Hey, I am trying to sum values based on type. I have a column of numbers and multivalues. I want to sum all the multivalues together and display the sum of all multivalues. How can I achieve this? Please refer to the diagram below: As you can see there are two column. One column displays the numbers and the other column displays the type of each cell. I want to get the sum of cell that have a multivalue type. ... View more

Hey, I recently made a bar graph in Splunk that adds new data of the duration of the test. My only problem with this graph is that after 13 entries, it starts adding data from the beginning of the graph.    So for example, you can see after 28th april, new data starts getting added from the beginning of the bar graph. Please refer to the diagram below. I want the new data to continuously get added at the end of the graph and erase the old data in the beginning of the graph. How can I accomplish this? The query I am using for the existing search is below: index="aws_dev" | eval st=strptime(startTime, "%Y-%m-%dT%H:%M:%S.%3N%Z"), et=strptime(endTime, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval st=mvindex(st,0) | eval et=mvindex(et,0) | eval diff = et - st | eval date_wday=lower(strftime(_time,"%A"))|eval date_w=strftime(_time,"%d-%b-%y %a %H:%M:%S") |where NOT (date_wday = "sunday" OR date_wday = "saturday") | chart values(diff) by date_w   ... View more

Hey, I am working on making a dashboard and wanted to know how can I subtract two dates that are in iso 8601 format.  Please refer to the snippet of json below: { "startTime": "2022-04-25T01:02:19.221Z", "endTime": "2022-04-25T01:57:59.417Z"} ... View more