I'm terrible with Regex's and can't figure out what is wrong with mine... I have this Regex: (?P<date>[^,\n]+),\d*--(?P<account>[^,]+),(?P<provider>[^,]+),(?P<product>[^,]+),(?P<service_username>[^,]*),(?P<billing_status>[^,]+),(?P<activities>[^,]*),(?P<requests>[^,]*),(?P<days>[^,]*),(?P<ruuid>[^,]*) Currently working fine for events like: 2014-04-03,1034--account,provider,product,username,Billable,10073107,,19,e5xwcmhbrk, We've added another field to the end that is optional for some events (80--parent below): 2014-04-03,1307--account,provider,product,username,Billable,1614,0,,,80--parent I can't figure out how to extract that "parent" value when it exists (I don't want the preceding "80--". It should work exactly as the 1304--account works in the currently functioning regex. When I try to essentially copy that part of the functioning regex, my queries only return the events that have that parent field name ... View more

I've built a dashboard with a bunch of panels that report on various data points for a given customer account. I'd like to add a form field to the dashboard where a user can enter an account name and all of the panels report based on that account name, rather than the hard-coded account name I used to build the initial dashboard. How can I do this? I figured out how to add a form field by changing to and adding a field set, but have no idea how to make all of the panels run based on the input. Account ABCAccount I really just need to figure out how to pass the value from the account input into those queries/panels. ... View more

I have a lookup table with a bunch of results. There is a a field called "accounts" representing a list of customers. Our splunk index has data on many more accounts than the lookup table has. How can I limit the results of my query to only the ones in the Lookup table? In pseudo code terms, I want to pull all accounts from the lookup table into the array, then limit my search with a WHERE command to the accounts in the array. ... View more

How can I capitalize the first character of some string values using one of the eval or fieldformat operators? ... View more

I'm trying to use a lookup table to get the # of days in the current month (I was told at .conf2012 that is the only way to do it). If there is an operator to return this (similar to date_mday) that would be fantastic, but if not.... I was told that the date_month field returned a numeric value for the month (i.e. September = 9) but it does not, it returns a string like "september". Is there a numeric alternative to this operator where it would return 09 or 9? ... View more

Is there a way that I can sort some data alphabetically where the values are case insensitive? Currently, it sorts all lowercase values alphabetically first, then all of the capitalized values alphabetically after. I want them intermingled so a term like "cat", "Cat", "dog" or are intermingled based on another field rather than being sorted as "cat", "dog", "Cat" ... View more

I've created a lot of reports and a number of dashboards, some of which are pretty complex. We don't have splunk setup on the best machine, so some of these queries take a while to run and dashboards can break or take forever to view while all of the reports are generated, sometimes they timeout. All reports are based on daily data that is pulled in each night around midnight. Is there a way to schedule each report to run early in the morning, say 6am, each day so that every time someone views a dashboard with that report that day, it doesn't have to re-run each time and take forever to load, as its been "pre-run/scheduled"? I don't need it to be emailed to me or anything. ... View more

I am trying to create a report that only returns results that are new this past month. Further, I want it to only return results for "accounts" that first appeared in the data this past month and were not in there 2 months ago. I'd also like to know that date the "account" first appeared in the data. Ultimately, the report will display new accounts added in the previous month and the date created. So the report would initially display new accounts created in february that were not there in February. When it becomes March it should display new accounts for March that were not in data for February. ... View more

One of the fields of my data is a date, represented as a string like 20120215. I need to reformat this date to m/d/y. How can I do this? ... View more

I have a report that I'd like to have cover data from the beginning to end of the previous full month (i.e. today is January 12, I want the report to cover December 1-31). How can I set this time range? I've figured out how to set the start time (-1mon@mon or 1 month back snap to month) but I can't figure out how to specify the end of last month. The best option I know of is now, and that is not correct for my report. Help! ... View more

I am performing a search and sub search and would like to combine the results into a single result set. I have run the 2 searches individually and have an idea of what the combined result set should be. I have tried to join, append, appendcol the sub search with all of the different options inner/outer join, overwrite/override=true/false, etc. and in all of these cases, my result set is missing records that should be in there (i.e. combined i should have like 30 unique records but the max I get is 10). Any idea what might be going on? There are some records that appear in both searches and some that are only in 1. In most cases, it seems like the sub search results are the ones that are missing. ... View more

I have a number of panels on a dashboard that contain data tables with a large number of results. For some reason the panels also vary in the number of results that appear in the panel (i.e. 1 panel has 10 (of 60), another has 50 (of 66)) but I have nothing in the report/query that would control this. Is there a way to set pagination on these panels with a certain # of results per page? ... View more

I'm trying to add 2 fields, each of which contains some nulls. How can I treat these nulls as zeros for the purpose off adding? When doing so as is, it the 2 values added together have returned null. There are no good examples of how to use the if() operator and the ifnull() operator has no documentation at all. I'd imagine these are the best methods for achieving this. Any help would be appreciated ... View more

I'm trying to combine the results of a search and subsearch. They have overlapping fields but different result sets. There is some overlap in the 2 result sets and I want to combine the 2 result sets and add the values of 1 field for the overlapping results (i.e. I have a "volume" column and I want to add the value for "apple" volume in search A with the "apple" volume in Search B and end up with a single "apple" record in the combined resultset. I've tried join, append, and appendcols and can't figure out how to add the values of an overlapping record. Any suggestions? ... View more