Hi All, I have a big text field with sample value as: Random text Location:AL432 1)ART: New order ANYTHING Location:B2332 1)ART: Any order Random text I need to extract all the locations for example AL432 and B2332 and put them together in a new field. Please note that Location and 1)ART will always surround the location Id. I can use something like: | rex field=_raw "Location: (?P<LocationID>\d+) \)ART:" | eval LOCATIONVALUES= case(match(TEXT,"Location"), LocationID) But I am completely sure if my regex syntax is correct here. Also I need to put all Locations in LOCATIONVALUES together. Thanks in advance ... View more

Hi Everyone, I get a report ( 3tabs, 64 columns and 10k+ rows with all kind of data) every day multiple times. I need to upload the data as csv (3 csvs for each tab and a predefined source type for each csv) to Splunk in the same index. Currently, I wrote an Excel-VBA script with replacing a few keywords and then creating the CSV for each excel tab. However, when this CSV gets generated , Excel appends double quote (") at the beginning and end of each row cell. Therefore, I need to open all CSVs in Notepad++ and remove the double quote (") manually. After that, I upload all the data in Splunk enterprise. I believe, there are multiple workarounds for this issue. I am just looking for certain pointers if: 1. Is there any already available app for one-click excel to CSV convert and upload to Splunk (with some customization). I just found https://splunkbase.splunk.com/app/1832/ but I am not sure about the customization 2. Could you please recommend any scripting tool, which can help me with this. Thanks a lot for your time. ... View more

Hi Everyone, I have a very small conceptual doubt. Does the eval case do case insensitive compare or will it compare the exact values (Case sensitive only)? I need a case-insensitive comparison here. LINE_CODE value examples:- AMx05323, amy4bl124, bmz4265678 etc. If the first Character is a or A (case insensitive "a", it should return Atlanta otherwise it should return Other. Do the following 2 statements will provide the same results or different. | eval REGION_ID = (substr(LINE_CODE,1,1)="a") OR (substr(LINE_CODE,1,1)="A")) ,"Atlanta", 1=1,"Other") and | eval REGION_ID = substr(LINE_CODE,1,1)="a" ,"Atlanta" , 1=1," Other") Thanks for your time. ... View more

Hi All, Is it possible to combile the stats from different queries in a single table or string. If I can create a string then table can be generated as:- | makeresults | eval data="Product Revenue,420000; Services Revenue,210000; Fixed Costs,-170000; Variable Costs,-140000;" | makemv delim=";" data | mvexpand data | eval data=split(data,",") | eval name=mvindex(data,0) | eval value=mvindex(data,1) | table name value I am trying to generate a Waterfall diagram with the results from different queries:- Query1 | stats count as Product Revenue Query2 | stats count as Services Revenue Query3 | stats count as Fixed Costs Query4 | stats count as Variable Costs However, I am not certain, how can I execute the 4 queries altogether and then combine the stats count as a string "Key1,Value1;Key2,Value2;Key3,Value3;Key4,Value4;"). ... View more