Hello,  I have the following 2 events : 1st event :      { [-] dimensionMap: { [-] User type: Real users dt.entity.application_method.name: Application } dimensions: [ [-] APPLICATION_METHOD ] timestamps: [ [-] 1650966840000 1650966900000 1650966960000 1650967020000 1650967080000 1650967140000 1650967200000 1650967260000 1650967320000 1650967380000 1650967440000 ] values: [ [-] 0.47 0.67 0.37 0.45 0.44 0.57 0.48 0.47 0.69 0.70 0.40 ] }     2nd event :      { [-] dimensionMap: { [-] dt.entity.application_method.name: Application } dimensions: [ [-] APPLICATION_METHOD ] timestamps: [ [-] 1650966840000 1650966900000 1650966960000 1650967020000 1650967080000 1650967140000 1650967200000 1650967260000 1650967320000 1650967380000 1650967440000 ] values: [ [-] 18 27 23 19 17 21 24 30 13 10 5 ] }     I would like to bind each value of the 1st event to each value of the 2nd event. I tried some join commands using the timestamps as a common value, but it didn't work. At the end, I would like the following table (result = value1*value2) :       Timestamp                                  Value1                    Value2                        Result 1650966840000                            0.47                          18                              0.47*18 1650966900000                            0.67                          27                              0.67*27 1650966960000                            0.37                          23                              0.37*23 1650967020000                            0.45                          19                              0.45*19 1650967080000                            0.44                          17                              0.44*17 1650967140000                            0.57                          21                              0.57*21 1650967200000                            0.48                          24                              0.48*24 1650967260000                            0.47                          30                              0.47*30 1650967320000                            0.69                          13                              0.69*13 1650967380000                            0.70                          10                              0.70*10 1650967440000                            0.40                           5                                0.40*5 Thank you. Regards, ... View more

Hello,  My Splunk query an API and gets a JSON answer. Here is a sample for 1 Host (the JSON answer is very long ≈ 400 hosts) :  {     "hosts": [         {             "hostInfo": {              "displayName": "host1.fr"                                    },              "modules": [                 {                     "moduleType": "JAVA",                     "instances": [                         {                             "Instance Name": "Test1",                             "moduleVersion": "1.0"                         },                         {                             "Instance Name": "Test2",                             "moduleVersion": "1.1"                         },                         {                             "Instance Name": "Test3",                             "moduleVersion": "1.2"                         }                       ]                   }               ]           }        ] }   First-of-all I have to manually parse this JSON because SPLUNK automatically gets the 1st fields of the 1st host only.   With this following search, I manually parse this JSON all the way through the "instances{}" array and I count the number of moduleVersion : index="supervision_software" source="API" earliest=-1m | spath path=hosts{}.modules{}.instances{} output=host | fields - _raw | mvexpand host | spath input=host | stats count(moduleVersion) It displays a number of 1277 moduleVersion and it is the right number. On the other hand with the next similar search, when I parse the JSON starting only to the 1st array ("hosts{}"), I am getting a different number of moduleVersion  : index="supervision_software" source="API" earliest=-1m | spath path=hosts{} output=host | fields - _raw | mvexpand host | spath input=host | stats count(modules{}.instances{}.moduleVersion) It displays a number of 488 moduleVersion but it's incorrect. Why is there a difference ? Thank you. Best regards, ... View more

Hello, I would like to center the dates of my timechart (column) :         I'm using the timechart command in order to get a table that is then transformed in a column chart. How can I do this? Thank you. Best regards, ... View more