Well, I've got the answer. It's funny. After 8.1.0.1 the web page became wider, may be by 20 pixels or so. It does not fit by the width anymore, now there's a bottom scroll bar. So the export button is not visible until you scroll right. Somehow I was not able to notice this much longer then it should be taking... Is there any way to decrease the width?  NJ ... View more

jeffland, I appreciate your help very much. I had to add a single correction to your code, the events that are started and cleared on the same day were not calculated right. The following has fixed this problem. | eval outage_secs_between = clrtime-eventtime | eval outage_secs_total = min(outage_secs_from, outage_secs_to, outage_secs_between) Regards! ... View more

Thanks, but the above does not create new events, if I'm not missing something. ... View more

With this approach it's possible to expand the event only by the fixed number of new events, 7 in your case, defined by the count. In my case I never know how long is the event, count must be variable calculated per each event. Can this be fixed? ... View more

It would be easier to use a combination of the sitename and eventtime. There is some ID but it's not plain and needs a lot of regexing. If you think there's no other way I'll work on it. Actually we can use only the event with both eventtime and clrtime present and ignore the event with the empty clrtime field. I do not need all that running realtime, it's ok to have report when the event with the clrtime arrives. So when it arrives, we'll have eventtime (start) and clrtime (event end). Thanks, NJ ... View more

eventtime - event creation time, clrtime - event clearance time. For the particular site down event, I actually have two messages. First, when the site goes down, there's an event with a specific sitename and eventtime. clrtime is empty at this moment. When the site comes back online, there's another message, with the sitename and eventtime same as in the previous message and the crltime now is not empty and is he time site came back online. ... View more

eventime_u=clrtime-eventtime; it's set through the "calculated fields" from the Web GUI. I may be able to extract the unique ID it's there in the raw data. It could give me a possibility to fix on the ceasing day. But it's still unclear what could be done on the day in the middle of the event. I was thinking of makeresults command, but not sure. ... View more

I was looking for a hint or an idea. Here are all the details, anyways. | search (SPECPB="*LOSS-OF-ALL-CHAN*") | dedup EVTTIME SPECPB | eval bintime_u=eventtime_u | bin bintime_u span=1d | stats list(sectorname) as sectorname list(eventtime) as eventtime list(clrtime) as clrtime list(eventduration_u) as eventduration_u sum(eventduration_u) as cumulative_sector_down count(eventduration_u) as cumulative_event_count by bintime_u sitename | eval bintime=strftime(bintime_u,"%m-%d") | eval mean_site_down=cumulative_sector_down/cumulative_event_count | eval siteavailability_d=100-round(100*mean_site_down/86400,2) | xyseries sitename,bintime,siteavailability_d My events: _time sitename sectorname eventtime clrtime SPECPB eventduration_u So I'm getting correct results when the event lasts within a day (i.e. it starts after 00:00 and ends before 24:00 of the same day). If the event lasts longer then one day, starting on the day before and ending on the next day, the current day has obviously no event. I need to spread such events trough the following bins somehow. Regards, NJ ... View more

After several regex suicide commitments, I've got this below working: SEDCMD-subst1 = s/(([^;]*;){NN})[^;]*;(.*)/\1SUBSTITUTION;\3/g You can replace the semicolon with your delimiter, NN is an N-1 field to replace, SUBSTITUTION is the replacement text. You can have an empty string there to remove the field. ... View more

Hello, Thanks for your replies. No, as I wrote, I'm not using any forwarder. Splunk is monitoring a file which is being copied from another machine. No, as I wrote, I'm cleaning the index after making changes to SEDCMD to make sure there is no residual data. Yes, the file is proceeded as 'csv' and field extraction is done at the index time. I believe this is the reason. I disabled 'csv' proceeding and now everything is looking fine. Looks like SEDCMD anonymizing just doesn't work with 'csv' Regards, NJ ... View more

Update: https://answers.splunk.com/answers/597431/about-the-license-when-using-sedcmd.html If so, what is the source type of the data - "csv" by any chance? If so, there is extra index time processing done for them (csv and json) May be this is the reason. Any workaround? ... View more