What you will need is two lookup files. One with list of all possible machines (only one column called machine ) and second with a list of all possible files (one column called file ). Assuming you events look exactly as you have provided in your question, try something like this... | your base search that returns "Machine: A, File: Foo, SizeMB: 10" in each event | rex field=x "Machine:\s?(?<machine>\w+),\s?File:\s?(?<file>\w+),\s?SizeMB:\s?(?<size>\d+)" | append [| inputlookup machinelist.csv | table machine | eval file= [| inputlookup filelist.csv | mvcombine file delim="," | return $file] | makemv file delim="," | mvexpand file] | stats max(size) as size by machine file | stats perc50(size) by file ... View more

@zacksoft, you could do as @niketnilay suggests here or you can create a new field for "pro_con" or "action" (call it whatever) with two values "produced" or "consumed" and then you can chart over state. Like this should work host="A" OR "B" ("orancon" OR "oranpro") | eval pro_con=case (match(_raw, "orancon"), "consumed", match(_raw, "oranpro"), "produced", 1=1, "UNK") | timechart count by pro_con OR | stats count by pro_con OR | chart count over some_other_grouping_field by pro_con @niketnilay's search is probably more efficient, whereas the above may be more readable. More options to achieve same result. ... View more

Have you tried using search events to capture earliest/latest? From your question, it appears you want to pass earliest/latest for the search used in the single-value panel, right? Try this (can be used for any search block) <panel> <single> <search> <query>...</query> <done> <set token="e">job.earliest</set> </done> </search> ... </single> </panel> http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Search_event_elements_and_job_properties ... View more

Try this | makeresults | eval selectedtime=$t.earliest$ | eval dbformattime=if(isnum(selectedtime), stftime(selectedtime, "%F %H:%M:%S:%3Q"), strftime(relative_time(now(), selectedtime), "%F %H:%M:%S:%3Q") You could also do the formatting in the change event of the timepicker. Like this <input type=time token="t"> ... <change> <eval token="dbxTime">if(isnum($t.earliest$), stftime($t.earliest$, "%F %H:%M:%S:%3Q"), strftime(relative_time(now(), $t.earliest$), "%F %H:%M:%S:%3Q")</eval> </change> And just use $dbxTime $ in your query ... View more

Try like this response_code=200 | filterbots | stats count fields I want to show, dc(src_ip) as distinctip by IPLocation | append [| inputlookup docs | eval count=0 ] | sort IPLocation DocumentFoo - count | dedup IPLocation DocumentFoo | search DocumentFoo="name of document" | table fields I want to show ... View more

See if this works | eval status=if(like(_raw, "%gcmMtmReports%"), "Completed", "NotComplete") | stats count by status | eval "Completed"=if(isnull(Completed) OR Completed=0, "Not Complete", "EU Run Completed") | table "Completed" | eval range=if(status="EU Run Completed", "low", "severe") ... View more

Try this "run-anywhere" sample. Use from the first rex till the end for your data. | makeresults | eval x="<ab1:search-name>ABC-123-XYZ</ab1:ab1:search-name> <ab1:search-response>YES</ab1:search-response> <ab1:search-relevance>15</ab1:search-relevance> <ab1:analysis/> <ab1:search-name>ABC-001-PROD</ab1:search-name> <ab1:search-response>NO</ab1:search-response> <ab1:search-relevance>25</ab1:search-relevance> <ab1:analysis/>; <ab1:search-name>ABC-123-XYZ</ab1:search-name> <ab1:search-response>YES</ab1:search-response> <ab1:search-relevance>10</ab1:search-relevance> <ab1:analysis/> <ab1:search-name>ABC-001-PROD</ab1:search-name> <ab1:search-response>YES</ab1:search-response> <ab1:search-relevance>20</ab1:search-relevance> <ab1:analysis/>" | makemv x delim=";" | mvexpand x | rex max_match=0 field=x "-name\>(?<name>[^\<]+)" | rex max_match=0 field=x "-response\>(?<response>[^\<]+)" | rex max_match=0 field=x "-relevance\>(?<relevance>[^\<]+)" | eval z=mvzip(name, mvzip(response, relevance)) | mvexpand z | rex field=z "(?<name>[^,]+),(?<response>[^,]+),(?<relevance>[^,]+)" | table name response relevance ... View more

Look at streamstats command. You can use that to add a "counter" in reverse order to your events. Something like this may work base search | reverse | streamstats count http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Streamstats ... View more

You could store all the values in a kvstore . In your dashboard, at the top, assign the values from kvstore to tokens. Something like this may work <dashboard> <init> <search><query>| inputlookup kvstorewithvaluesinonerow</query> <---- should return only one row with fields for each value <done> <set token="mapCenter">$result.field1$</set> <set token="mapRight">$result.field2$</set> </done> </search> </init> ..... ... View more

Have you looked at accelerated datamodel ? From you description, is appears, you have the right query to get you the desired results, what you looking for is a faster solution. http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Acceleratedatamodels ... View more

Please share the props.conf stanza your are using ... View more

What do you mean "duplicates in the id"? Try adding this before the chart segment. | eval id=source."::".id ... View more

Those values/strings are set based on the _time value. If _time is greater/newer than start of the day (@d), then it is Today, else Month ... View more

Why not add REAL to the eventstats, like this? index=data sourcetype=log* Type=INS finalStatus=done | eventstats values(fecha) AS "MES",values(diasLaborablesMes) as "DIAS HABILES",values(OBJETIVO) as "OBJETIVO MES" sum(Q_PRO) as REAL by AGENCIA | eval ING_BRUTO=round(ING_BRUTO,0) | eval currentDay = strftime(now(),"%d") | eval OBJETIVO_DIARIO= floor(OBJETIVO/diasLaborablesMes) | eval OBJETIVO_FECHA= floor(OBJETIVO_DIARIO*tonumber(currentDay)) | eval PORCENTAJE_FECHA=round((REAL/OBJETIVO)*100,2) | eval PROMEDIO_DIA=round((REAL/currentDay),2) | eval PROYECCION=(REAL+(diasLaborablesMes-currentDay)*OBJETIVO_DIARIO) | eval PORCENTAJE_PROYECCION=round(PROYECCION/OBJETIVO*100,2) | eval BRUTO_PROYECTADO=round((ING_BRUTO/REAL)*PROYECCION,0) | dedup AGENCIA |table AGENCIA,MES,OBJETIVO,"DIAS HABILES", OBJETIVO_DIARIO, OBJETIVO_FECHA, REAL, PORCENTAJE_FECHA, PROMEDIO_DIA, PROYECCION, PORCENTAJE_PROYECCION,I NG_BRUTO, BRUTO_PROYECTADO | sort AGENCIA | addcoltotals ING_BRUTO, BRUTO_PROYECTADO | eval ING_BRUTO = tostring(ING_BRUTO, "commas") | eval BRUTO_PROYECTADO = tostring(BRUTO_PROYECTADO, "commas") ... View more

Try this index=**** source="*****_****" "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" AND "Outbound Message" OR "Inbound Message" | rex "(?<info>Inbound|Outbound)" | rex "ID:(?<id>.*)" | chart earliest(_time) as time over id by info | eval responsetime=outbound-inbound | eval responsetime=tostring(responsetime, "duration") | convert ctime(*bound) AS *bound ... View more

Try this index=foo sourcetype=foo earliest=-3d@d | eval when=if(_time>relative_time(now(), "@d"), "Today", "Month") | stats avg(response_time) as avgtime by when ... View more

What kind of results are you expecting? Try this, without transaction command source="/var/log/logstash/dynatraceqa*" businessTransaction="Real User Page Actions - Copy" | stats list(actionName) as actions by visitID application _time | eval eventcount=mvcount(actions) | rename ... | table ... ... View more

See if this query gives you the desired results index="test1" (sourcetype="stype1" OR sourcetype="stype2") | rex "(?<status>Running)" | fillnull value="Not Running" status | stats latest(status) as status by sourcetype | eval running_ok = if(stype1="Running" AND stype2="Running", 0, 1) | eval final=running_ok | table running_ok final ... View more

Try this index="random" host="xxxxxx" Fruits=*"Apple" |stats count by Fruits ... View more