I have a query like this   sourcetype=tseltdw tags{}= "request" | fillnull data.service,data.service1, api_revamp,data.status, tags{}, keyword, keyword_api,data.timeTaken | eval keyword_api=if(keyword LIKE "user/628%" OR keyword LIKE "user/08%" ,"user/msisdn",keyword) | eval data.service1= if(len('data.service')>200, "null",'data.service') | eval datex=strftime(_time,"%Y-%m-%d") | eval datetime=strftime(_time,"%Y-%m-%d %H:00:00") | eval hourx=strftime(_time,"%H") | eval data.uri3= if(len('data.uri2')>100, "null",'data.uri2') | stats count as trx by datex, hourx, datetime, data.service1, data.status, tags{}, data._id, keyword_api,api_revamp, data.timeTaken | sort data.timeTaken asc and return like this.  Can anyone help me how to return one value only with p90 percentile by data.timeTaken? Much appreciated for any help, thank you. ... View more

Just a quick question. I have no experience on Splunk, but my company just use it to collect data. My Splunk Query search :   sourcetype=st_file| fillnull clientTransactionID msisdn ocsID orderID applicationID productType providerName reponseCode responsedetail reponseMessage actiontype bNumber gatewayTransactionID | stats count as trx by _time clientTransactionID msisdn ocsID orderID applicationID productType providerName reponseCode responsedetail reponseMessage actiontype bNumber gatewayTransactionID     Then the result will be export to csv file like this :   "_time",clientTransactionID,msisdn,ocsID,orderID,applicationID,productType,providerName,reponseCode,responsedetail,reponseMessage,actiontype,bNumber,gatewayTransactionID,trx "2020-10-17T17:20:00.000+0700",023029300002187960,6281220636564,TC01,0,RBT0000,SP,RBT,2,"0|1630429199000|65","CHARGING_SUCCEEDED",F,000,"RBT0000:023029300002187960",1    Can anyone suggest me how to change delimiter from '"," to "|" on my search query?  I already read that we can change it from conf. files but since  I can't get access to those files, so i have no clue here.    Thank you ... View more