You could expand errors with mvexpand, then use streamstats to copy the name to the next event, then clear the name if it is equal to the previous name. ... View more

My answer was a passive-aggressive prod.  You need to ADD DETAIL.  Show us the entry in savedsearches.conf. ... View more

Hi @Veeru , you need to extract the earliest and latest values from the first search, so try something like this: index="C" sourcetype="cpu" host="A.local" [ search index="A" sourcetype="B" | rex "\d+\-\S+.(?<JobName>\w+)\," | transaction JobName startswith= start endswith=end | eval earliest=_time, latest=_time+duration | fields earliest latest ] | eval firsttime=strftime(_time, "%d/%m/%Y %H:%M:%S"), secondtime=strftime(_time, "%d/%m/%Y %H:%M:%S") | where (firsttime >= "26/02/2023 03:03:03") AND (secondtime <= "26/02/2023 04:03:03") | eval Total=(pctSystem+pctUser) | table "firsttime" "host" "secondtime" "Total" You could also work in avoiding transaction command that's a very slow command. Ciao. Giuseppe ... View more

@yuanliu  Thanks for the reply    Let me try and update you.   Happy splunking! ... View more

Hi @Veeru as i am afraid that i have the same issue with you, could you please inform us what have you done to fix the problem? Best Regards. ... View more

So, for a single globalOpId, in your example 0000016, does that mean the list of values is very large for that single row? The table you show has 6 rows, you state 4 rows - can you clarify that you a row in your table means a row you talk about. Can you state how many values(point) you have for a SINGLE global code and _time - what sort of count of values do you have? If you have several million point values for each row, then that is why it is so slow. Can you clarify what you are trying to do. If your point cardinality is very high, you should not collect values(point) and then split them out again. Without knowing your data, can you do the first stats by global point _time rather than just global _time and then see if you can work out what your calculations from that data.     ... View more

Hi @Veeru, you can disable email sendings, simply temporary modifying the information about the email server at [Settings -- Server Settings -- eMail Setings], and then restore the correct information at the end of the maintenance period. For the scripts, you have to intervene on the script, e.g. temporary renaming it. Ciao. Giuseppe ... View more

An option other than the one suggested by rrovers is to use the rex command:   | makeresults | eval id="a,t1023,t456,t0123" | makemv delim="," id | mvexpand id | fields - _time | rex field=id "(?<expected_id>\w{1,3}$)"   This option adds a bit more flexibility given that you can do some validation on the content by changing the regex (e.g. you want only the id's digits just swap \w with \d in the rex command)  ... View more

There are 600 seconds in 10 minutes - the bin takes the time back to the start of the 10 minute bucket; you wanted the end of the bucket, hence the additional 600 seconds ... View more

Hello @ITWhisperer  Thanks for reply. what i got  the results CH DW_i6 DW_dx DW_bp DW_o9 DW_sb DW_tz DW_o6 DW_tz DW_ed DW_h6 DW_zp DW_bl DW_c1 DW_v2 DW_zp DW_o4 DW_o3 DW_o5 DW_ed DW_ed DW_zp DW_w6 DW_d6 DW_ec DW_t6 DW_eb DW_t1 DW_d6 DW_w6   DW_v2 what i except  output is TWIN_ID Y VALUE N CH DW_i6 DW_zp 0 CH DW_dx DW_h6 DW_2 CH DW_bp DW_ed 0 cH DW_o9 DW_bl DW_3 ch DW_sb DW_c1 0   ... View more

It's not about the events themselves 🙂 _time is _time. As I understand the "problem" - there is a timestamp - possibly parsed out from the event - which as we know is internally stored as number of seconds since epoch and is completely "timezoneless". And OP wants to render it in different timezone than user's configured timezone. Splunk as such doesn't allow it. The strftime converts given timestamp to a string but the timezone is not-configurable. It's always the one configured for the user "globally". And there is no way around it. What I meant and what you showed is rendering a completely different value of timestamp to make the string representation appear "correct". It "works" meaning that it should produce expected string values but is prone to cause much confusion and errors later when everyone forgets how it's done, when the daylight saving kicks and so on. Unfortunately, time calculations can be annoying and timezone differences can be confusing. I suppose I'd advise @Veeru to keep the time rendered in user's timezone but maybe give for reference some predefined timestamps in other timezones rendered in user's timezone. ... View more

Which events tell you that the service or store is down? ... View more

Hi @Veeru  if it resolved your issue can you please accept the solution it might help others in the group   note:- If it helps karma is appreciated/if it resolves acceptance as solution is appreciated  ... View more

index=A OR index=B | stats latest(_time) as latest_time by source,host | table latest_time,source,host | sort latest_time | streamstats window=2 range(latest_time) as timerange | eval colour=if(timerange>24*60*60),"red",null()) | fields -timerange | sort -latest_time | fieldformat latest_time=strftime(latest_time,"%d/%m/%y %H:%M:%S:%Q") Then use colour to indicate that the row needs to be coloured  - there are many answers on how to do this ... View more

Looks like there may be a problem with the search being used to populate the dropdown. Can you edit the dashboard and examine the source? ... View more

The "IN" keyword must be capitalized.  Also, consider using the relative_time function instead of maths. index IN (a,b) sourcetype in (a,b) earliest=-12h latest=@m |bin span =30m _time |stats dc(Uuid) as today by _time |append[ |search index IN (a,b) sourcetype in (a,b) earliest=-12h -1w latest=@m-1w |eval _time=relative_time(_time, "+1w") |bin span =30m _time |stats dc(Uuid) as lastweek by _time] |fields today,lastweek   ... View more