Hi I used where and replace command. but it takes more time to run the query. Is there any other way I can make this query still efficient: index=sec_proxy_web user_work_country="in" user_bunit="rbei/bsd1" sourcetype="bluecoat:proxysg:access:syslog" |where category!="Content Delivery Networks" | where category!="Chat (IM)/SMS" |where category!="Web Ads/Analytics" | where NOT url like("%edge-chat%") |where NOT url like("%mtalk.google.com%") |where NOT url like("%accounts.google%") |where NOT url like("%doubleclick%") |where NOT url like("%googlevideo.com%") |where NOT url like("%clients%") |where NOT url like("%googlesyndication%") |where NOT url like("%adservice%") |where NOT url like("%gstatic%") |where NOT url like("%api%") |where NOT url like("%gravatar%") |where NOT url like("%youboranqs01%") |replace tcp://* WITH * IN url |replace http://* WITH * IN url |replace https://* WITH * IN url | stats count by url | sort -count ... View more

EG 1 and 3 works fine But eg2 i get error : Error in 'rex' command: Encountered the following error while compiling the regex '([chpt]://)(?.*)': Regex: unrecognized character after (? or (?-. I wanted to write a rex where it can ignore http https and tcp the above expression looks correct but i dont know why splunk throws above error. Couldnt understand this "rex to extract then drop old field and rename new (can't just extract and overwrite):" ... View more

This works but i cannot use it for realtime and for a particular user in drilldown later. ... View more

Hi I just was cross verifying the 2 search's found that the results are not same its different for a same time duration. Do you have any insight on why is there a mismatch since both of them run the same query but in different manner? 1: Query output weekend_or_not avg_count weekend 13399.5 work day 40337.2 2:query weekend_or_not avg_count weekend 6130.5 workday 6662 ... View more

Thanks alot it worked. But I could not understand the working of 2nd search query | gentimes start=-7 | eval random_user_count = random()%5000 + 4000 | eval date_wday = strftime(starttime, "%A") | eval _time = starttime How you selected the random function and the number 5000/4000? So if there is an explanation it would be great for my Understanding Thank YOU. ... View more

Thanks it worked.. But I could not understand the 2nd search query how you got the random function and how you decided the number 5000 and 4000 if any explanation would be there it would be great:) | gentimes start=-7 | eval random_user_count = random()%5000 + 4000 | eval date_wday = strftime(starttime, "%A") | eval _time = starttime ... View more