Hi You gave me idea with combaning indexs by OR. I have used eval with If instead of streamstats. eval TYPE_OF_REPORT=if(index=="A","X","Y") Thank you ... View more

I was more referring to set up caclulated fields in Fields » Calculated fields not in the search. ... View more

Hi Unfortunately this is not working. I want to see the different unique values which are exist in one data set and not exist in second one. e.g. If a new client appear in new month this need to be shown or if a client which exists in previous month but in current month is not visible Thank you with helping here ... View more

HI I have gave the same result what my search as well (which I have just corrected). However both shows one filed with 0 but the value is visibe in 2 month. What can be the reason ? I have corrected my search like that : |set diff [search index = A earliest=-7d@mon-1mon-1d latest=-7d@mon-1d | stats dc() as * |transpose | table column] [search index = A earliest=-7d@mon-2mon-1d | stats dc() as * |transpose | table column] ... View more

in search I can not add this because calculated fields do not exist. They are computed in the Pivot ... View more

This will not work because Column 1 and Column2 are created in Pivot as Column Volume (they do not exist in the objects) Basically they are aggregated values created in Pivot editor ... View more

Correlation is by the same column name So DataSouce_1 Event_Number = DataSource_2 Event_Number DataSource_1 Ticket= DataSource_3 Ticket ... View more

I have Accepted second question. Here Macro is still not working for me. ... View more

it is happening like you said. Last value is shown in the FLAG. I was trying to add this part what you mentioned but unfortunately is not working. However I have made this simpler. I have changed FLAG eval expression. Results are expected (Now it is showing me how many values are in the every column. ) Previous version also works but second FOREACH statement did not do anything- all job is done in status - count) eval TYPE= "" | foreach IM_* [eval TYPE= TYPE.if(isnotnull('<>'), "<>#", "")] | makemv delim="#" TYPE | eval FLAG="FLAG" | stats count(FLAG) as COUNT by TYPE, REPORT_PERIOD ... View more

Hello, Thank you for helping me here As you probably see I have managed to solve my issue in a bit different way (second my question ) but here I wanted use a macro for that. So basically I wanted check how many values are populated in the filed for couple of different columns. E.g. Column ASSIGNEE for some different months have different counts for populated filed Sep- 100 Nov -200 vs all events is 1000. So Sep- is 10% and Nov 20% of populated values in the filed ASSIGNE I was going to do a macro which will be populated one column at a time. E.g. first time ASSIGNE later another column name and so on. For this reason I have transformed column headers into value index=test_im | stats dc(IM*) as IM* | transpose| fields column | Then I was planing use one column put to the macro using FOREACH command My idea was: index=test_im | stats dc(IM*) as IM* | transpose| fields column | foreach * [ mymacro(<>) ] Macro: will populate <> with columns (like ASSIGNEE later another coulmn and so on. )At the end result will be combined my macro: eval FLAG=if(isnull($Parameter$),0,1) | eval TYPE="$Parameter$" | stats sum(FLAG) as COUNT by TYPE, sourcetype, REPORT_TIME Sorry for not good expalanation. Just starting with Splunk and want to explore a lot of new commands. ... View more

I think with your hint I am closer to solution however I have encounter further issues.Results are not combined into one. It is showing last result It looks that my macro does not work properly. eval FLAG=if(isnull($Parameter$),0,1) | eval TYPE="$Parameter$" | stats sum(FLAG) as COUNT by TYPE, sourcetype, REPORT_TIME Once I am testing without macro and put brackets ] after second eval expression - i have got result for one filed. Once I put them at the end I got error message. ...... | foreach IM_* [eval FLAG=if(isnull(<>),0,1)]|stats sum(ERR_FLAG) as ERR_COUNT by sourcetype, REPORT_PERIOD Foreach can not deal with Text. ... View more

I want to get my list from search if possible. It will be 8 column names. If not I can maybe use CSV file and use inputlookup command Then I want to add one column name at the time run a macro then add another and run a macro. At the end result will be comined. example data: Name ID ect hope this help ... View more

This sounds good. Will be possible to pick source type ? (becase i have different files to upload) ... View more