Hello everyone. I want to make a statistic of tickets. How many are opend everyday by CI Name. And I wnat to add an AVG of Tickets opened over all days. CI Name 2021-01-20 2021-01-20 2021-01-20 AVG Test 1 5 1 1 2,3 Test 2 3 3 3 3             Thats my current search:   index=prod_test | dedup dv_number | eval openday=strftime(strptime(opened_at, "%Y-%m-%d %H:%M:%S"), "%Y-%m-%d") | chart count(dv_number) as anzahl by dv_cmdb_ci openday | sort anzahl desc   ... View more

Hello everyone. I have field which sometimes contains Profilename and Stepname and sometimes just the Profilename. I would like to extract the profilename and stepname. Example: Test_Profile-TestStep Test_Profile is the profilename TestStep is the stepname It`s always combined with an - So if there is no - then the whole field is the profilename. I´m absolutely not confirm with regular expressions. I`ve tried this (?(?=\b-\b)(?P<ProfileStep>[^-"]+)|(?P<ProfileStep>[^"]+)) But splunk says "Regex: two named subpatterns have the same name" I would be so happy about some help. 😄 Kind regards Jessi ... View more