The timewrap normalises all the time series on to the same time window, i.e. in your case the last 24 hours. It will create a new series for each of the days going back in time in your search time range I think your field names are not quite right | table _time 1day_before 7days_before latest_day Missing '_' character in fields  ... View more

Perfect. Cheers mate. That worked ... View more

index=temp_env sourcetype=access_combined earliest=-4mon latest=@m | bucket _time span=1mon | stats count by _time | eval date_month=strftime(_time, "%b") | eval date_day=strftime(_time, "%a") | stats avg(count) as AverageCountPerDay max(count) AS Peak_Per_Month by date_month, date_day Try this, it will give you the max peak per month and day along with the average count per day and month. It's got a 4 month look back so it may get expensive to run. You may want to consider using metasearch or tstats for faster search speeds ... View more

index=test host=server-1* status=404 | timechart count span=30min by host | untable _time host counts | streamstats current=f last(counts) as prev by host | eval diff = counts - prev | eval perc = diff / counts * 100 please modify perc calculation. ... View more

The best way to get a comprehensive solution is to give us an example of the data. Just make one or more tables that show each type of event and what some fake example data might look like. Since you want to deal with multiple referers, you probably should include two different examples for that. what are the relevant fields when the event has referer="https://www.abc.com/mobile/monthly ", and what are the relevant fields when it has requested_content="/mobile/monthly"? How does a human know that those two types of records get linked? ... View more

I can see time from raw data in _time, see screenshot from my lab instance https://imgur.com/a/bW5T8ok How are you ingesting data ? ... View more

... | stats min(_time) as _time values(Exception) as Exception | eval Exception=mvjoin(Exception,"|") please use code sample and check your post. ... View more

Hi @Shashank_87 Check this | makeresults | eval text="/temp/test?csrkyyt=12334##/test1/test2&csrkyyt=7968676" | makemv delim="##" text | mvexpand text | rex field=text "(?P<output>^[^(?|&)]+)" ... View more

... | stats count by temp ... View more

timechart fails because stats is not passing on the _time field. See my corrected answer. ... View more

You're welcome! ... View more

try this: index=temp ("SoapMessage" "GetCustomerRequest") OR ("SoapMessage" "GetCustomerResponse") | rex field=_raw "\>(?[^\<]+)\<\/\w+?\:requestID\>" | transaction requestID startswith="GetCustomerRequest" endswith="GetCustomerResponse" keepevicted=true mvlist=true | search eventcount > 1 | eval last_response=mvindex(response, -1) ... View more

add at last: .... | fields - _* ... View more

your search | where relative_time(now(),"-8d@d+12h") <= _time earliest=-8d@d+3h is 03:00 AM, but timechart starts at 00:00 AM. I don't know why. Why not limit the display period? ... View more

You can also use loadjob and savedsearch to pull in the results of previous search runs; this will bypass having to write to a file but you run the risk of the searches' TTL expiring and splunk reaping the search job artifacts if you are not careful. ... View more

try rename and eval. ... View more

Add this to the end of your search |convert ctime(_time) ... View more

Scheduling two separate reports is easier in one regard - but you do now have to maintain two things instead of one 🙂 Personally, I'd prefer to have one that I just scheduled every day across the last 4-7 days, and get the results when there actually are some (Mo & Th) 🙂 ... View more

That was easy. Thank you @493669 🙂 ... View more

I see this question allot all over the place and honestly, I think it's comparing apples and oranges. While there is some overlap in functionality, I think both cater to their own specific things. ... View more

Thanks @skoelpin for your response. I have just got it working with the query commented by somesoni. But thanks anyways for looking. ... View more

@Keysofsandiego Hey, let me know if you can help me with the query please. ... View more