: | eval mylimit2=strftime(mylimit, "%d/%m/%Y") However, I want this to be relative to today and stored in a variable that I can use in a search. possible related Q ... View more

converting date string "d/mm/yyyy" into "d/mm/yyyy" that can be ordered correctly. I have a column with a Date in string format "1/01/2011" (d/mm/yyyy), but when I sort this column by date it does not work as it is in a string format. this is what I get: 1/01/2011 1/01/2012 1/01/2013 1/01/2014 1/01/2015 1/01/2016 1/02/2011 1/02/2012 1/02/2013 1/02/2014 1/02/2015 1/02/2016 Is there a way to do an eval on this column, or other way, and correct this? This is what I want: 1/01/2011 2/01/2011 3/01/2011 4/01/2011 ... NOTE: I basically have a csv file that I am importing and this is the format it appears in splunk when it is imported. ... View more

if I have the following search that gives: _time val1 val2 val3 val4 1 2016-02-22 14298.520982 2083.388889 10311.996070668 1658.393286670 Is there a shorthand way to round all the numbers? Or do I just have to do a round on each val | eval val1=round(val1,2) .... ... View more

if I have a search that gives me something like this: a b c 1 2 3 4 5 6 7 8 9 how do I add a column d that would do an operation (row2columnC - row1columnC, row3columnC - row2columnC ... all the way down ) in each cell in column d(jsut want to show the value in column d) a b c d 1 2 3 3-0=3 4 5 6 6-3=3 7 8 9 9-6=3 I am thinking it would be ...| eval = ?? or something like this... ... View more

I have the following search ... | stats dc() | transpose | which gives me this: column row 1 dc(ID) 273 dc(SBC) 2 dc(TGID) 273 dc(TGN) 504 dc(beginTime) 2 dc(c1907466966) 54 dc(c1907466967) 59 dc(c1907466968) 55 dc(c1907466969) 31 dc(c1907466970) 50 dc(c1907466971) 55 dc(c1907466972) 7 dc(c1907466973) 47 dc(c1907466974) 57 What I want is to do a regex on this column and extract the values. This is the pattern I am interested in dc(c1907466966) and this is what I want to extract 907466966 and store it in a field called name1. This is the regex I need dc\Dc(?P\d+)\D , but I can't apply it to extract that data I want to a field. How do I do this? This is my regex example https://regex101.com/r/qO8aS6/1 ... View more

I have this search: ...| timechart span=d sum(kpi1) as "kpi1" sum(kpi2) as "kpi2" by userLabel which gives the following format(1): _time kpi1: obj1 kpi1: obj2 kpi2: obj1 kpi2: obj2 1 2016-02-04 7560856 7046562 1009480 946519 I have this search: ... | chart sum(kpi1) as "kpi1" sum(kpi2) as "kpi2" by userLabel -- want this format but with _time column which gives the following format(2): userLabel kpi1 kpi2 1 obj1 7560856 1009480 2 obj2 7046562 946519 So what I want to do is achieve this _time userLabel kpi1 kpi2 kpiN 1 2016-02-04 obj1 7560856 1009480 777 2 2016-02-04 obj2 7046562 946519 777 how do I do this? i have been trying xyseries and untable, but no joy yet. A bit frustrated as I am sure I have done this before. I think I might have to go with chart (2 above) above and use bucket. Can anyone assist? ... View more