I have the following Dataset: { "createFormInstanceRequest": { "formId": "xxxxxxxxxxxxxxxxxxxxxxx", "requestOptions": { "requestAction": "SUBMIT" }, "responseOptions": { "returnFormDefinition": false, "returnFormInfo": false, "returnFormData": true }, "formData": { "groups": [{ "groupId": "studentDetails", "iterations": [ [{ "fieldId": "studentName", "value": ["timothy jones"] }, { "fieldId": "studentid", "value": ["sxxxxxx"] }, { "fieldId": "address", "value": ["12/12 some street"] }, { "fieldId": "attendingevent", "value": ["No"] }] ] }, { "groupId": "grades", "iterations": [ [{ "fieldId": "math", "value": ["C"] }, { "fieldId": "PE", "value": ["D"] }, { "fieldId": "english", "value": ["A"] }, { "fieldId": "science", "value": ["B"] }] ] }] } } } I am struggling to parse the field names and values as everything is placed in either: createFormInstanceRequest.formData.groups{}.iterations{}{}.fieldId and createFormInstanceRequest.formData.groups{}.iterations{}{}.value{} . They both become multivalue fields. I couldn't get SPATH to work with this data and changing the log format is not an option either. How can I create fields based on the fieldIDS and assign them the corresponding values in search time? ... View more

Hi all, I would just like to mention that I'm horrible with CSS and unfortunately am tackling a problem that is way outside my comfort zone. I would like to freeze the first few columns (first 3 or 4 columns) so that when a user is scrolling right on the table, these columns remain visible on the screen. Basically, I'm trying to replicate the pane freeze feature in excel but am experiencing alot of difficulty achieving this. Currently, I have a table: <row> <panel> <table id="table1"> <search base="base"> <query>| table region location dept * total</query> </search> </table> </panel> </row> I have some basic CSS (which isn't working): #table1.table-wrapper{ overflow-x:scroll; overflow-y:visible; width:250px; margin-left:120px; } #table1.td{ padding:5px 20px; width:100px; } #table1.th{ padding:5px 20px; width: 100px; } #table1.th:first-child{ position:fixed; left:5px; } ... View more

A single event has two dates. How do I count the number of days excluding weekends and holidays between these two dates? For instance, an event will have two date fields such as startdate and end_date. I need to count the number of days from the start_date to the end_date while skipping over weekends and holidays. All the holidays that I am concerned with are in a lookup file. I was thinking of using an array to store all the dates from the start_date to the end_date, loop through array, check if weekend, if not a weekend, increment a counter. This counter will be the number of days. But, unfortunately, I don't know how to use arrays in Splunk and am not sure how to calculate what the dates are to add to an array which fall between the start and end_date field. Also, is there a better way of performing this task besides using an array of dates? ... View more