Hello everyone,   I have been bumping my head trying to subtract a list of values from a single value after I use the stats command.   I have something like this:   | stats values(TIME_ALERT) as "TIME ALERT" values(TIME_FRAUD) as "TIME FRAUD" by ID   TIME ALERT TIME FRAUD ID 1647854522 1647854525 1647854529 1658452541 UYU_UIS007   But what I want is something like this: TIME ALERT DIFF TIME FRAUD ID 1647854522 1647854525 1647854529 -10598019 -10598016 -10598012 1658452541 UYU_UIS007 which is doing DIFF= TIME ALERT - TIME FRAUD, knowing that TIME FRAUD will always be a single value... thank you so much guys for your help ... View more

Hello respected members of the prestigious forum of Splunk I have been working with datetimes in splunk and it is making me insane... I am extracting the datetime of two separate events to later on subtract them, I have tried many ways to achieve this but I still dont have the results that I want... the format of datetime of the events look like this:  2020-07-28T09:42:33-06:00 I want to be able to have calculate difference in minutes between to events "join" by the field: error-code... Because of the way the system is configured the error "adult.mov" may appear twice or three times but I am only interested in the first time it appeared ... However, if this error has not appeared yet I want to record the current time instead... I am trying something like this:   | eval terrorXYU=if(match(_raw, "e_type_k"),datetime_c, null) | eval terroradult.mov=if(match(_raw, "mov"),datetime_c, null) | eval terroradult.mov= strptime(terroradult.mov,"%m/%d/%Y %H:%M:%S:%3N") | eval terrorXYU= strptime(terrorXYU,"%m/%d/%Y %H:%M:%S:%3N") | eval diff= terroradult.mov-terrorXYU   but I get nothing ins return I have tried a most of the codes in other posts but no luck at all.. thank you for helping me indeed ... View more

Hello Friends, I was wondering if there was a way in the New Dashboard Studio d visualize charts and single values only after the queries of data is fully calculated or loaded... I know that in the classic version or the "old" dashboard we could choose to see a progress bar so that we know when the values were fully calculated... is there something similar ion the new version? Thank you so much I have read a lot of documentation without any luck... Thanks for the help! have great week  ... View more

Hello Everyone I hope you are having a great day, This new dashboaard studio feature is GREAT 10/10 but I'm having a little of trouble when I  want a visualization to be linked to another dashboard and also show the data within the same time period as the main dashboard,   What I did before was to set the earlist and latest time token to the one on the main dashboard...but in the new dashboard studio I cant seem to find that feature I rather have something called:      Currently using Global Time Range input $global_time.earliest$ - $global_time.latest$   so I already tried parshing this info in he URL of the desired link dashboard without any luck... I dont know if some of you know the way to have the new linked dashboard to show values in the same time period of the main dashboard using the new feature dashboard studio! THANK YOU SO MUCH ... View more

Hello Everyone I hope everyone is doing well...   It turns out I have to find how many times a custumer that has made a purchase has contacted the corporate line to complain...  I can generate a table that shows me the custumers that have made an actual purchase by ID , and also I can make a table of the custumer that have called on the line to make a complain.. first table would look like this: ID PRODUCT_BOUGHT 41545 x_98 1428 x_98 4856 x_91 8596 x_91 1254 x_96   and the second table would look like this.. ID CASE_NUMBER 41545 001 4856 002 4856 003 41545 004 1254 005 1254 006   The issue is that I need to count how many times each ID has called on the line and bring also the product bought and the case number recieved on the line... BUT I can only think of a multiseach in order to create the table but I cant seem to find any documentation on how to do the cross validation or even count and I feel like Im hitting my head against a wall... This is the multisearch that I am using: | multisearch [| search index="pur.ok" | search status="PAY.ok" | fields ID PRODUCT_BOUGHT] [|search index="corp_line" | search in_calls="corp_cx_cases") | fields ID CASE_NUMBER]   but since I am a python user trying to learn splunk I cant seem to find a way to obtain this table: desired results: ID CALLS_ON_THE_LINE PRODUCT_AND_CASES 41545 2 x_98-001-004 4856 2  x_91-002-003 1254 2 x_96-005-006 1428 0 x_98 8596 0 x_91   THank you a million to everyone that can help me out with a guidance or documentation on how to achieve this like form the bottom of my hart thank you so much!!!!!! Im sending you a big hug from Texas! ... View more