Hey guys. I'm kind of new to Splunk and was wondering if there was a simpler way of writing this search. index=server App1=1|stats dc(servers) as count1 |append [search index=server App2=1|stats dc(servers) as count2] |append [search index=server App3=1|stats dc(servers) as count3] |table count1 count2 count3 The idea is i need to count the number of servers per application the data is set up something like this which is why i'm doing a distinct count instead of a normal count: Server|App1|App2|App3 _____________________ serv1 |1 |0 |1 serv1 |1 |0 |1 serv2 |0 |1 |0 serv3 |1 |1 |1 serv3 |1 |1 |1 ... View more

Hey guys, So I've used strptime before but for some reason this isn't working properly. I have a column with different types of data like below: Column |Value ------------------ 02/2016 | 100 03/2016 | 200 04/2016 | 150 05/2016 | 450 high | 12 medium | 30 low | 34 I have a column that separates the dates from the rest. so with that me search s simple: index="servers" filter="dates" | eval myDate = strptime(Column, "%m/%Y")|table myDate "filter" would be the field thats used separate the date from other data. This search gives me nothing. What would the problem and how would i get it to work? Thanks in advanced! ... View more

Hey people, I have a simple search I can't get to work. I've tried to look up solutions, but couldn't find anything that worked for me. index="servers" |timechart count(eval(status="On")) as on count and total eval(round(on/total*100)) I keep getting this error: The eval expression has no fields: 'round(on/total*100)' ... View more