I have events like these: 20131212 17:59:07@VE@SANL31 EHDB 121755 CCA@06240@EHAM@ @E 4.47N52.18@Successfully completed 20131212 17:57:17@VE@SANL31 EHDB 121755 @06240@EHAM@ @E 4.47N52.18@Successfully completed These events belong together because they have the same MessageTime (121755). Using the following subsearch I can return them in pairs: [search sourcetype="brem" sanl31 eham Successfully completed (cc*) | fields MessageTime] sanl31 eham Successfully completed How can I refine this search in order to only return the one containing CCA when there is no message not containing the CCA? In this example no event should be returned because both appear. If however the second event was not there I want to keep the first one. ... View more

When I create a graph plotting the delay in a message using count by delay: eval Delay = strptime(Time, "%H:%M:%S") - strptime(substr(MessageTime, -4), "%H%M") | fieldformat Delay=substr(tostring(Delay,"duration"),1,8) | stats count by Delay The graph looks ok, but when I click on a value, no events are shown. Splunk adds e.g. Delay="00:02:17" to the search, but the original Delay was in seconds and it should add Delay="137.000000" to the search. Is there a way to click on the graph but keep the ability to format the representation? ... View more

I have two saved searches, saved them as macros. 1: [search sourcetype="brem" sanl31 eham Successfully completed (cc*) | fields MessageTime] sanl31 eham Successfully completed cc* | stats count This is saved as brem_correction_count 2: [search sourcetype="brem" sanl31 eham Successfully completed (cc*) | fields MessageTime] sanl31 eham Successfully completed NOT cc* | stats count This is saved as brem_corrected_count How can I use these searches to subtract the outcome of the 2 searches? ... View more