I have a search that calculates latency in a full-mesh network, where each router has a direct connection to all of the other routers in the network. Latency is bidirectional, in other words latency between AAA-CCC is the same as CCC-AAA. I am able to generate a table but only AAA-CCC latency is showing and CCC-AAA is blank (this can be reversed depending on how source and destination was setup). How can I have CCC-AAA to show the same value as AAA-CCC instead of blank? search ... | eval Route=RouterA."_".RouterZ | eventstats perc03(RTT) as RTT_03p, perc98(RTT) as RTT_98p BY Route | where RTT >= RTT_03p and RTT <= RTT_98p | stats min(RTT) as Latency values(RouterA) values(RouterZ) by Route | xyseries values(RouterA) values(RouterZ) Latency This is what I am getting: values(RouterA) |AAA|BBB|CCC AAA&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp |&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp|027|012 BBB&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp |&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp| &nbsp&nbsp&nbsp&nbsp&nbsp| &nbsp&nbsp&nbsp CCC&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp |&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp|010| &nbsp&nbsp&nbsp This is what I want to see: values(RouterA) |AAA|BBB|CCC AAA&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp |&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp|027|012 BBB&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp |027| &nbsp&nbsp&nbsp&nbsp&nbsp&nbsp|010 CCC&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp |012|010| &nbsp&nbsp&nbsp Thank you in advance! ... View more

I am using a search that was provided as an answer to a previously posted question - How to search what values are missing in my lookup table? https://answers.splunk.com/answers/612603/how-to-search-what-values-are-missing-in-my-lookup.html I have a follow up question regarding the above and that is how do I check missing values per day over a period of time? Tried bin _time span=1d but did not work. My query below (lookup file is probes.csv): | fields Router | eval from="feed" | append [| inputlookup append=t probes.csv | table Router | eval from="lookup"] | stats values(from) as from by Router | where mvcount(from)=1 AND from="lookup" | fields Router | sort -Router So expecting an output in table format like this: Date Router 3/21/19 RouterA RouterB 3/1/19 RouterC 2/11/19 Router D Thank you in advance! ... View more

I've seen similar issues being asked, but no solutions/updates on any and hoping that this has been already resolved? | eval Month=strftime(_time,"%b") | stats avg(rtt) by RouteRegion Month | sort -RouteRegion So, as an example, some of my RouteRegion values are APAC_APAC EUR_LATAM LATAM_MEA MEA_USA USA_USA (basically these regions are in full mesh). I want to re-arrange the trellis so that USA to USA and to other regions will be first but the sort function does not work on trellis. ... View more

Sorry, this is more of a regex question but can't figure it out myself. I would like to extract a string preceded by the specific characters "Leg x Seg" where x can be any number. The strings to be extracted can have alpha numeric, dots, or underscore characters. Also, find only the first extraction match so there are no duplicate values per log. So from the single event log example below, the strings I'm looking to extract are: S3R.VPLS92966 EDBK766V0001 P125018_NNI_QBKW5ZP EDBK49MH0001 Event: Summary Leg 3 Seg S3R.VPLS92966 Site PBY CNGHDR JuniperJUNIPER_MX SLOT 3 CARD 2 PORT 0 TAGTYPE vlan TAG 22 STACKINGMODE none Leg 3 Seg S3R.VPLS92966 Site PBY GNBRD9 FujitsuFujitsu9500 SHELF 1 SLOT 1 PORT 1 TAGTYPE vlan TAG 22 STACKINGMODE none Leg 2 Seg EDBK766V0001 Site PBY GNBRD9 FujitsuFujitsu9500 SHELF 1 SLOT 14 PORT 15 TAGTYPE vlan TAG 49 STACKINGMODE stacked STACKEDTAGNUM 31 Leg 2 Seg EDBK766V0001 Site XTRILEC228PHLAPALO XTRILEC 228 PHLAPALO virtualswitchVirtualSeries SLOT 1 PORT 15 TAGTYPE vlan TAG 49 STACKINGMODE stacked STACKEDTAGNUM 31 Leg 2 Seg EDBK766V0001 Site XTRILEC228PHLAPALO XTRILEC 228 PHLAPALO Leg 1 Seg P125018_NNI_QBKW5ZP Site XTRILEC228DWTWPADT XTRILEC 228 DWTWPADT virtualswitchVirtualSeries SLOT 1 PORT 4 TAGTYPE vlan TAG 49 STACKINGMODE stacked STACKEDTAGNUM 31 Leg 1 Seg P125018_NNI_QBKW5ZP Site XTRILEC228DWTWPADT XTRILEC 228 DWTWPADT Leg 1 Seg P125018_NNI_QBKW5ZP Site C0LUMB P125018 OvertureOVERTURE_ISG SLOT 0 PORT 4 TAGTYPE vlan TAG 49 STACKINGMODE none Leg 0 Seg EDBK49MH0001 Site C0LUMB P125018 OvertureOVERTURE_ISG SLOT 0 PORT 1 TAGTYPE transparent TAG 0 STACKINGMODE none Leg 0 Seg EDBK49MH0001 Leg 1 Seg P125018_NNI_QBKW5ZP Leg 2 Seg EDBK766V0001 Leg 3 Seg S3R.VPLS92966 Thank you in advance! ... View more