Hi, I am aware that an eval in the parent search cannot be used in a subsearch like this - | eval foo = ..... | eval bar = [search index='event' | eval alice = foo/10] if subsearch is out of the question, then are joins the only way we can achieve this? Also, is it possible to return a multivalued field(list) in the above query and store it in bar, instead of returning a single number(like count using return $count). If so, how is it done? Basically if I have an eval in one search and I want to extract a list of data from another search index where that eval needs to be used, how is it achieved? Thanks. ... View more

Hi, I have events coming into splunk with payload of nested json array type. The elements in the array are of the same format looking like - { type:'Foo', time:'10 July' } But events may have variable number of these elements within the payload array. That means some event may have 10 elements within the payload array whereas some other may have just 1. Is there a way to efficiently handle extracting data from such variable size payloads in splunk? I saw some examples with spath but it looks like the expectation is to kinda have same fixed number of elements in the payload array. Thanks. ... View more

Hi, I have a query with 5 joins but I am sure that this can be reduced to just one join. I cant figure out the syntax for doing so though. Need something like the following but I know this kind of syntax is not valid. if(payload.type="Foo", stats count as foocnt by txnid) Query - index="event" eventType="A" | eval diff = $$payload.endVal$$ - $$payload.beginVal$$ | search diff=$someval$ | eval txnid = $$payload.ID$$ | join type=left txnid [search index="event" eventType="B" payload.type="Foo" | eval txnid = $$payload.ID$$ | stats count as foocnt by txnid] | join type=left txnid [search index="app_event" eventType="B" payload.type="Bar" | eval txnid = $$payload.ID$$ | stats count as barcnt by txnid] | join type=left txnid [search index="app_event" eventType="B" payload.type="Hello" | eval txnid = $$payload.ID$$ | stats count as hlcnt by txnid] | join type=left txnid [search index="app_event"eventType="B" payload.type="World" | eval txnid = $$payload.ID$$ | stats count as wcnt by txnid] | join type=left txnid [search index="app_event" eventType="B" payload.type="Other" | eval txnid = $$payload.ID$$ | stats count as othercnt by txnid] | table txnid, foocnt, barcnt, hlcnt, wcnt, othercnt Can someone please help me merge these joins to just one join, or perhaps let me know if there is a better way to go about this whole query. Thanks. ... View more

Hi my x axis labels for a chart are really long. E.g. 2017-19-18 22:33:22:10247392048 ABSSHEUVCBKSOWNMSKWOKSNKJWK Because its long splunk shortens it like 2017-19.......NKJWK How do I force splunk to show full x axis labels? Thanks. ... View more

When we plot a chart like this | chart count time phase Lets say the legend appears as Foo Bar Hey Day When I hover over the columns, I see popups like time: .... Foo: 1 time: .... Bar: 3 I want to change the names in the popup while keeping the legend names the same(which means replace would not work). How do I go about this? Legend names still stay Foo Bar Hey Day But names in popup look like Foo-1 Bar-1 Hey-1 Day-1 Thanks. ... View more

Hi, I create a chart using the following query which basically combines three fields and plots their count on a chart. When I hover the mouse on any column I can see the phase name and count(as expected). index=“app_event” | eval myFan=mvrange(0,3) | mvexpand myFan | eval time=case(myFan=0,$$payload.beginVal$$, myFan=1,$$payload.endVal$$, myFan=2,$$payload.anotherVal$$) | eval phase=case(myFan=0,"Start", myFan=1,"End", myFan=2,"Other") | eval Time= strftime (time, “%F %T.%9Q”) | chart count by Time phase I now want to add an extra label($$payload.eventID$$) to every column such that when I hover over a column I am also able to see this label. How do I do this? (PS I first tried concatenating this label to phase but then the chart starts counting by 'phase+payload.eventID' which I do not want. I want the chart to look the same, just with the new added label to each column.) Thanks. ... View more