Do you mean something like this? | bin _time span=1w | stats count as attendance by _time employee | stats count as frequency by _time attendance ... View more

Actually you were correct. Not having the quotation marks was what was giving me issues.  ... View more

I do use a base search to get all data in one go. The you have all variable search.   |inputlookup all_users.csv | search Function"$Functions$" +++   Then I use that base search in all Input/Dashboard/Table etc. So if one input is changed. all other follows   Look at this Dashboard (that we use to get all server logs in one view)   <form version="1.5" theme="dark"> <label>List of server log message</label> <search id="base_search"> <query> index=_internal sourcetype=splunkd source="*splunkd.log" NOT source="*splunk*forwarder*splunkd.log" | rex "(?&lt;severity&gt;(?:INFO|WARN|ERROR))\s+(?&lt;module&gt;\S+)\s\[(?&lt;id&gt;\S+)\s(?&lt;sub&gt;[^\]]+)\]\s-(?:\s+(?&lt;message&gt;(?&lt;message_header&gt;\S+).*))?" | rex field=sub "(?&lt;sub&gt;HttpClientPollingThread)_(?&lt;Server&gt;.*)" | rex "(?&lt;ip&gt;\d+\.\d+\.\d+\.\d+)" | fillnull value="" Server ip | search host="$Host$" severity="$Severity$" module="$Module$" sub="$Sub$" $Free$ message_header="$MessageHeader$" | rename host as server | sort 0 - _time | table _time server severity module id sub Server message_header message ip </query> </search> <fieldset submitButton="false"> <input type="time"> <label></label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="Host"> <label>Server</label> <search base="base_search"> <query> | eval data=server | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Severity"> <label>Severity</label> <search base="base_search"> <query> | eval data=severity | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Module"> <label>Module</label> <search base="base_search"> <query> | eval data=module | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Sub"> <label>Sub</label> <search base="base_search"> <query> | eval data=sub | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="MessageHeader"> <label>Message Header</label> <search base="base_search"> <query> | eval data=message_header | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="text" token="Free"> <label>Free Text</label> <default>*</default> </input> </fieldset> <row> <panel> <title>Server</title> <chart> <search base="base_search"> <query> | timechart count by server limit=10 </query> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> </chart> </panel> <panel> <title>Severity</title> <chart> <search base="base_search"> <query> | timechart count by severity limit=10 </query> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> </chart> </panel> <panel> <title>Module</title> <chart> <search base="base_search"> <query> | timechart count by module limit=10 </query> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> </chart> </panel> <panel> <title>Sub</title> <chart> <search base="base_search"> <query> | timechart count by sub limit=10 </query> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> </chart> </panel> </row> <row> <panel> <table> <search base="base_search"> <query> </query> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="server"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="severity"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="module"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="message_header"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="sub"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="Server"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> </table> </panel> </row> </form> ... View more

Try this: index=<provide_index_name> EVDESCR="alarm" | append [ | inputlookup genericlookupname.csv | eval index="mycsvdata" ] | eval Date=coalesce(Date, strftime(_time, "%m/%d/%Y")) | fields index, Date | stats count(eval(index="<provide_index_name>")) as alarms, count(eval(index="mycsvdata")) as acknowledgements by Date   If this reply helps you, a like would be appreciated. ... View more

Hey @yuanliu basically what it was doing was getting the average of all the days by 220 rather than average of each day. However the search string you just provided seems to be the perfect solution for this. ... View more

That format is fairly straightforward to parse with rex as long as the field order is constant. | rex "duration\\\":(?<duration>\d+),\\\"type\\\":\\\"(?<type>[^\\\"]+)\\\",\\\"direction\\\":\\\"(?<direction>[^\\\"]+)\\\",\\\"action\\\":\\\"(?<action>[^\\\"]+)\\\",\\\"result\\\":\\\"(?<result>[^\\\"]+)" The "extra" backslashes are there to escape the embedded quotation marks. ... View more

Hi when you want to calculate avg, you must apply this to a numerical field not as string like you have here.  Here is example how to do it with stats eval combination https://docs.splunk.com/Documentation/Splunk/latest/Search/Usestatswithevalexpressionsandfunctions You could found easily several other examples how todo it. r. Ismo ... View more

Apologies for the late reply @bowesmana and @inventsekar . To answer your questions yes I can isolate the cost center when using the inputlookup command and it was indeed the timechart that was the culprit. I've figured it out using both your help so thank you very much! In case anyone else stumbles upon this question this is the search I used. index="my index" EVDESCR="specific event" READERDESC="criteria" | lookup user_lookup.csv user_employee_number as EMPLOYEE_ID |search user_esc_cost_center="specific cost center" |timechart span=1d dc(CARDNUM) AS EVDESCR ... View more

I got it to work thank you so much for your help! ... View more