Hello, I have built the following query "search query" earliest="11/22/2018:18:55:00" latest="11/22/2018:18:59:9" | eval platform = if(source == "S1", "Android", "IOS") | eval server = case(host == "H1", "Server1", host == "H2", "Server2") | eval server_platform = server.":".platform | timechart span=5m count as COUNT by server_platform This works perfectly when there are results, although if a result is not found, no event is returned. I think the problem is that, if no result is returned, the eval will fail and no result is displayed. Is there a way I can create a dummy record and then populate it with the results? I cannot default to a value, because I do not know what it didn't find. Any help is much appreciated, I will continue investigating. Thank you. ... View more

Hello, I am attempting to use Splunk to search two log files that hold activity for two platforms of an application "IOS" & "Android". The log file for each platform unfortunately uses a different identifier for login behavior. I would like to combine both searches into one. Currently each of my searches look like the following (some filters are the same) > index=I1 source=S1 sourcetype=ST1 host=H1 "searchCriteria1"earliest=-1hr latest=now | timechart span=5m count by host > index=I2 source=S2 sourcetype=ST1 host=H1 "searchCriteria2" earliest=-1hr latest=now | timechart span=5m count by host I would like to have the result displayed as follows; total, android and ios. I am using the JAVA API to splunk, so as long as I can differentiate Android from IOS on the response, that is ok. Time | Total Logins | Android Logins | IOS Logins 01:00 | 10 | 8 | 2 02:00 | 15 | 10 | 5 I have looked into "multiSearch" and "subsearches" but I am new to using Splunk and do not know exactly what I am trying to do. Any help is greatly appreciated! Thank you, Anon EDIT: Considering I can differentiate between each platform via "source", the following query does produce a correct result, although I'm unsure if its the correct way. Is there a better way to obtain the following: (index=jboss source=/var/log/jboss/server.log sourcetype=jboss:server:log host="lblux31*" "NewState showDashboard PreviousState checkIfActiveCustomer") OR (index=jboss-mobile source=/var/log/jboss-mobile/server.log sourcetype=jboss:server:log host="lblux31*" "[EVENT]login") earliest=-1hr latest=now | bucket _time span=5m | stats count by _time, source, host | sort - Time ... View more