This works, thanks! ... View more

I tried this but seems this is not working. I want to convert BST to EST please. | eval BST=strftime(TransactTime/1000000000, "%d/%m/%y %H:%M:%S %Z" ) | eval TimeZone=BST+" -EST" | eval ET=strftime(strptime(TimeZone,"%d/%m/%y %H:%M:%S %Z"),"%d/%m/%y %H:%M:%S %Z") | table BST, ET ... View more

why you didn't accept answer if it works? ... View more

Since it is production it cannot be done. ... View more

Not sure why you would consider that "not the clean way", but six months later, I would not be using a + at all. This is cleaner, in my current opinion: Index=some sourcetype=a OR sourcetype=b or sourcetype=c | eval result=coalesce(result,FieldA,FieldB) | timechart span=7d sum(result) as result ... View more

Try like this response_code=200 | filterbots | stats count fields I want to show, dc(src_ip) as distinctip by IPLocation | append [| inputlookup docs | eval count=0 ] | sort IPLocation DocumentFoo - count | dedup IPLocation DocumentFoo | search DocumentFoo="name of document" | table fields I want to show ... View more

Thank you very much! ... View more

Ah ok that can happen too. Also something that happens is missing quotes, wrong quotes, etc. ... View more

I was able to figure out the rex. The following works! Thanks everyone. rex field=_raw "(?ms)^(?:[^\"\n]*\"){9}(?P\w+)" ... View more

Thank you!. You saved me lot of time. ... View more

If you don't see a download link on the app base (https://splunkbase.splunk.com/app/1841/ ), then you might need to contact support or your sales rep. Good luck! ... View more

How did you upgrade? can the upgrade be done like an update? ... View more

Unfortunately I cannot use timewrap as I cannot import the app. Is there any other way to get the desired result? ... View more

Thanks. When i used the second one (which is what i am looking for) i got error and modified by adding eval but did not get any results as chart but results are returned in the events, no visuvalization or stats. "Error" | bucket span=1s _time | stats count by _time as t_err |eval t_err=if(t_err>0,1,0) | bucket span=1d _time | stats sum(t_err) as totalSecsDown by _time | eval Percent_Available = round((86400-totalSecsDown)*100/86400,2) | timechart span=1d max(Percent_Available) as Avail.Pct ... View more

yoursearch |eval time1=strftime(_time,"%b-%y") |eval time2=strftime(_time,"%Y%m") |stats count by time2 time1 |fields - time2 This should work. ... View more