Hello respected members of the prestigious forum of Splunk I have been working with datetimes in splunk and it is making me insane... I am extracting the datetime of two separate events to later on subtract them, I have tried many ways to achieve this but I still dont have the results that I want... the format of datetime of the events look like this:  2020-07-28T09:42:33-06:00 I want to be able to have calculate difference in minutes between to events "join" by the field: error-code... Because of the way the system is configured the error "adult.mov" may appear twice or three times but I am only interested in the first time it appeared ... However, if this error has not appeared yet I want to record the current time instead... I am trying something like this:   | eval terrorXYU=if(match(_raw, "e_type_k"),datetime_c, null) | eval terroradult.mov=if(match(_raw, "mov"),datetime_c, null) | eval terroradult.mov= strptime(terroradult.mov,"%m/%d/%Y %H:%M:%S:%3N") | eval terrorXYU= strptime(terrorXYU,"%m/%d/%Y %H:%M:%S:%3N") | eval diff= terroradult.mov-terrorXYU   but I get nothing ins return I have tried a most of the codes in other posts but no luck at all.. thank you for helping me indeed ... View more

Hello guys  I am trying to create a timechart in my dashboard where I can show the percentage of people that enter my website and made a purchase  this calculation is equal to = amount_purchase/total_amount and my code looks like this:   | multisearch [| search index="A" | search IN_PEOPLE="gate_10"] [|search index="CATALOGUE" | search ACC="pur_ok"] | streamstats c(IN_PEOPLE) as IN, c(ACC) as OUT | eval rate=OUT/IN   now that rate was been calculated I want a timechart that can show me the value of rate for the last 10 days I was trying with the following code   | multisearch [| search index="A" | search IN_PEOPLE="gate_10"] [|search index="CATALOGUE" | search ACC="pur_ok"] | streamstats c(IN_PEOPLE) as IN, c(ACC) as OUT | eval rate=OUT/IN | timechart span=1d max(rate) as rate   BUT is not showing what I am looking for due to that it will give the max value of rate recorded but what I want is the overall rate of yesterday and the day before and so on.. to give you guys an example the rate for yesterday (abril 19 from 00:00 to 24:00) was 0.78 but my code is giving me 1 because I guess at some point it was a 1 the max value of rate thank you so much to anyone that can help me out, I trullly from the bottom of my heart appreaciate your help      ... View more

Hello everyone, I was wondering if any of you know how to change ONLY the color of the number that would be display in a single value radial panel using the new dashboard studio feature... Because when I see the available configuration it only allows me to change background color using thersholds... if anyone knows I will be very thankful!!! thank you so much ... View more