Is this possible to transform a data set from :   Time User Number of Errors 9 pm Josh 2 9 pm Andy 1 10 pm Josh 0 10 pm Andy 1 11 pm Josh 1 11 pm Andy 3 to :   Time User Number of Errors 9 pm Josh 2 9 pm Andy 1 9 pm Total Number of Errors 3 10 pm Josh 0 10 pm Andy 1 10 pm Total Number of Errors 1 11 pm Josh 1 11 pm Andy 3 11 pm Total Number of Errors 4 ?  I've tried to use  :    <insert index here> | convert num("Number of Errors") as NumberofErrors |eval Total_Number_of_Errors= Josh + Andy |table Time User Number of Errors   However  its erroring out when i try to run this query .   ... View more

Hello Splunk community, When trying to splice multiple events so that it can generate a specific output from a Splunk index, I’ve been running into the “Regex: syntax error in subpattern name (missing terminator)” error often. ========================================================================= For example, there are events that are being shown in a Splunk index: (each line is a different Splunk event)   “This is one way to do everything” “Regular Expressions in Splunk” “test: 123fourfive” “and escape characters” “test: !A-Z” “are an interesting exercise in” “test: ~Lettersand Numbers” “finding out how Regex works” “test: What is the? AndWhen to use it!” “in Splunk.” “test:   This is the Splunk query :   *randomsplunkindex*|rex field=_raw “(?<OUTPUT>(?<=” “).*(?=” “test:))”   I’m trying to get the output between two the quotes. So that the output would be:   Regular Expressions in Splunk and escape characters are an interesting exercise in finding out how Regex works in splunk.   However I’ve run into this error “Regex: syntax error in subpattern name (missing terminator)” I’ve tried these combinations of exit characters so that I won’t get the “Regex: syntax error in subpattern name (missing terminator)” error:   *randomsplunkindex*|rex field=_raw "(?<OUTPUT>(?<=\" \").*(?=\" \"test:))" *randomsplunkindex*|rex field=_raw "(?<OUTPUT>(?<=\" ").*(?=" \"test:))" *randomsplunkindex*|rex field=_raw "(?<OUTPUT>(?<=\" \").*(?=" "test:))" *randomsplunkindex*|rex field=_raw "(?<OUTPUT>(?<=" ").*(?=\" \"test:))" *randomsplunkindex*|rex field=_raw "(?<OUTPUT>\(?<=" ").*(?=" "test:)\)"   Is there any way to use regular expressions so that if there are characters like “or ‘ in said event so that you’re trying to extract the output using rex? ... View more

Seems to be an odd issue when using tokens to search an entire csv file. I don't know if this is built into splunk on purpose but......   Example:  stuff.csv file contains :  Equipment Location_within_building Street Price CI_Number TV stand first floor 1404 Bay street $29.99 121 Wireless headset second floor 1404 Bay street $39.99 223 Laptop second floor 29th Bay Pl $999.99 3334 Wireless Microphone first floor 404 Bay Street $9.99 5552   And the user has an input text box  where they can search the entire CSV file. with a token of :  *$Item$* The issue is that IF a user  put into the text box  1404 Bay street . They won't get any results back. However if  a user puts in 1404 , they will get results back...... is there  anyway to modify the search query (within a statistics table ) of  : " |inputlookup stuff.csv| search Equipment=*$Item$* OR Location_within_building = *$Item$* OR  Street = *$Item$*  OR Price = *$Item$* OR CI_Number = *$Item$*    so that if  a user puts in 1404     or    1404 Bay    or  1404 Bay street    they would get a return of :  Equipment Location_within_building Street Price CI_Number TV stand first floor 1404 Bay street $29.99 121 Wireless headset second floor 1404 Bay street $39.99 223   instead of getting nothing as a return value when searching the entire csv file?  ... View more

example file : Stocks.csv  Stock ticker Stock price IBM 120 NFLX 240 APPL 999   And in the dashboard it will show:  Number of stocks selected by input 3 User has a text input where they can put a search term that will search both columns at once. ( The token for the search query is $Stocks$) If the user puts in say "L"  This is what will return :  Stock ticker Stock price NFLX 240 APPL 999       And in the dashboard it will show:  Number of stocks selected by input 2 I've tried this query :  |inputlookup Stocks.csv |stats count as Total    ( which only gets the total number of stocks back in the csv file.... NOT the actual number of stocks selected by the user from their text input......)   However is there any way possible to get the " Number of stocks selected by input" correctly ?  ... View more

I have a dashboard that's similar to this, however i'm running into a problem... Is it possible to use a single token (Text token) to search multiple fields at once ?   For example from the csv file   Stockticker StockDescription Stock Price CompanyName JMS Food 1 JM Smucker Co CO Food  2 Carpy Oscar CSS Consumer goods 2.40 Consumer Staples Select Sector SPDR ETF (XLP) FINC Goods 5.12 Food. Inc   user puts in : "Co"  in the token field  and their return fields are :  JMS Food 1 JM Smucker Co CO Food  2 Carpy Oscar CSS Consumer goods 2.40 Consumer Staples Select Sector SPDR ETF (XLP)           Is there a way to search Multiple fields with one single token and match that  token's value to those multiple fields  to return their respective rows ? <form> <label>Stocks dashboard</label> <description>Stocks dashboard</description> <fieldset submitButton="true" autoRun="false"> <input type="text" token="Stocks"> <label>Put Stock ID here</label> <initialValue>*StockTicker*</initialValue> </input> </fieldset> <row> <panel> <title>Stocks</title> <table> <title>Stocks</title> <search> <query>| inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName|Search Stockticker=$Stocks$ |Search StockDescription=$Stocks$|Search CompanyName=$Stocks$ </query> <earliest>-24h@h</earliest> <latest>now</latest> <refresh>10m</refresh> <refreshType>delay</refreshType> </search> <option name="count">100</option> <option name="drilldown">cell</option> <option name="refresh.display">preview</option> <option name="rowNumbers">true</option> </table> </panel> </row> </form>    The query :  | inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName|Search Stockticker=$Stocks$ |Search StockDescription=$Stocks$|Search CompanyName=$Stocks$     Issue is that the token only searches for the first field that is given  which is  : Stockticker=$Stocks$ .... so if a user puts Co into the input.....they only get this for the return :  Stockticker StockDescription Stock Price CompanyName CO Food  2 Carpy Oscar   What the user should be getting when using the dashboard to search:  JMS Food 1 JM Smucker Co CO Food  2 Carpy Oscar CSS Consumer goods 2.40 Consumer Staples Select Sector SPDR ETF (XLP)           Is there a way to do that through a csv file for a splunk query?  ... View more