Happy to help! Sorry for the typo.. 😅 ... View more

Could you send a sample of your data to understand your question better? And what are you looking to show - average across the 8 sensors or? ... View more

Hi! Something like this should help you: index=* sourcetype="Perfmon:Network Interface" source="Perfmon:Network Interface" counter=* | eval bytes_out=if(counter="Bytes Sent/sec",Value,0), bytes_in=if(counter="Bytes Received/sec",Value,0) | eval bandwidth_mbps=(bytes_out+bytes_in)/1024/1024 | timechart avg(bandwidth) Please replace index=* with your index name, as it is bad practise to use index=*. I'd strongly suggest doing the free Splunk Fundamentals 1 course, it will help you understand basic SPL better. ... View more

Also to note that there must be events on the "last working day" for this search to work. ... View more

Hi!  Here's a solution that will work if your data has the default field "date_wday" extracted (see docs here). Although it is a default field (extracted automatically), you should read the docs before using this field. If this field is not available, you would need some other logic to determine the weekday for each event. index=yourindex earliest=-4d@d latest=-0d@d date_wday IN ("monday","tuesday","wednesday","thursday","friday") | eventstats latest(date_wday) as last_weekday | eval previous_working_day=case(last_weekday="monday","friday",last_weekday="tuesday","monday",last_weekday="wednesday","tuesday",last_weekday="thursday","wednesday",last_weekday="friday","thursday") | where date_wday=last_weekday OR date_wday=previous_working_day ... rest of your search... Basically the search will look back last 4 full days (as on Monday it will have to look back for Thursday-Friday). It will filter to only look at weekdays, determine last week day, and based on this, determine the previous week day. Then it will filter to only show those last two weekdays. Hope this helps! 😊 Phoebe ... View more

Really late to the party but this still shows in Google search results so here you go:   | eval mv_combined_field=mvzip(mvfield1,mvfield2,"|") | mvexpand mv_combined_field | eval mv_combined_field_expanded=split(mv_combined_field,"|") | eval mvfield1=mvindex(mv_combined_field_expanded,0), mvfield2=mvindex(mv_combined_field_expanded,1)   The delimiter "|" was chosen assuming your data does not contain pipes. It is just to separate the events for later extraction. So with mvzip we take first value of mvfield1 and mvfield2 and combine them together (separated by "|"), same with second with second and so on. Now we've created a single mv field.Now expand with mvexpand and split the values, taking first value with mvindex and second value with mvindex. For more than 2 fields you can nest it (unlimited times):   | eval mv_combined_field=mvzip(mvfield1,mvzip(mvfield2,mvfield3,"|"),"|") | mvexpand mv_combined_field | eval mv_combined_field_expanded=split(mv_combined_field,"|") | eval mvfield1=mvindex(mv_combined_field_expanded,0), mvfield2=mvindex(mv_combined_field_expanded,1), mvfield3=mvindex(mv_combined_field_expanded,2)   Hope this helps! ... View more

Thanks heaps, that helped!! ... View more

If there is anybody still looking at finding an alternative for using commas in a csv lookup file, because they CAN'T use commas, because their fields contain commas, GOOD NEWS: You can use quotes as text delimiters and commas as field delimiters in the following fashion: "field1","field2" "example1 , that contains commas","something" "example2","" "","example3" Splunk correctly extracts field value pairs! ... View more

If there is anybody still looking at finding an alternative for using commas in a csv lookup file, because they CAN'T use commas, because their fields contain commas, GOOD NEWS: You can use quotes as text delimiters and commas as field delimiters in the following fashion: "field1","field2" "example1, that contains commas","something" "example2","" "","example3" Splunk correctly extracts field value pairs! ... View more

Ahh.. thanks heaps!! ... View more