My events are in the below format in splunk: [Wed Feb 15 16:41:07 2017]Local/ESSBASE0///139702560335616/Error(1040065) Protocol mismatch may occur if a client other than an Essbase Client tries to access Essbase or if the packet is corrupted. How shall i parse this log so that i can extract the error code as 1040065 and or if i want to extract other values. ... View more

In my search query, I have 2 searches 1. This gives stats for today 2. This gives stats for the period entered as parameters to the panel (which is a) Last week same day/time b) Last month same day time c) Yesterday same day/time The issue i am facing is if we have no events for 1 and 2, I need to show 0 as stats for both the mentioned criteria's along with dates e.g. Date Requests 12/31/2016 0 12/30/2016 0 same as 12/31/2016 --> 0 12/24/2016 ---> 0 I need the above so that i can put a single value field with trend charts [| gentimes start=-1 | eval earliest=if(lower(strftime(now(),"%A"))="monday", "-3d@d", "-1d@d") | eval latest=if(lower(strftime(now(),"%A"))="monday","-3d@s", "-1d@s") | table earliest, latest | format "" "" "" "" "" ""] index=yy sourcetype=zz | search "xx" | spath output=OpName path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.operationName | spath output=EvType path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.eventTypeCode | spath output=state path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.state | spath output=Line_Count path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.recordCount | spath output=Org_Code path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.attribute1 | spath output=TimeZone path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.attribute2 | spath output=ccpath=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.attribute3 | eval combined=mvzip(mvzip(mvzip(mvzip(mvzip(mvzip(OpName,EvType),state),Line_Count),Org_Code),TimeZone),cc) | mvexpand combined|eval combined=split(combined,",") | eval OpName=mvindex(combined,0) | eval EvType=mvindex(combined,1) | eval state=mvindex(combined,2) | eval Line_Count=mvindex(combined,3) | eval Org_Code =mvindex(combined,4) | eval TimeZone =mvindex(combined,5) | eval cc=mvindex(combined,6) | where OpName="abc"|append [search earliest=@d index=yy sourcetype=zz | search "xx" | spath output=OpName path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.operationName | spath output=EvType path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.eventTypeCode | spath output=state path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.state | spath output=Line_Count path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.recordCount | spath output=Org_Code path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.attribute1 | spath output=TimeZone path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.attribute2 | spath output=CDC_RDC path=payload.gpmGenerateEventLogs.gpmGenerateEventLog{}.attribute3 | eval combined=mvzip(mvzip(mvzip(mvzip(mvzip(mvzip(OpName,EvType),state),Line_Count),Org_Code),TimeZone),CDC_RDC) | mvexpand combined | eval combined=split(combined,",") | eval OpName=mvindex(combined,0) | eval EvType=mvindex(combined,1) | eval state=mvindex(combined,2) | eval Line_Count=mvindex(combined,3) | eval Org_Code =mvindex(combined,4) | eval TimeZone =mvindex(combined,5) | eval cc=mvindex(combined,6) | where OpName="abc"] | bucket _time span=1d | stats sum(Line_Count) AS Requests by _time Any help on this pls ... View more