Hi Team, I have two searches one is normal search and another in lookup, both returns the count. Both always return a single value so I used appendcols. My end goal is to perform eval operation on them as shown below. Query index=data | stats dc(number) as X_data | appendcols [| inputlookup data.csv | stats dc(number) as Y_data] | eval result =X_data/Y_data Since the outer search results returns fast in this case X_data, the eval is evaluating the expression before outer search is complete Y_data.  Example X_Data =237 Y_data =71 Expected result = 3.29 Actual result = 1.00 How do I fix this issue ... View more

Hi Team, I have time in below two  formats and I want to convert them to minutes. How can I do this Format 1 1 Hour 10 Hours 47 Minutes 1 Day 5 Hours 15 Minutes 45 Minutes Format 2  00:00:00 00:09:00 22:30:00 ... View more

Hi Team, I am trying to run a search and get the searchId, I will use this searchId later to fetch the results.       curl --location --request POST 'https://splunkcloud.com:<port>/services/search/jobs?output_mode=json' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer JWT' \ --data-raw 'search=search |rest /servicesNS/-/-/saved/searches/ splunk_server=local | rename eai:* as * | rename acl.* as *|search app=*| table triggered_alert_count, title       I am getting the SID and  doing get       https://splunkcloud.com:<port>/services/search/jobs/<SID>/results?output_mode=json        I am getting the error as below       { "messages": [ { "type": "FATAL", "text": "Error in 'rest' command: This command must be the first command of a search." } ] }          This works fine for normal searches, but not for searches thats starts with |rest. Let me know why rest is not taking | even after adding it. ... View more

Hi Team, I want to extract aws-region from host name.  host= "my-service-name-.ip-101-99-126-252-us-west-2c".   I want to extract us-west-2 from the host. How I can achieve this. ... View more

Hi Team, I have a requirement in splunk, where if instance count went down it should alert. For example if I have 10 instances running in a application and in which 4 went down, then splunk should be able to compare previous results and present results and trigger the alert as its less than 10. Basically, I want base line alerts, where it should compare previous values to current and if its not same it should, Please let me know how this can be done. ... View more

Hi Team, I have data for the year 2016. I want to display the data on a quarterly basis, and I want to customize the duration for each quarter, like 2016 DEC- 2017 Feb as one quarter and 2017 March to 2017 June as one quarter etc. Can you please let me know, how this can be achieved? I googled and got this query, but not sure how this will work. |eval period=strftime(_time,"%Y")."-Q".(round(tonumber(strftime(_time,"%m"))/3)+ 1) ... View more

Hi All, This give me value by subtracting 7 days from now |stats count | eval next_time=relative_time(now(),"-7d@d")| convert ctime(*_time) I am actually want 7 days starting from yesterday and used the below one and its not giving me any value. |stats count | eval next_time=relative_time("-1d@d","-7d@d")| convert ctime(*_time) Please let me know, how this can be achieved. ... View more

Hi Team, I have requirement where I need to show or hide panels depending on the drop-down value selected but it's not working as expected. Can you let me know how this can be achieved? ... View more

Hi Team, I am populating the data in summary index using the following Splunk search index=data" | sistats count as total by appName,trueclient, httpstatus,request_uri when, I do stats over this index=summary_ |stats count as total by appName. We are getting lot of difference in counts. When, I run the search directly the app counts are very low, then on summary index it's very high. Why summary index data is returning wrong data? is it because, I added trueclient, httpstatus,request_uri in sistats? ... View more

Hi Team, I have a requirement where, I need to compare multiple apps' data for past two weeks. I have app1, app2, app3 ... app10 in my Splunk and I need draw a trend how it looks current week and compare with previous week. As of now, I am able to do for current week for top 10 apps using below query. index=data |top 10 apps This works fine while visualizing as column chart with app names at the bottom of each column chart, I want to add the same app value next to each column bar for current week and last week. It should be something like below. App1 App1 App2 App2 .................................. App10 App10 currentweek Previousweek currentweek Previousweek -------------------------- currentweek Previousweek I tried using Timewrap but it works for 1 app but not for multiple apps, as I need to display 10 app, Timewrap with Timechart is creating lot of mess in output. Can you please let me know if we have any way to achieve this? ... View more