Please note that id!=1 and NOT id=1 are NOT equal. If you have the following events id=1 someotherfield=a someotherfield=a id=1 someotherfield=a id=2 someotherfield=b searching for someotherfield=a NOT id=1 leads to someotherfield=a id=2 someotherfield=b whereas searching for someotherfield=a id!=1 leads to id=2 someotherfield=b as id!=1 only returns events that contain field id, but not value 1, whereas NOT id=1 removes events with id=1 from the previous event set. ... View more

No problem. This adds a Column named "Total transactions" to your table and then calculates the percentage each "No of transactions (total)" is of that in the field "Percentage of total transactions" (simply append to exisiting search): | eventstats sum("No of transactions") as "Total transactions" | eval "Percentage of total transactions" = round('No of transactions (total)' / 'Total transactions' * 100, 0) If you don't want to keep the column "Total transactions", just append another | fields - "Total transactions" to your search. ... View more

Like this: | makeresults | eval raw="11111 Amount 12000::11111 Reference 101010::11111 Operator John::11111 Subject Credit::11111 Notes XXXXXXXX::11112 Amount 75000::11112 Reference 202020::11112 Operator Will" | makemv raw delim="::" | mvexpand raw | rename raw AS _raw | rename COMMENT AS "Everything above generates sample event data; everything below is your solution" | rex "^\d+\s+(?<key>\S+)\s+(?<value>\S+)" | eval {key}=value | fields - key value ... View more

Okay, so you have key-value pairs where these three together make the key - transaction_id status date type. This code will create fields named after the attributes, set their values, and then roll the data together into a single event | eval {attribute} = value | fields - attribute value | stats values(*) as * by transaction_id status date type | eval _time = strptime(date,"%m/%d/%y") You might want to consider putting the csv into a temporary index each month, then using collect after the above lines to write the combined transactions to the permanent index. ... View more

This analogous search work for me: index=_* earliest=-1d@d latest=now | eval Day=if(_time>=relative_time(now(),"@d"),"Today","Yesterday") | chart count over sourcetype by Day | where Today<(2*Yesterday) ... View more

This will work too, but as I told earlier, you're running two searches here so if the performance is not an issue for you, above will just do the task,. One problem that you may run with your query is that you're relying on the order of the product (appendcols merges column row by row), so if there is a missing product this week OR new product this week, the results will not be 100% correct. Whereas other query will take care of it. ... View more

Like this: | rex max_match=0 "(?ms)ab1:search-name>(?<search_name>[^<]+)" | rex max_match=0 "(?ms)ab1:search-response>(?<search_response>[^<]+)" | rex max_match=0 "(?ms)ab1:search-relevance>(?<search_relevance>[^<]+)" | eval raw = mvzip(search_name, search_response, "::") | eval raw = mvzip(raw, search_relevance, "::") | rex field=raw mode=sed "s/[\s\r\n:]*$//" | fields _time raw | mvexpand raw | rename raw AS _raw | eval len=len(_raw) | search len>0 | rex "^(?<search_name>.*)::(?<search_response>.*)::(?<search_relevance>.*)" ... View more

The main problem with transaction is that the work must be done on the search head which means you have 2 very important downsides. First, there is no map-reduce; the indexers, instead of sharing the processing load and reducing the size of the partial results instead are merely fileservers for the data. Second, even more important, nothing can be discarded along the way which means that as you build aggregate events out of the raw events, you have an incredible explosion of RAM consumption on the search head. Exhausting RAM is what causes transaction to give up and the worst part is that it does so with no direct indication of it (silently). The good news is that you can almost always use stats instead. Check out Nick Mealy's Virtual Conf session (March 2016) here: http://wiki.splunk.com/Virtual_.conf ... View more

My next concern is that I am having troubles with the LOOKUP command - it will not let me check multiple event_fields against the SINGLE lookup_field; When I try to do a second lookup as below, there is no new field output; ... | lookup sub_ref sub_code AS comp, sub_code AS comp_ID OUTPUT company as Company Do I need to run the lookup command once for each event field and then output all as the one output field (Company) ... View more

You are a gentleman and a scholar, thank you kindly! Answer accepted and upvoted. ... View more

Perfect, thank you kindly! Looks like there are too many irrelevant fields extracted if I use the xmlkv command, so I think I will have to use the rex command to extract the fields I require! ... View more

All were correct - turns out it was an issue with the lookup table data as summarised in the answer below 🙂 ... View more

For the replacement to work correctly, the value in product field has to match. You do have the option of setting up your lookup with wildcards, but the replacement will the same for all matching values. For example prod1, prod2, prod3 can have a single prod* in the lookup to map to "same description for any of the three variations". For this to work, you will have to configure your lookup as https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html ... View more

This is a slightly complicated one - however if you can provide some sample data then there may be a more suitable way to approach the logic here. ... View more

thank you so much, Nice Explanation. ... View more

It looks like as of at least Splunk Version 7.0.3.4 if you go into Lookups -> Lookup definitions and select the "Advanced options" checkbox there's now a Match type field. I just added "WILDCARD(fieldname)" there and it worked. ... View more