Hello, I've an index where all my data is stored and I want to create 2 savedsearch :  - one with all the data (i have to create this one because there are others sourcetype that i don't want the user to access). - one with less data I have an issue when i create my savedsearch with      |table myfield1,myfield2      i can see myfield3 in the events tab from the search result.   In fact, i want to see myfield3 from events tab only with my savedsearch with all the data but not in the other one. ... View more

Hello, i'm trying to add values to an existing field but i'm running into a wall. I have a field name vector and another field name source, the pattern of the source field is XXX - YYY - ZZZ, i only want to keep the XXX part, so i've done     | eval temp = mvindex(split(source, " - "),0)     then i try to add these result to the vector field like this :     |eval vector = vector + temp     but it doesn't work.   Can you help me ? ... View more

Hello, I'm trying to change my date format two times because i want to sort to order my month from January to December. I've been trying this search but the field newPeriode2 isn't showing any results : | eval newPeriode = strftime(strptime(Période,"%Y-%m-%d"),"%m-%Y") | sort newPeriode | eval newPeriode2 = strftime(strptime(newPeriode,"%m-%Y"), "%B-%Y") this is what it looks like. I want my newPeriode2 looks like : January-2022 etc... Thanks for your help ! 🙂 ... View more