My csv file has  "month" field and the values are as below :   2020-10 2020-09 2020-08 2020-07 2020-06 2020-05 2020-04 2020-03 2020-02 2020-01     I want to convert the months from number to Jan, Feb, Mar, Apr and so on... I tried using strptime, but that is not working. I want to show it as 2020-Jan, 2020-Feb, 2020-Mar...  Please help , below is my query :   index=azure sourcetype=azure_total_cost source="C:\total_cost\\azure_total_cost_by_year.csv" month!="month" | eval mymonth=strftime(month, "%Y-%b")         ... View more

I have a CSV data in following format and I have written props and transforms to extract the fields. Somehow, the ""Summary|vSphere Tag"" field values are not getting extracted wherein I have written transforms for it. Below are my configuration files - inputs, props and transforms : CSV Data:     "Name","Summary|vSphere Tag" "DC4VPWSAM","[<Application_category-Software Asset Management>, <Sub_class-Facilities>, <Department-Infrastructure & Operations>, <Primary_System_Owner-Pankaj Gadhari>, <Section-SM Service Support_Sec>, <Organisation-Technology & Infrastructure>, <Division-I&O Service Management>, <Application_Name-Manager Suite>, <Unit-SM Service Support>, <Class-Line of Business>]" "DC1VPWSAM","[<Application_category-Software Asset Management>, <Sub_class-Facilities>, <Department-Infrastructure & Operations>, <Primary_System_Owner-Pankaj Gadhari>, <Section-SM Service Support_Sec>, <Organisation-Technology & Infrastructure>, <Division-I&O Service Management>, <Application_Name-Manager Suite>, <Unit-SM Service Support>, <Class-Line of Business>]" "DC3VPWSAM","[<Application_category-Software Asset Management>, <Sub_class-Facilities>, <Department-Infrastructure & Operations>, <Primary_System_Owner-Pankaj Gadhari>, <Section-SM Service Support_Sec>, <Organisation-Technology & Infrastructure>, <Division-I&O Service Management>, <Application_Name-Manager Suite>, <Unit-SM Service Support>, <Class-Line of Business>]" "DCVPWSCCM","[<Primary_System_Owner-Pankaj Gadhari>]" "witsql-esx","none"     Inputs.conf     [monitor://C:\VMware-Tags\tagsplit\*.csv] disabled = false index = vmware sourcetype = vmware-tags-csv crcSalt = <SOURCE>       Props.conf     [vmware-tags-csv] DATETIME_CONFIG = CURRENT INDEXED_EXTRACTIONS = csv KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured disabled = false pulldown_type = true REPORT-vmtags = myplaintransform1 EXTRACT-vmname = (?<vmname>[A-Za-z0-9]+),       transforms     [myplaintransform1] REGEX=(?<vmname>[A-Za-z0-9]+),\<(.*?)-(.*?)\> FORMAT=$1::$2         somehow the transforms is not working and the fields are not getting extracted. I want to extract Key Value pairs from "Summary|vSphere Tag" field so that it should show in search as below : vmname, Application_category Primary_System_Owner and so on...  Please help resolve the issue. ... View more

In my table the last row is the "Average" of all the columns which is calculated based on the query. I want to disable the drilldown click for it. how it can be done ? Attaching image for your reference. Below is the snippet of query I am using for the table : | transpose header_field=Category 10 | addtotals | eval Average=round(Total/8,0)| fields - Total | table column "Availability Management" "Identity Access & AD" "Information Security Management" "Monitoring & Analysis" "Server & Storage" "Service Asset & Configuration Mangement" "Service Management" Others Average | transpose header_field=column 25 | rename column as Category ... View more