As per your question Run every 5 minutes at 3 pm every day which means it will start at 3 pm and the next day till 3pm..so it is same as running for every 5 minutes every day it does not make any sense. Either your question should be run every day at 3 pm every 5 minutes for a period of an hour or so..or run every 5 minutes every day 0/5 15 * * * does not make any sense to me. as this will run the report at 3 pm, give you a result and stop. In other words, it will run only once. So if you want your report to run every 5 minutes at 3 pm for entire day till midnight then your cron expression should be */5 15-23 * * * I hope you understand what I am trying to say. ... View more

ahh I see, thank you! Looks like that did it ... View more

Can you clarify what doesn't work or share more details about your search? My token example works fine for me. index= _internal earliest=-30d | fields _time | bucket _time span=1d | stats count as total by _time | streamstats avg(total) | sort -_time | eval day=strftime(_time,"%b %d, %y") | table day total avg(total) day| total | avg(total) Mar 05, 18|3349|85247.33333333333 Mar 03, 18|4107|101627 Feb 18, 18|66397|126007 Feb 17, 18|227887|145877 Feb 16, 18|171441|104872 Feb 15, 18|38303|38303 ... View more

In this above query i want to include prior week like last 14 days and instead of 7dayavg i want eventcount ... View more

Yes, this is the whole point of having inputs in a form. Download this app and copy from their examples: https://splunkbase.splunk.com/app/1603/ ... View more

HA!, yes, true. ... View more

Yup, an alert just a search that's fit into a special pigeonhole named "alert", so you have most features available to an alert that you have to any other search. ... View more

The bin or bucket command will create buckets/bins of the specified field based on specified option. E.g. above, the field _time will be aggregated into bins spanning 1 day, so _time values (actual values are in epoch, just representing in human-readable here for understanding) 2017-02-01 00:17 OR 2017-02-01 09:50 OR 2017-02-01 17:55 will be part of same bucket 2017-02-01 00:00 (start of the bin i.e. day). See this for more information: http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Bin ... View more

The field "info_max_time" is added to each row by the addinfo SPL command. It represents the epoch time value of the latest search time value for the query. So, this search segment allows you to differentiate the events that represent the last hour (where the _time is greater than or equal to or greater than info_max_time minus 3600 seconds, one hour) from those events later than the last hour, "Last Week". This command is why we have to add back the values from "Last Hour" later in the search (the appendpipe part). ... View more

awesome, thank you! ... View more

Hi @demkic - Did the answer provided by sundareshr help steer you in the right direction towards a working solution? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks! ... View more

Thank you very much for the explanation. I think for the purpose of this analysis it's actually best that I display the results in a table only. However, when I take the command | chart count over errorType by myTime our of the query, I get empty results. With this command, even if I save the report as a statistics table only, it still displays the chart as well. ... View more

Actually, I do have one more question regarding this. I would like to actually remove one row in my results but do it in such a way that it does not affect my calculation. Here is an example: errorType, CompletedTransactions, columntotal, and percent_failure are field1, field2, field3, and field4, respectfully. field1 field2 field3 field4 approved 120 185 0.65 insufficient funds 50 185 0.27 expired card 10 185 0.05 contact issuer 5 185 0.03 In this case, I would like to removed the entire row where field1=approved but I do not want this to affect the calculations. Reason being is that "approved" is not a failure type and I am only interested in observing the proportion of error types given the total number of transactions processed that result in a failure. Many thanks! ... View more

Well, you're querying about 31 days worth of data and it's bound to be slower. See this this work better:- sourcetype=.... earliest=-30d@d | top 10 product_name showperc=f | streamstats count as MonthRank | append [ search sourcetype=... earliest=-4h@h | top 10 product_name showperc=f | streamstats count as HourRank ] | stats first(MonthRank) as MonthRank first(HourRank) as HourRank values(monthproduct) as monthproduct values(hourproduct) as hourproduct by product_name | eval diff=MonthRank-HourRank | sort HourRank | table product_name, HourRank, MonthRank, diff, monthproduct , hourproduct OR sourcetype=.... earliest=-30d@d latest=now | eval Type=if(_time>relative_time(now(),"-4h@h") ,"Hour", "Month") | top 10 product_name by Type showperc=f | streamstats count as rank by Type | chart values(count) as count values(rank) as rank over product_name by Type | rename "count: Hour" as hourproduct "count: Month" as monthproduct "rank: Hour" as HourRank "rank: Month" as MonthRank | eval diff=MonthRank-HourRank | sort HourRank | table product_name, HourRank, MonthRank, diff, monthproduct , hourproduct ... View more

I did fields to ensure that out of sum and store_name fields we only get store_name field values and not the sum values. In general table <fieldA> and fields <fieldA> would work the same way. ... View more

Yes, you can include token values in the url. Just make sure to wrap it in "$" symbols. It would look something like this: <a target="_blank" href="my_dashboard?form.dropdown=$mytoken$">My Dashboard</a> ... View more

It's ok, I figured it out with the round(x,y) command. ... View more