Hi guys, As I understand, dedup command will filter the complete set of results and remove any duplicate fields. What if I want it to remove daily duplicates only? In other words, I would like to have duplicates, if their events happened on different days. Is this possible? Thanks, Max ... View more

Hi guys, I faced this problem when implemented "Export" functionality to my reports. Unfortunately, time there was only displayed as a non-readable timestamp, so I had to convert the _time value to a human-readable string. It resulted in my X-axis to look like a complete mess It seems that the _time change has also changed my span parameter, though it's actually empty. Anyway, the thing is that I now need span=2h for the search results (i.e. the actual line), but I don't need to see that many "time sockets" on the bottom. What I'm looking for is something like the default timeline, like that: Where report's line does not necessarily have a timeline slot allocated at each results set. So I was wondering, if there is a module or a parameter that I can use in order to specify the span parameter particularly for the timeline, not for the whole search. Alternatively, is there a way to format the _time value exported into the CSV, so that the online report will remain untouched? Thanks. ... View more

Hi everyone, I have a questions in regards to the data representation in Splunk. The sample user agent field we have is: ua = Mozilla/5.0 (Linux; U; Android 4.0.3; en-us; ASUS Transformer Pad TF300T Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Whenever I build a report based around the ua field, it's being represented by the full value string. I wonder if there is a way to tell Splunk to only display either a device name or OS version based on the regular expression? In other words the above list will look like: iPad 1 iPad 2 Samsung Galaxy ASUS Transformer Pad List item Or Android 4.0.3 iOS 3.2 iOS 4.1 Android 3.1.3 To give you a better understanding, the reports that I need to create are: Top device models hourly over a period of time Top OS versions hourly over a period of time Thanks, Max ... View more