Hello friends! I get JSON like this {"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338} and so on ... { [-]    key: 29.09.2023    value_cnt: 2736    value_sum: 51150570.59 } аnd row_source like this 10/4/23 1:23:03.000 PM   {"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338} Show syntax highlighted host = app-damu.hcb.kz source = /opt/splunkforwarder/etc/apps/XXX/pays_7d.sh sourcetype = damu_pays_7d   And i want to get table like this: days sum cnt 27.09.2023 35476232.82 2338 29.09.2023 51150570.59 2736   so i have to get latest events and put it to table. Please help ... View more

Hello I have python script just like this         #!/bin/python import os import json import datetime HOMEPATH = '/opt/monitor_dirs/SomeDir' def path_to_dict(path, depth = 1, first = False): for base, dirs, files in os.walk(path): r = {'name': base, 'dirs': len(dirs), 'files': len(files)} if first: r['datetime'] = datetime.datetime.now().strftime("%Y-%m-%dT%H:%M:%S%z") if depth > 0: r['subdirs'] = {} for subdir in dirs: r['subdirs'][subdir] = path_to_dict(os.path.join(path, subdir), depth - 1); return r #print path_to_dict(HOMEPATH, 1) result = path_to_dict(HOMEPATH, 1, True) if result: print (json.dumps(result, sort_keys=True, indent=4))           And i have output          # ./file_count.py { "datetime": "2023-02-22T21:10:49", "dirs": 9, "files": 0, "name": "/opt/monitor_dirs/SomeDir", "subdirs": { "XXXX": { "dirs": 0, "files": 63, "name": "/opt/monitor_dirs/XXXX" } } }             There is some problem in Index I have 2 event instead just only one 1. { 2.  ""datetime": "2023-02-22T21:10:49", "dirs": 9, "files": 0, and so on, but there is no '{'   How i can get only one event with my JSON   ... View more

Hello im newbie with Splunk search Can you please help me I have HF request which return: -AAA  datetime_of_change -BBB datetime_of_change Every halfhour i get the same dataset from DB to INDEX I have to get latest dataset (not latest row!)           ... View more