@mseijos - Marking this answer as accepted as it seems working. And it has been answered correctly first. Let me know if this doesn't work for you.   Splunk Community Moderator, Vatsal Jagani ... View more

I tried    index= earliest=-600@m | stats max(_time) as maxT min(_time) as minT | eval maxtime=strftime(maxT,"%Y-%m-%dT%H:%M:%S.%Q"), mintime=strftime(minT,"%Y-%m-%dT%H:%M:%S.%Q")   and got back 10 min of events as expected based on your explanation. ... View more

Thank you, @richgalloway!  I never learned about return command and the use of $field. ... View more

It's just a field.  There's nothing wrong or special about  | search search=foo ... View more

Hi @pm771, the filter in Alerts page is only to find an alert. If you want to put some boolean condition, you can do it in the search. Anyway, if one of the answers solves your need, please accept it for the other people of Community, otherwise tell us how we can help you about your request. Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated by all the Contributors 😉 ... View more

As @richgalloway says, fields is a useful command, particularly when dealing with large data sets, as it instructs the search to remove unwanted data from the event, thus improving efficiency. An important point about fields is that it typically runs on the indexer before the data is returned to a search head, so it can be very important in minimising the data flow through the Splunk environment, therefore improving your search performance, but also having less impact on others' search performance.   ... View more

Excellent explanation @acharlieh! This "| collect testmode=true " was also nice trick ! ... View more

What I meant was: | makeresults | eval i1=if(null==null, "true", "false") | eval i2=if(null!=null, "true", "false")  The return will be false and false.  ... View more

Hi @pm771  I think the Splunk docs are not very detailed about this and could be improved, for sure.  I believe it's just python libraries in the Splunk backend so, yes, any valid python strftime() modifiers will work (dependent on the installed Splunk python version). Here's a run anywhere example I tried.   | makeresults | eval epoch=relative_time(_time, "@month") ,date1=strftime(relative_time(epoch, "@month"), "%Y-%m-%d") ,date2=strftime(relative_time(epoch, "@month"), "%Y-%m-%e") ,date3=strftime(relative_time(epoch, "@month"), "%Y-%-m-%-d") ,date4=strftime(relative_time(epoch, "@month"), "%Y-%#m-%#d")   Note the %e has a leading whitespace so stick to either %-d or %#d. Hope this helps.   ... View more

Hi there was days when there haven’t been true() as function, for that reason 1=1 was a way to do that. r. Ismo ... View more

@to4kawa , Thank you. It works. Since I'm dealing with relatively large data sets I stumbled into 10,000 limit on sort.   So, I used sort 0 _time. ... View more

The Answers site is not run by Splunk so it's unlikely Answers can use Splunk's code for syntax highlighting. ... View more

[Answering my own question.  Any ideas for improvement are welcome] index=... [| inputlookup ZeroEvents.csv | where Category="custom" | fields event| format] | stats count as eventscount by event | append [ | inputlookup ZeroEvents.csv | eval currentdate=strftime(now(),"%Y-%m-%d") | lookup NoEventDates.csv NEDate as date OUTPUT NEDate as Holiday | eval Holiday=if(isnull(Holiday), "N", "Y"), DOW=strftime(now(), "%w"), currentHour=strftime(now(), "%H") | where Category="custom" AND NOT match(DaysOfWeek, DOW) AND (Holiday="N" OR HolidaysOff="N") AND currentHour >= HourFrom AND currentHour <= HourTo | fields event | eval eventscount=0 ] | stats sum(eventscount) as total by events | where total < 1   The main change is that almost all filtering is done on lookup table itself. Advantages: DRY principle is obeyed (almost) Main lookup logic is isolated and can be debugged on its own In order to test it's necessary to replace 4 variables with desired hard-coded values. Due to late filtering the query will perform extra work, but its performance is still acceptable.   ... View more

Hi I hope that this link helps you https://community.splunk.com/t5/Splunk-Search/What-s-the-difference-between-where-and-search-in-the-pipeline/td-p/77055 If not there are quite many other explanations what are the difference between search and where, which you could found by google.  Basically search are using for search and where is using for expressions.  r. Ismo ... View more

@renjith_nair , Thank you very much for your reply. I was considering  an`append` approach but did not come with `count()` and `sum()` combination. ... View more

you're welcome. try to present your final query. ... View more

Give this a try index=common_index sourcetype=common_sourcetype (EventName=First somethingElse=whatever) OR (EventName=Second) | eval EventNameToUse=if(EventName="First",EventName,null()) | stats dc(EventName) as reportedOnvalues(EventNameToUse) as EventName values(keyField) as keyField by GroupId | where reportedOn=2 | table EventName keyField ... View more

You're correct in that +? is the lazy 1 or more quantifier that I was talking about and is enough for the problem at hand... The (?:x|y) syntax denotes a non-capturing group with two options x and y. Since you don't care to capture either the comma nor the end of line character, by habit, I typically mark such as non-capturing since there's no need for your regex processor to spend time keeping the value of that group around. There are some other group syntaxes (atomic groups for example) that have other characteristics in terms of what they do vs performance ... View more

@pm771 - all those other verbs are effectively just skins for stats - chart , timechart , eventstats and so on. But, regardless, it's best to stick to lower case for verbs and functions, and upper case for Boolean operators. Home grown functions and macros, use the case you wrote them in. ... View more

There's a more official response regarding the difference here - https://answers.splunk.com/answers/306047/is-there-any-performance-impact-when-you-use-searc.html Basically, "search" may be slightly more efficient, but "where" allows you to compare the values of two fields. | search x>y The above searches for values of X that are greater than "y", whereas the below searches for values of X that are greater than the value of Y. | where x>y Thus, when it can be used, "search" is slightly more efficient because it isn't analyzing the right side of that equation. ... View more

Like this: ... | eval BOSS=if((Position="Boss"), Name, null()) | stats values(BOSS) AS BOSS values(Position) AS Position BY Department | search Position="Particular" | table BOSS ... View more

Actually my requirements were: how many times frequent travelers visited each location, so I dd not need distinct count. ... View more