Hello Experts,   I was wondering if you can help me figure out how do I show the merged values in a field as 'unmerged' when use 'values' in stats command   (DETAILS_SVC_ERROR) and (FARE/PRCNG/AVL-MULT. RSNS) are different values .... coming as merged as an example, its merging all values in one when used "Values" OR "List" how to unmerge same If I use 'mvexpand' it then expands to single count even if the values are same   Thanks in advance Nishant ... View more

Hello Experts,   This is a long searches, explored query that I am getting a way around. If we do a simple query like this     index=zzzzzz | stats count as Total, count(eval(txnStatus="FAILED")) as "Failed_Count", count(eval(txnStatus="SUCCEEDED")) as "Passed_Count" by country, type, ProductCode | fields country, ProductCode, type, Failed_Count, Passed_Count, Total     This above simple query gives me a result table where the total belongs to the specific country and productCode i.e. individual Total Now there is this field 'errorinfo' -  what I want is that I want to show the 'errorinfo' if its "codeerror"  as well in the above list like this   index=zzzzzz | stats count as Total, count(eval(txnStatus="FAILED")) as "Failed_Count", count(eval(txnStatus="SUCCEEDED")) as "Passed_Count" by country, type, ProductCode, errorinfo | fields country, ProductCode, type, Failed_Count, Passed_Count, errorinfo, Total   This table shows results like this below country ProductCode type Failed_Count Passed_Count errorinfo Total usa 111 1c 4 0 wrong code value 4 usa 111 1c 6 0 wrong field selected 6 usa 111 1c 0 60 NA 70   How can I do so that I can see the results like this where Total remains the complete total  of field txnStatus (FAILED+SUCCEEDED) like below table - If I can achieve this I can do % total as well, if you see the Total belongs to one country - usa total shows usa total and canada total shows can total   country ProductCode type Failed_Count errorinfo Total usa 111 1c 4 wrong code value 70 usa 111 1c 6 wrong field selected 70 can 222 1b 2 wrong entry 50 can 222 1b 6 code not found 50 country ProductCode type Failed_Count errorinfo Total usa 111 1c 4 wrong code value 70 usa 111 1c 6 wrong field selected 70     Thanks in advance Nishant ... View more

Hi Team, I was comparing the Summary Index transaction time with the live Splunk server transaction time. I see all transactions collected in 15min bucket keep the same time and override the actual transaction time. Is there a way to retain the original time while still keeping the count going in buckets define?   Nishant ... View more

Hi Team, I have a field that has the data in this format below : [ { data data data }],[ {data data data}] As you see the data in the Bar and Curly bracket sets are more than one separated by comma however when I used 'stats count by field' or table field only first set of brackets return, anything after comma is dropped. With rex I am able to extract the entire string data extracting to new field but I dont want to use Rex on Raw - our company doesnt promote and support it and warn us to not to use it. I tried delim=, with makemv, mvcombine etc but it only shows data in first set of bar brackets, rex on field also doesnt show data beyond first set of bar brackets. Is there a way to get the entire string by not using rex on Raw but using field itself.   Thanks in advance Nishant ... View more