HI everyone I have two queries that returns an total accumulated of transactions. host="konecta-marketing" "request.input.text"="*" | stats count and host="konecta-marketing"| stats count by request.context.conversation_id | search count>1 | stats count I´ve tried make an time chart with this but unsucessfully: host="konecta-marketing" | timechart count(request.context.conversation_id) as Conversaciones count(request.input.text) as Peticiones | search Conversaciones > 1 When i use this query the result in the graph is not the same that when i use the first query (host="konecta-marketing"| stats count by request.context.conversation_id | search count>1 | stats count) Any idea ? Only i need compare into graph two accumulers of previous queries. Thanks ... View more

Hi I´m new in splunk , I´m triying to build an table with this querie : host="xxxx-pronto" | spath | rename logs{}.request.context.conversation_id AS id_Conversacion,logs{}.request.input.text AS Pregunta,logs{}.response.output.text{} AS Respuesta,logs{}.response_timestamp AS Fecha_Respuesta,logs{}.response.intents{}.intent AS Intencion | table id_Conversacion,Pregunta,Respuesta,Fecha_Respuesta,Intencion But only i´m getting all results in a event .How can i separate all results in separate rows. Thanks ... View more

Hi everyone I´m new in splunk ,I need to get items from a json file but when i search in my file i see this in many parts and i don´t get all entities that i need. How can i configure splunk to read json in only one event and so i can to get all entities ? On image i have 3 events from same json file i need only one event and so get all entities from this json . ... View more