Hi, I currently have a working report as: `Master_Search` |eval Upper_Element = upper(Element)| rex field=Upper_Element mode=sed "s/ //g" | search(Upper_Element = "*K21A*" OR Upper_Element = "*DG23*" OR Upper_Element = "*FM23*" OR Upper_Element = "*DP14*")| Now, I want to convert it to a dashboard with a user input where I can fetch the search values in the Input box in the dashboard: <row> <panel> <input type="multiselect" searchWhenChanged="true" token="Element_t"> <label>Element in Upper case</label> <default>K21A DG23 FM23</default> </input> </panel> </row> However, I am not certain how I can get the similar results as the above query. I tried the following approaches 1. I have tried to use the subquery [search * | head 1 | eval Upper_Element="$Element_t$" | makemv delim=" " Upper_Element | fields Upper_Element] Tried to use the delimiter in multi-select as XdelimiterY " OR Upper_Element = " X/delimiterY //replace the X and Y with less than and greater than symbol But, I am not getting the proper results. Could you please direct me to the correct path. I am really confused here. Thanks a lot in advance for the help. Br, Chandra ... View more

HI All, I am able to get the time value difference in epoch and able to convert it to string with the following command:- eval LeadDays = ( Answer_Time - Bookingdate) | eval LeadDays = tostring(LeadDays, "duration") | Bookingdate Answer_Time LeadDays 1535635518.000000 1535708751.000000 20:20:33.000000 1535636031.000000 1536059535.000000 2+21:38:24.000000 The problem is in the first row: is there a way to convert it to 0+20:20:33.000000 instead of 20:20:33.000000 I tried to use string concat but it didnt work. Also is there a way to convert 2+21:38:24 to only days as 2+21/24+38/3600= 2.88 days ... View more

Hi All, I need to find the difference between these two dates with the removal of the weekends I have 2 date value fields as ASSIGNED_DT = 2018-08-30 15:33:51 ANSWER_DT= 2018-09-03 16:59:48 | makeresults | eval ASSIGNED_DT = "2018-08-22 15:33:51" | eval ANSWER_DT= "2018-09-03 16:59:48" | eval Assigned_Time = strptime(ASSIGNED_DT, "%Y-%m-%d %H:%M:%S") | eval Answer_Time = strptime(ANSWER_DT, "%Y-%m-%d %H:%M:%S") | eval start=relative_time(Assigned_Time,"@d") | eval end=relative_time(Answer_Time,"@d") | eval Date=mvrange(start,end+86400,86400) | convert ctime(Date) timeformat="%+" | eval WeekendDays=mvcount(mvfilter(match(Date,"(Sun|Sat).*"))) | eval diff = tostring(( Answer_Time - Assigned_Time), "duration") | table ASSIGNED_DT, ANSWER_DT, diff, WeekendDays Everything is working fine and the results are:- ASSIGNED_DT ANSWER_DT diff WeekendDays 2018-08-22 15:33:51 2018-09-03 16:59:48 12+01:25:57.000000 4 Now I just need help with: 1. remove the WeekendDays from the diff 2. Convert diff-WeekendDays as the only number of days in decimal: for example here : it should be 8.01 days or 8 days 1 hour 25 mins only. Thanks for your help. ... View more

Hi Everyone, Through inputcsv and outputcsv, i finally able to consolidate the data in a single CSV. Now I need to create another CSV with the events with a single key. My inputcsv has data in the following format:- Ticket | Main_Ticket | TYPE | STATUS | END_DATE A2345A | A2345A | MAIN | IN Work | 2018-09-12 A2345A001 | A2345A | SUB | Closed | 2018-07-03 Z2995A | A2345A | PEER | Closed | 2018-07-23 A2345A002 | A2345A | SUB | In Work |2018-08-12 B4321A | B4321A | MAIN | IN Work | 2018-09-12 B4321A001 | B4321A | SUB | Closed | 2018-07-11 Z3495A | B4321A | PEER | Closed | 2018-07-19 B4321A002 | B4321A | SUB | In Work |2018-08-15 C9854A | C9854A | MAIN | Closed | 2018-07-12 C9854A001 | C9854A | SUB | Closed | 2018-06-15 Z8749A | C9854A | PEER | Closed | 2018-06-23 C9854A002 | C9854A | SUB | Closed |2018-06-29 Now I need to find the first "In Work"SUB or PEER ticket for each Main_Ticekt. The result may look like the following. Main_Ticket | PEER_SUB_IN_Work | PEER_SUB_TN | PEER_SUB_ENDDATE A2345A | SUB | A2345A002 | 2018-08-12 B4321A | PEER | Z3495A | 018-08-12 C9854A | Closed | Closed | 2018-07-12 So I am trying to get something like for each loop with the key filed "Main_Ticket" , find last IN Work SUB/PEER ticket and END_Date of that SUB/PEER TIcket. If all SUB/PEER tickets are CLOSED, It should return the MAIN Ticket Type value. Once I have the values, I can easily save it to outputcsv. As of now, I am downloading the CSVs and doing it with VB. Is it possible with Splunk? Thanks for your help and I apologize for such a long post. ... View more

Hi All, I have 2 sourcetypes as following:- Sourcetype_A Ticket | Main_Ticket | Value | Line | LinkedTicket Sourcetype_B Ticket | Main_Ticket | Value | Line | LinkedTicket Now I need to find the results from sourcetype_B and if the sourcetype_B.Main_Ticket = Sourcetype_A.Ticket then I need to combine the results as:- sourcetype_B.Ticket | sourcetype_B.Main_Ticket | sourcetype_B.Value | sourcetype_B.Line | Sourcetype_A.Ticket | Sourcetype_A.Value Currently, I a using the join approach but I am not fetching all the results as my database have 500,000+ entries and join look for the first 50000 entries. The second approach is using "append" but still, it is very slow. Is it possible to use Stats values(X) as X by Ticket if all the fields in both sourcetype are same but the field to compare ( sourcetype_B.Main_Ticket = Sourcetype_A.Ticket ) are different? Thanks a lot in advance. ... View more

Hi everyone, when I try to use the following command, it always gives in CA_flag as "Other" although lower_Ticket_Desc has a exact maching term. Is there something, which I am not doing correctly here : | eval lower_Ticket_Desc = lower(TICKET_DESC)| rex field=lower_Ticket_Desc mode=sed "s/ //g"|eval CA_flag = case(lower_Ticket_Desc=="[yes/no]:no" ,"Flag_NO" ,lower_Ticket_Desc=="[yes/no]:yes" ,"Flag_YES" , 1=1, "Other" ) | I have removed all blank spaces and converted everything to lower case. TICKET_DESC example = "asdfjkasdhf [Yes/No]: No dfasjaskl" Or "asdfjkasdhf [Yes/No]:no asdfadsf" or "asdfjkasdhf [Yes/No]: YES asdfadsf" ... View more