Hi, Try this index=_audit user!="splunk-system-user" user!="N/A" user=* host=* NOT (action=log* info=fail*) | chart dc(user) as "Splunkers" by user , date_wday Thanks Anantha ... View more

Try this | rex field=AbsoluteUri "https://\w+.\w+\w/\w+/(?<uri>[^(\/)|(\s)]+)" | table uri ... View more

check the below link https://answers.splunk.com/answers/134553/how-to-delete-data-index-reset-start-from-scratch.html Hope this helps. Thanks Anantha. ... View more

Please try with below code | rex field=Opened "(?[^\s]+)" | eval "FTime"=strptime(opdate,"%Y-%m-%d") | table FTime opdate _time | rename _time as LTime | eval duration = round((LTime-FTime)/86400) | table duration Hope this works ... View more

try this | rename Opened as InTime | eval "FirstAuth"= strftime((InTime ),"%d.%m.%y") | rename _time as OutTime | eval "LastAuth"= strftime((OutTime ),"%d.%m.%y") |eval Lastloginduration = round((LastAuth-FirstAuth)/86400) |table Lastloginduration ... View more

try this | inputlookup AND value=x ….. | search creationDate="1/*/2020" this should list all values in lookuptable for all Jan Month. ... View more

try giving double $ sign . passed variables should be in $$ sign. | map search="search [| makeresults | eval evaltest="$$test$$" | return $evaltest]" ... View more

Hi, you have to use "Last seen" for rest of your query and you are evaluating and assigning _time value to this variable give |sort - "Last seen" | fields - "Last seen" . Thanks Anantha. ... View more

Hi , try this base query| spath | stats count(**documentType) as DocType, values(**reference) as Reference , values(**name) as Name by **msg| rex field=**msg "Filtered\sstatements\sfor\saccount\s(?P<AccountNo>[^\:]+)" | search DocType > 1 | table AccountNo , Name, Reference, DocType . Here when we use spath , fields are automatically extracted . Choose the right field name that is under interesting fileds and put in above query and try . Thanks Anantha. ... View more

@skoelpin : My syntax is not wrong. May be it did not worked in this scenario .It did work for me when I had to take the time difference. when you assign time to a variable , it is automatically converts to epoch format. I believed Gravi was assigning different _time's to Time1 and Time2 variable. Thanks Anantha. ... View more

Hi, Try this once Let the time be in %H instead of %I format . then | eval Duration = tostring((Time2 - Time1), "duration") | table Duration . Thanks Anantha. ... View more

try this basequery | spath | you will have all fields from Json expanded . Use the proper field that represents failed , proccessd and succeed from the extracted fields . Thanks Anantha. ... View more

try this base search|spath "body.totalTime" | eval body.seconds=body.totalTime*1000 | eval body.minutes=body.seconds*60 |table body.totalTime, body.seconds, body.minutes ... View more

Hi Try this | rex field=_raw "error\smessage\s(?P<ErrorMessage>.*)\s:\smessage\s" | table ErrorMessage ... View more

Hi, Try this |rex field=_raw \,(?P<Date>[^\s]+) (?P<Time>[^\s]+) | table Date Time Regards, Anantha. ... View more

Hi, sorry cant understand Chinese. but can say that the results will be shown 3rd(Statistics) and 4th(Visualisation) tabs. If you are in "Fast mode" , then you cannot see events . If you want to see the events you have to change to "Verbose Mode". Hope this helps. Thanks Anantha. ... View more

Thanks Gaurav . This worked. Actly I aslo tried the same code to initiate the token but was trying to get the value from same Panel. This has to be obtained by different panel (hidden as you mentioned) . Thanks for the help. Wish we had a solution to get token value from same panel . Thanks Anantha. ... View more

I tried this, but getting "$result.devAppC$" as a result but not value. ... View more

It gives one result , but varies depending on customer choosen. ... View more