Hi @vnravikumar,   Can you help me to understand where should i save this src=<path>? <img src="/static/app/search/img.png"   ... View more

Can you help me with the steps to install add-on? We have distributed environement, where we need to install on SH or HF's?   ... View more

Hi all,   Can someone help me how to integrate Service-Now with Splunk? what type of integrations we have and what steps we need to take to implement those. ... View more

Hi, Do you have any resolution for this? Please post if you have any sample query. ... View more

Hi @manjunathmeti , For single transaction_id above commands are working as expected But when I give transaction_id=*, I am getting wrong difference.. Any suggestions how to fix it?  ... View more

Hi @manjunathmeti , Thanks for your time.  I combined both commands and it worked when i try for one transaction id's: index=abc sourcetype=def transaction_id=123456789 | stats count by _time, direction, pacs, transaction_id | streamstats range(_time) as TotalDiff | streamstats window=2 range(_time) as SingleDiff | streamstats count by transaction_id | where count IN(3, 4) | eval diff_2_3=if(count=3, SingleDiff, ""), diff_4_1=if(count=4, TotalDiff, "") | fields - count SingleDiff, TotalDiff | stats latest(_time) as _time max(*) as * by transaction_id   For single transaction_id above command is working as expected But when I give transaction_id=*, I am getting wrong difference.. Any suggestions how to fix it?  ... View more

Thanks for your help @bowesmana. I want only TotalDiff in the 4th entry and SingleDiff in the 3rd entry in the table. I don't want anyother values.   For example, I have output as below: _time                                                   direction           transaction_id     count        SingleDiff       TotalDiff 2021-08-04 06:18:19.178               in                     123456789             1             0.000000      0.000000 2021-08-04 06:18:19.230             out                    123456789             1             0.052000      0.052000 2021-08-04 06:18:34.525             out                    123456789             1            15.295000    15.347000 2021-08-04 06:18:34.546             out                    123456789             1            0.021000       15.368000 2021-08-04 06:18:48.005              in                       123456789            1           13.459000       28.827000 Instead of above output I want output as below: transaction_id      SingleDiff       TotalDiff 123456789           15.295000    15.368000   Below is the search I am using: index=abc sourcetype=def transaction_id=123456789 | stats count by _time, direction, transaction_id | streamstats range(_time) as TotalDiff | streamstats window=2 range(_time) as SingleDiff   Any suggestions? ... View more

Thanks for your help @ITWhisperer .. To mask these field values I can use sedcmd as below right? SEDCMD-Test = s/<ab:Nm>(?<Nm>[^<]+)/<ab:Nm>########/g Expected Output: <ab:Nm>########</ab:Nm> ... View more

Hi @bowesmana, yeah I edited my original post. Sorry to confuse you.. ... View more

Thanks for your time @bowesmana. What if my data looks like below: _time                                                  Direction                ABCD                              Transaction_ID       2021-07-13 18:56:58.487            in                abcd.008.001.08                     123456789 2021-07-13 18:56:58.603          out               abcd.008.001.08                     123456789 2021-07-13 18:56:59.981            in                abcd.002.001.10                     123456789 2021-07-13 18:57:00.062          out               abcd.002.001.10                     123456789 2021-07-13 18:57:00.565          out               abcd.002.001.10                    123456789   I want to calculate time difference between (1st and 4th event), (2nd and 3rd event). I don't want 5th event in the results.                                    _time                                                         direction                     ABCD                                Transaction_ID First event :         2021-07-13 18:56:58.487                      in                   abcd.008.001.08                   123456789 Second Event:   2021-07-13 18:56:58.603                     out                 abcd.008.001.08                   123456789 Third event:         2021-07-13 18:56:59.981                     in                   abcd.002.001.10                     123456789 Fourth event:     2021-07-13 18:57:00.062                     out                abcd.002.001.10                     123456789 Fifth event:        2021-07-13 18:57:00.565                      out                abcd.002.001.10                    123456789 ... View more

Hi @venkatasri ,   No.. My Transaction_Id is same for all five events and my data looks like below: _time                                                  Direction                ABCD                              Transaction_ID       2021-07-13 18:56:58.487            in                abcd.008.001.08                     123456789 2021-07-13 18:56:58.603          out               abcd.008.001.08                     123456789 2021-07-13 18:56:59.981            in                abcd.002.001.10                     123456789 2021-07-13 18:57:00.062          out               abcd.002.001.10                     123456789 2021-07-13 18:57:00.565          out               abcd.002.001.10                    123456789   I want to calculate time difference between (1st and 4th event), (2nd and 3rd event). I don't want 5th event in the results.                                    _time                                                         direction                     ABCD                                Transaction_ID First event :         2021-07-13 18:56:58.487                      in                   abcd.008.001.08                   123456789 Second Event:   2021-07-13 18:56:58.603                     out                 abcd.008.001.08                   123456789 Third event:         2021-07-13 18:56:59.981                     in                   abcd.002.001.10                     123456789 Fourth event:     2021-07-13 18:57:00.062                     out                abcd.002.001.10                     123456789 Fifth event:        2021-07-13 18:57:00.565                      out                abcd.002.001.10                    123456789 ... View more

I want to delete data for a source as we are seeing sensitive information in it. Can I use | delete for that source? Once we fix the maxing issue, we can start pulling logs from that source and we can search it right? Please let me know. ... View more