Hi , Can i ask about the purge option. Does it apply to KV store only.? If i am just indexing the report (no Kv store) ; in that case are the already indexed records purged on every interval? ... View more

@edavison Thank you for your reply. yes i soon realised the interval setting after posting this question. 🙂 good to know that it actually trigger a report to run on the interval and pull a fresh extract in which can yes there is no need to schedule. I was goin to shedule the report run just before interval but i guess dont need that now. Cheers.. ... View more

https://splunkbase.splunk.com/app/3567/ ... View more

@shaskell_splunk hi Scott, thanks we got it resolved finally. Just did nt work correctly on splunk 6.4 , works fine on later versions 🙂 Thank you ... View more

You could extract year from your period field.. Not sure what's the formal of period value but you can simply use combination of substr and mvindex to do this. Then can do |stats count by . Depending on use case you could also use the inbuilt interesting field called date_year to do the count. Hope this helps Cheers ... View more

Thank you for the info Luke. 🙂 ... View more

the raw event can have either SC or SNC but not both for an individual event thats why i am fetching both the events by using | eval TARGET=CASE( Work_Notes LIKE "%SC=%",1, Work_Notes LIKE "%SNC=%",2) | search TARGET=1 OR TARGET=2 ... View more

index=sdp-fr sourcetype=sdp_remedy_workorders_worknotes | join Work_Order_ID [search index=sdp-fr sourcetype=sdp_remedy_Workorders] | search Company="*" Work_Order_ID=* Status="*" | eval TARGET=CASE( Work_Notes LIKE "%SC=%",1, Work_Notes LIKE "%SNC=%",2) | search TARGET=1 OR TARGET=2 | regex field=_raw "SNC=(?<snc>[^\s]+)\sService\s(?<idl>.*)" | rename Actual_End_Date AS Closing_Date | table Company Customer Work_Order_ID Submit_Date Closing_Date Work_Order_Type Status Submitter Summary Support_Group Work_Notes Work_Log_ID snc idl ... View more

| regex field=_raw "SNC=(?[^\s]+)\sService\s(?.*)" still got the same error. as you can see I am trying to fetch the fields IDL and SNC from the Work_Notes field. the whole raw event is : Work_Log_ID=CWL000000164885 Work_Order_ID=WO0000000050093 Submit_Date=1462945570 Work_Log_Type="General Information" Submit_Time="2016-05-11 17:46:10.000 " Work_Notes="SC=$170 Service IDL100611944\x00" ... View more

Thank you for your response. I am intrested in raw event containing both: SNC=$170 Service IDL120686730 OR SC=$170 Service IDL120686730 which I filter using the CASE statement as shown below. I tried to use the regex for SNC but I might be missing something. Error in 'SearchOperator:regex': Usage: regex (=|!=) index=sdp-fr sourcetype=sdp_remedy_workorders_worknotes | join Work_Order_ID [search index=sdp-fr sourcetype=sdp_remedy_Workorders] | search Company="*" Work_Order_ID=* Status="*" | eval TARGET=CASE( Work_Notes LIKE "%SC=%",1, Work_Notes LIKE "%SNC=%",2) | search TARGET=1 OR TARGET=2 | regex Work_Notes=_raw "SNC=(?<snc>[^\s]+)\sService\s(?<idl>.*)" | rename Actual_End_Date AS Closing_Date | table Company Customer Work_Order_ID Submit_Date Closing_Date Work_Order_Type Status Submitter Summary Support_Group Work_Notes Work_Log_ID snc idl ... View more