I have a query to breaks up the search result into multiple time period below eval Period=if(_time > relative_time(now(),"-2d"),if(_time > relative_time(now(),"-1d"),"day_0_1","day_1_2") This works if the query latest time is now, but if I select the time range to be 7-10 days ago, how would I reference the start time of the search time range so I can pass it into relative_time? thanks ... View more

I am trying to write a search that reports the percentage of total users impacted from log data. // All users will have this line recorded initializing user blah blah // success user will have this line recorded init succeeded // fail users will have a few variations init failed A init failed B How do I write a search that counts the occurrences of these strings and calculate a percentage from there? Also preferably, I would like to use the userid field to only count each user once. The report would look something like Total User | Success Rate | Failure Rates 53334 | 99% | 1% I tried using the append command to combine the counting of each result, but it is too slow. I was hoping for a more streamline answer. Thank you very much ... View more

I have a stats table like this Header1......Error....Count 0-24hr..........1a..........1 0-24hr..........2a..........2 0-24hr..........3a..........3 24-48hr........1a..........4 24-48hr........2a..........5 24-48hr........3a..........6 and I'd like to transform it into a table like this and I'd like to sort it by one of the columns (for example 0-24hr column) Error 0-24hr 24-48hr 1a..........1..........4 2a..........2..........5 3a..........3..........6 How would I do that? thank you very much ... View more

I have a Splunk search that generates a table of errors. Each row is an error entry. I would like to compare the change of the entries from 2 time periods (24-48hrs ago vs last 24hrs) for spike in errors. Is it possible to do so with Splunk? thanks ... View more