Hi all, I am confident with strptime/strftime but i'm really struggling with the correct strptime argument for the following date/time format - 2023-01-25T21:32:04:501+0000 The T between date and time is causing me issues. Thank you in advance! ... View more

Hello, I am using rex to remove everything after a specific character, but i need to keep the specific character. Currently, I am using this - | rex mode=sed field=Cluster "s/[k].*//g" Unfortunately it is also removing the 'k'. Can I amend this argument slightly so it removes everything after k but the k remains? Unfortunately I don't have any / to work with. Thanks! ... View more

Hello, I have calculated my Total Escalations per Quarter using stats count and I would like to include another field to calculate the percentage increase/decrease of Total Escalations per Quarter. My query - | inputlookup Case_Database_v2.csv | rename "Case Number" AS Case_Number | search Role=Support Squad=*CMS* | lookup EAS_Escalations_v1.csv "Case Number" AS Case_Number OUTPUTNEW "Case Number" | rename "Case Number" AS EAS_Case_Number | eventstats dc(Case_Number) as CaseCount by Quarter | stats count(EAS_Case_Number) as Total_Escalations by Quarter, CaseCount | eval EAS_Escalation(Percentage)=round(Distinct_Escalations/CaseCount*100,2)   And this shows -         Quarter CaseCount Total Escalations Qtr 1 799 315 Qtr 2 889 368 Qtr 3 798 287 Qtr 4 777 220   I would like to calculate the percentage reduction per quarter, for example,  Qtr 4 Total Escalations of 220 is a 13.5% reduction on the 287 escalations from Qtr 3. Any help is much appreciated! ... View more