Another incredible answer!  These helped me a lot! ... View more

@woodcock wrote: Like this: ... | reverse | streamstats current=f last(Magnitude) as prevMagnitude ... Now that each event contains the magnitude of the previous event you no longer need any correlation between events so you can tack whatever you like onto the end: ... | search magnitude > 3.3 Incredible answer!  So concise and powerful! ... View more

Super helpful checklist, thanks!  Also will include a link to this answer as base queries with non-transforming results have boundary limits. I think if you're getting inconsistent results its because you're over a limit. https://community.splunk.com/t5/Splunk-Search/Post-processing-gives-incorrect-results/m-p/522520   ... View more

EDIT (just realized someone answered this too) So consider this my thumbs up to that. Though the embedded example others provided works. It should be used sparingly. The TL/DR use a look AS a lookup. That scales even at large lookup sizes. | mysearch | lookup mylookup host OUTPUTNEW host as to_filterr | where isnull(to_filter) gives you results where it is not in the table. this has added option of using the lookup match types such as wildcard, CIDR etc etc. Calling a csv file directly in a subsearch does not. It is best to use the repeatable pattern. ... View more

Thanks for this answer!  It was helpful to realize that using the same output name is overwriting. I did the following as well to collapse the output fields back into one field. search | lookup mylookup.csv A OUTPUTNEW B | lookup mylookup.csv C OUTPUTNEW D | lookup mylookup.csv E OUTPUTNEW F | lookup mylookup.csv G OUTPUTNEW H | eval allInOneAgain = coalesce(B, D , F ,H) | fields - B D F H   ... View more

Below one works for me.  | gentimes start=1 end=5 | eval [| makeresults | eval foo="test" | return foo] ... View more

Ditto!  Awesome info. ... View more

This is awesome, thank you! ... View more

Thank you, you gave me a great brainstorm! Using your advice I set out to create some new fields and to manipulate them.  It made me notice that for Query1 I was inadvertently fetching multiple occurrences of events matching myEvent1.common_uid_field value rather than one representative event that is sufficient. I needed to constrain Query1 further. By limiting Query1 to return only one event per common_uid_field I could now use one query for both event1 or event2 and count by common_uid_field. And only when count=2 does it mean the value is in both events. My query is now of the form: index=myindex (event1) OR (event2) | stats values(field_in_event1) AS ImportantField count by common_uid_field | where count=2 | stats count BY ImportantField ... View more

Outrageous trick!  Very helpful, thank you!  😀 ... View more

I needed the double quotes too which I learned from your post. Thanks! ... View more

Thanks for this info! 😀  I'm using outputlookup. ... View more

How interesting!  I will try it! ... View more

Super helpful! Works great! ... View more

Worked for me too! ... View more

Such a useful list, thank you! ... View more

Thank you for that query. I see that it ran today but still when I click on the name I get the same "There are no results because the first scheduled run of the report has not completed." Here is the timestamp of the last time it ran, just after midnight today: 2020-04-14 00:01:22.259 ... View more

Glad that works. You can also use a where command to trim out a line: index=myindex host=host1 OR host=host2 event=“event1” OR event=“event2” earliest=-21d latest=now | eval date=strftime(_time, "%Y-%m-%d") | where tonumber(strftime(_time, "%H"))<=3 | eval rounded_mean = round(‘my data’, 2) | chart perc50(rounded_mean) over name by date limit=0 ... View more