index=conversation botId=ccb | eval intent_count=if(like(intent,"%"), "1", "0") | stats sum(intent_count) as intent_count by sessionId | where intent_count >= 2 | addtotals col=t row=f labelfield=sessionId label="Total Sessions with More Than 2 Intents" | append [search index=conversation botId=ccb | eval intent_count=if(like(intent,"%"), "1", "0") | stats sum(intent_count) as intent_count_small by sessionId | addtotals row=f col=t labelfield=sessionId label="Total Sessions with Less Than 2 Intents" | where intent_count_small < 2] | search sessionId="Total Session*" Maybe changing the intent count field name will eliviate that. I am not sure if bin would work, but it could! ... View more

index=conversation botId=ccb | eval intent_count=if(like(intent,"%"), "1", "0") | stats sum(intent_count) as intent_count by sessionId | where intent_count >= 2 | addtotals col=t row=f labelfield=sessionId label="Total Sessions with More Than 2 Intents" | append [search index=conversation botId=ccb | eval intent_count=if(like(intent,"%"), "1", "0") | stats sum(intent_count) as intent_count by sessionId | addtotals row=f col=t labelfield=sessionId label="Total Sessions with Less Than 2 Intents" | where intent_count < 2] | search sessionId="Total Session*"   This will return the results with two different column totals. The last Search is just a filter to only the totals will show, but if you want the sessionId's to be listed as well you can just take out that last line.  Is this more what you were looking for? ... View more

index=conversation botId=ccb | eval intent_count=if(like(intent,"%"), "1", "0") | stats sum(intent_count) as intent_count by sessionId | addtotals col=t row=f labelfield=sessionId intent_count | where intent_count >= 2 This should only show a Total count and the sessionId's with over two intents.  ... View more

because forwarders are automatic load balancers they distribute across all the indexers. So say one search needs to pull 4 buckets of one index (index=example) depending on parameters set)  indexer 1 could have the primary copy of bucket one and 2 of index example   indexer 2 has the primary copy of bucket three and the back ups for bucket one and two indexer 3-4 have the back ups for bucket 3 and 4.  and indexer 5 has the primary of bucket 4. Etc…  so in this search indexer 1,2, and 5 would participate.  ... View more

Do you have a couple sample events to work the search against.  Because in this event with the eval you are doing, it looks like it will only return values of 1 or 0 for intent_total. So I don’t think you can use that to | where >2 against.  Unless you are trying to do |where against the new field that is sum in which case it should be written | stats sum(intent_total) as intent_total by sessionId  ... View more

Yes you can.   Here is the doc that shows the configs to do so.  https://docs.splunk.com/Documentation/Splunk/8.2.6/Indexer/Configuremulti-clustersearch https://docs.splunk.com/Documentation/Splunk/8.2.6/DistSearch/SHCandindexercluster   ... View more

To ensure that exactly one copy of each bucket participates in a search, one searchable copy of each bucket in the cluster is designated as primary. Searches occur only across the set of primary copies. This is to ensure that there isn’t duplicate data/events being returned in a search. https://docs.splunk.com/Documentation/Splunk/8.2.6/Indexer/Basicclusterarchitecture So if the primary copies are stored in one site then that is the site the Search Head will search. The others are “back-ups” in the event that one of the Indexers goes down. This is feature is more for data loss prevention and user search ability not being interrupted.    Also check to be sure your SH is configured to disable search affinity: https://docs.splunk.com/Documentation/Splunk/8.2.6/Indexer/Multisitesearchaffinity ... View more

You can set your Timezone in props.conf  example:  [host::nyc*] TZ = US/Eastern https://docs.splunk.com/Documentation/Splunk/latest/Data/Applytimezoneoffsetstotimestamps ... View more

I am not sure it is your whole issue, but your time format doesn't match the example: [2022-04-04 23:10:30.643]    It should be %Y-%m-%d %H:%M:%S.%N I would also add in a  LINE_BREAKER = <REGEX>   ... View more

Fantastic!!  ... View more

Ahhh change the eval to capitalize the field name | eval time_epoch = strptime(SESSION_TIMESTAMP, "%Y-%m-%d %H:%M:%S") ... View more

Does the strptime format match the time format of the SESSION_timestamp in your data?   ... View more

| timechart span=1d count | fullnull ... View more

Convert the time to epoch, reformat it without the seconds, and then concatenate with strcat:: | eval time_epoch = strptime('SESSION_timestamp', "%Y-%m-%d %H:%M:%S") | convert ctime(time_epoch) as hour_minute timeformat="%Y-%m-%d %H:%M" | strcat hour_minute ":" SEQUENCE combo_time   combo_time= 2022-04-20 12:23:101 ... View more

index=* SrcCountry=Mexico  | timechart span=1week count by SrcCountry  This gives you a count by Country per week.  Run the search across 2 weeks. (If you want complete weeks you can "snap down" to the nearest week by using span=1w@w) Or,  index=* SrcCountry=Mexico  | timechart count by SrcCountry span=1d | timewrap 1week This returns a daily count by country, that is compared to the previous week days.  I used Mexico as the example country. Any countries with spaces need quotes: like "United States" ... View more

You can use fields to group transactions together. So group it by the user field and use the maxspan time to make sure the first activities and last are no more than 8 hours apart.  | transaction user maxspan=8h ... View more

try: | eval Epoch_login =strptime(login_time,”%Y-%m-%d %H:%M:%S”) | eval log_out = relative_time(Epoch_login,"+8h") Use %I instead of %H, if it isn't in 24 hour time format, but in 12 hour.   To use relative_time the time has to be in Epoch which is why I converted it first. Then added 8 hours to the epoch time to give you the log_out time https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions#relative_time.28.26.2360.3Btime.26.2362.3B.2C.26lt.3Bspecifier.26gt.3B.29 ... View more

Are you using dashboard studio, or classic?  ... View more

You can use the field extractor to extract the fields based on the "," as the delimiter.  Or | rex in the search bar.  Using the K=V pair extraction. (?<_KEY_1>[^=]+)=(?<_VAL_1>[^,]+),? https://regex101.com/ Then use |eval <field> = mvindex(<ref_field>, #) To reference each value in a search, or you can use the | eval mvexpand()  function to split them into multiple events based on the field specified.  https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/mvexpand   ... View more