I have a query that has a interval of few mins there are some duplicated results during that hour. When I use dedup it delete all the previous result and display the latest. Anyone met this problem? How can I only dedup results for every hour ? ... View more

I have my data here Xml Data, I need to extract using Splunk IFX, Generated pattern (regex). Example 1: (22/7)19:55 Accident on ECP (towards Changi Airport) after Maxwell Rd Entrance. Avoid lane 1./d:Message Example 2: (22/7)14:29 Accident on ECP (towards Changi Airport) before Fort Rd Exit. Avoid lane 5./d:Message Example 3: (19/7)15:19 Accident on PIE (towards Changi Airport) before Paya Lebar Rd with congestion till Kallang Way. Avoid lane 5./d:Message Help 1: I need to extract the express-way exits on the word after and stops at . Help 2: I need to extract the express-way exits on the word before and stops at Exit Help 3: I need to extract the express-way exits on the word before and stops at with There are still a lot of examples in the Xml Data. I did (?i) before (?P<wordafter>.[^\.]*?Exit) , this extracts the Fort Rd Exit (Example 2), this extract only before, how can I extract after ? together with this expression. ... View more

I have this search query sourcetype="CurrentWeatherSGMap" Message="Yishun" | eval Description=case(current_summary="Rain", "Poor",current_summary="Thundery Showers","Poor", current_summary="Cloudy", "Fair", current_summary="Partly Cloudy", "Excellent") | chart dc(Description) over _time by Description | eval Poor=if(Description==Poor, "1", "1"). How can I set the chart to display from 12am to 12am time range daily ? Or can I use advanced xml to display my result ? ... View more

I had a search query of sourcetype="CurrentWeatherSGTraffic" | stats count AS values by Location current_summary | sort - values | stats list(current_summary) AS categories. How can I display only Rain in the categories. I use (eval(current_summary="Rain")) but it wont work. ... View more

Hi Splunk professional, I have these data displayed on a timechart. Is there anyway I can improve on it ? Is it confusing ? Is it possible to do a selection of layouts (stacked with stacked, line with column) ? Please help me improve timechart. I would want to display nice and meaningful charts. Give me some advises. Thanks ! ... View more

Hi Splunk professionals, I am new to field lookup and read the documentation about it. But I am still not sure how can I implement it with my data. I have the weather data of many locations and example of my data is displayed below. How can I use a field lookup to check if summary is cloudy, fishing is Good, else if summary is Rain, fishing is Poor. How can I start with field lookup ? Any advises ? Area: Woodlands Summary: Rain Latitude: 1.44043052 Longitude: 103.7878418 I would like to do something like this. ... View more

I have used this search command to display timechart and I need to search between two sourcetype and return the specific location from sourcetype="CurrentWeatherSGTraffic" but it returns me all the location even from sourcetype="ltaTraffic". How can I return location only from sourcetype="CurrentWeatherSGTraffic". (note that sourcetype="CurrentWeatherSGTraffic" has the location extracted and is the same as sourcetype="ltaTraffic") sourcetype="CurrentWeatherSGTraffic" OR sourcetype="ltaTraffic" | timechart count(eval(current_summary="Partly Cloudy")) as Cloudy , count(eval(Type=="Accident")) as Ancident by Location ... View more

I am using a search command of sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic | timechart count(type) as Incident count(current_summary) as Rain. I had current_summary and type, which I needed only the Rain from current_summary and Accident from type in both sources using the search query. Anyway I can do it ? ... View more