I have a set of data that I would like to exclude the second search result set from. First search: Gets me all the error files. index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") DownloadException" NOT ("pdf.*" OR "jpg.*") | rex "Error in reading an asset: (?<uid>.*)\." | eval asset_uid=substr(uid,len(uid)-35) | dedup asset_uid| table asset_uid sample data: (about 1k reords) a562e77e-2291-44d7-94a9-0fcc97621288 d4852cc6-c92d-4748-83b3-0c32d20dd6cf second search: Gets me all the file not found error files. index=foo sourcetype="blah" (host="xxx*" OR host="xxx*") FileNotFoundException NOT ("pdf.*" OR "jpg.*") | rex "FileNotFoundException: (?<file>.*)\." | eval asset_fail_uid=substr(file,len(file)-35) | table asset_fail_uid I would like to exclude all records from second search from first search. Any help is appreciated. Thanks. ... View more

I'm trying to replicate the following graph (not based on splunk data) into splunk. On Time Batch - Planned Time is equal to SLA. I'm using the following search: sourcetype=foo job_status=completed | eval SLA="06:00 AM" | eval Date=strftime(_time, "%m-%d-%y") | eval EndTime=strftime(_time, "%H:%M %p") | table Date EndTime SLA ... View more

I'm sure this may have been asked before. When using transaction, I would like to format the duration into H:M:S , my search results for jobduration looks like 19 is being added to the result. Any help is appreciated. Search is: sourcetype=tws_merged (job_cpu_name ="cclita*" OR job_cpu_name ="cplisa3*" OR job_cpu_name = "cpaisa*f" OR job_cpu_name="lp0d7*") job_stream_name!="UNIXDLY" | transaction job_name host startswith"Jobman streamed" endswith="has completed SUCCESSFULLY" | eval Date=strftime(_time, "%m-%d-%y") | eval JobDuration=strftime(duration, "%H:%M:%S") | table Date job_name JobDuration Sample Results: 02-03-16 ELSHPCST 02:56:52 02-04-16 ELVALRTD 19:00:00 02-04-16 ELVALRTPE 19:00:00 02-04-16 ELVALOOS 19:00:00 02-04-16 ELVALRTD 19:00:00 02-04-16 ELVALRTPE 19:00:00 ... View more