This query does show the earliest posted_timestamp. However, all the other fields are blank for the table command for fields (event_id, process_id, msg_timestamp, lag_in_seconds) Thanks! ... View more

Thank you very much for the solution! ... View more

So a single event with two timestamps is easy | rex "time1=(?<t1>[^Z]*Z)" | rex "time2=(?<t2>[^Z]*Z)" | eval t1_t=strptime(t1, "%FT%TZ") | eval t2_t=strptime(t2, "%FT%TZ") | eval diff=t2_t-t1_t You can optimise that to make a single rex if you can guarantee the ordering of your _raw data ... View more

Never mind, my bad, i wasn't inside the Statistics tab. I now see the events matching the id. Thank you for all your help ... View more

Thank you! ... View more

Great, that works! Thanks for the info. appreciate it! ... View more

Yes this works, thank u very much! ... View more

Thank you richgalloway! that worked! ... View more

Instead of your existing foreach block, replace it with this | foreach 2* 3* 4* 5* [ eval "<<FIELD>>"=if('<<FIELD>>'=total OR '<<FIELD>>'=0, "", '<<FIELD>>'."(".round(100*'<<FIELD>>'/total)."%)") ] that will only show a value if the field value is not equal to total or 0. Add the fields - total to remove the total field at the end ... View more

Yes precisely, thank you very much yuanliu for your solution! ... View more

Thanks richgalloway for your quick reply. This worked half-way. So now i don't see any 0% percent anymore, but it still shows 100%. Thanks! ... View more

Blank results might mean you have no permission to view _internal index... However,  I am not aware of any way to append some text to a number and for Splunk to then plot that numerically. One thought it that if you add data values ON to the chart, whether with some Javascript and CSS you could dynamically change the visible text to add the percentage, but I don't know how to do that. See this developer tools view of the <tspan> element showing the data label of the graph value. I suspect this IS possible, but you would need to have the CSS and probably Javascript knowledge to do it.   ... View more