Hi All,  I would like to get last event occurred time of each day, my searching window area is last 30 days. For example : If my query return 3 events for day1 and 5 events for day 2 than I need only two event in output.  last event time of day 1 and last event time of day 2 and so on. I tried to get that with help of table command.  it works for me. but I need to do that without using of table command.  worth if you could help me to find rename or create duplicate field of date_mday and _time search | table date_mday, _time | dedup date_mday | sort date_mday. ... View more

I have Below Splunk query to get some data from my logs index=myindex sourcetype=mysourcetype "search string" | stats sum(TotalRecords) As "Total Records", sum(TotalTime_Taken) As "Total Time Taken" by Content Below is the result of the above query Content_Type Total Records Total Time Taken ========== ============= =========== Documents 13 25 Blogs 25 120 Events 2 5 I want another column in my result Average_time_taken Average_time_taken = Total Time Taken / Total Records The result should be as below Content_Type Total Records Total Time Taken Average_time_taken ========== ============= =========== ==================== Documents 13 25 1.9230 Blogs 25 120 4.8 Events 2 5 2.5 ... View more

Hi All, In my log, I have one field called ServerName. Below are some values of that field. DAAPP2aBANG2 DFAPP20bLON2 UATSER1aUS1 UATSER1bUS2 We differentiate the above server with node A and node B based on the first character we got after the first occurrence of one or more digit. DAAPP2aBANG2 -- its node a DFAPP20bLON2 --- its node b UATSER1aUS1 --- its node a UATSER1bUS2 --- its node b Here I want to create two fields called NodeA, and NodeB In NodeA it should contain DAAPP2aBANG2 ,UATSER1aUS1 In NodeB it should contain DFAPP20bLON2, UATSER1bUS2 ... View more

Hi All, I am new to Splunk, I am looking for dynamic field creation based on a comparison between two fields value. I have two fields in my search which named login_session and logout_session login_session contains value like below: 0343547092129730B6AA6C2367ABA709 07CF0EDE89760D3D16AA009B05B26942 096E6160F6C77B19A8FC486D9552CE79 0DA20333C8F2E602AFB0A5453D8A42EA 0E0FDC4D83637F3B88B679884CB7F553 0F37F388296DDFCD2D30A0E4DCE2C295 logout_session contains value like below 07CF0EDE89760D3D16AA009B05B26942 0DA20333C8F2E602AFB0A5453D8A42EA 0E0FDC4D83637F3B88B679884CB7F553 So I need to create new field named active_session in this field value should be: 0343547092129730B6AA6C2367ABA709 096E6160F6C77B19A8FC486D9552CE79 0F37F388296DDFCD2D30A0E4DCE2C295 So in simple words, I need to create new field active_session and this field contains the value of login_session which is not present in logout_session. ... View more