Hello, I have 2 index, one that received about 40 millions records per day and the other one about 80% of the first index.  I have 2 uniques fields in each index that allows me to merge the 2 index.  Is it possible to merge the 2 index before ingestion?  Because if I do mentionne index A OR index B with an eval after it, it's working but I have to limit the period to not more than  a couple of hour or else it take a lottttt of time before getting the result.  Plus if I want to limit the result by having a selection on other criteria, I need to merge them before aplying those criteria because the information is devided into the 2 index.   I have been trying to figure out this one for months now with a lot of trial and error that is why i'm giving a shot here.   Thanks!      ... View more

Hello Splunker! I added the "tostring + commas" to a number to get the thousand separator. Work's fine. The problem is when I do the rex command to replace the commas with a space to match the canadian format number, my numbers get shifted on the left side. Is there another way to do so, so I can keep my number on the right side? See code below: | eval sum_totrows=tostring(sum_totalrows,"commas") | rex field=sum_totrows mode=sed "s/,/ /g" Result: 407 930 119 14 131 ... Thanks! ... View more

I'm trying to put an apostrophe in a colunm title into a dashboard I tried with renameand fieldformat but it does'nt work. | rename trCount as "Nombre d'appel" or | fieldformat "Nombre d'appel" = tostring('Nombre appel',"Commas") In fieldformat when I do as above I get a colunm with the right title but I got 2 colunm: Nombre d'appel AND Nombre appel. I only want Nombre d'appel. Thx a lot!!! ... View more

In a dashboard I have a drilldown menu to select wich system ID to use. If no system is selected I use all system if there's a selection I use the system selected. So in a search (makeresults) I passed the value to a token that I use in the scale threshold color to either put green, yellow or red color to the listed cell. -search- -query-|makeresults | eval seuil_TPS=750, pre_seuil_TPS=round(seuil_TPS*0.90,2) -/query- -earliest-$sel_date_1.earliest$-/earliest- -latest-$sel_date_1.latest$-/latest- -done- -set token="tok_seuil_TPS">$result.seuil_TPS$-/set- -set token="tok_pre_seuil_TPS">$result.pre_seuil_TPS$-/set- -/done- -/search- And I use the and in my dashboard as follow: -format type="color" field="Max Total IMS" -colorPalette type="list">[#65A637,#F7BC38,#D93F3C]-/colorPalette> -scale type="threshold">[$tok_pre_seuil_TPS$,$tok_seuil_TPS$]/scale> -/format> This work OK. But when I choose a system my token value doesn't work. -search> -query>|makeresults |append [|inputlookup Seuil_lookup] |where Name=$sel_Name|s$ |eval pre_seuil=round(Seuil*0.90,2) |table Sys_name, pre_seuil, Seuil -earliest>0-/earliest> -sampleRatio>1-/sampleRatio> -done> -set token="tok_sel_Sys_name">$result.Sys_name$ -set token="tok_sel_Seuil">$result.Seuil$ -set token="tok_sel_pre_seuil">$result.pre_seuil$ -/done> -/search> -format type="color" field="Max $sel_Name$"> -colorPalette type="list">[#65A637,#F7BC38,#D93F3C]-/colorPalette> -scale type="threshold">[$tok_sel_pre_seuil$,$tok_sel_seuil$]-/scale> -/format> I need help Please. Thx! ... View more