Morning All    appreciate some guidance on a spl i'm working on and just cant get the information i require my dataset is tickets on our helpdesk . Im looking for the total number of ticket each team has for each different request type.  team is called techGroupLevel request type is call problem_detail here's my search so far and it's just note right.  | table _time id displayClient location_Name problem_detail detail bookmarkableLink status priority techGroupId techGroupLevel tech_Name reportDateUtc lastUpdated closeDate | stats values(problem_detail) as problem_detail count(problem_detail) as total by techGroupLevel under the i'm getting the following      you can see that the figure returned on total is the combined total for all problem_details for each team  i'd prefer to see a separate figure for each problem detail and then perhaps a total sum under each team but dont know how to go about this  for example techGroupLevel                                        problem_detail         Sub-Total                   Total  Systems & Network                                 Email                               10                                     20                                                                           Server                               5                                                                          Shared Drive                   5     appreciate some guidance  thanks    Paula    ... View more

Morning All  I am trying to work out how to use splunk spl to pick random names from a list i have 1 field called 'displayName'. there are over 200 entries and i'd like to use Splunk to pick 5 random names    appreciate help in this Paula     ... View more

Good Morning  Does anyone currently use Splunk or an App in Splunk to monitor folder size?  We are currently been asked to set up new folders for fileshare for various teams and as our storage resource are near end we'd like to monitor each users' folder size. The ideal scenario would be that there would be a threshold in size put on each folder and when the folder is near capacity then an alert would trigger and the IT Team would take action.  Kind regards,   Paula       ... View more

Afternoon All i'd like some help please with some SPL logic that i just cant crack 😞  I have data on some user in our Active Directory system and i am trying to: create a new column with actions identify those who have no logged in for more than 61 days and is so the action should return "reset password" here's the part that i am having an issue with below. the first two lines are working as expected returning last_logon_total  day, month, year i have a new field i created called 'action' that i want to return a value in of those users who have not logged in for more than 61 days.. but i cant get the spl right. | eval epoch_lastLogonTimestamp_date = strptime(lastLogonTimestamp, "%Y-%m-%dT%H:%M:%S") | eval last_logon_total = strftime(epoch_lastLogonTimestamp_date, "%d/%m/%Y") | eval action = if(last_logon_total = relative_time(), "-61d@d", "reset password")   any ideas ?   Thanks Paula     ... View more

Hi All  In my current dashboard i have several text input that colleagues can use to find varies information. Sometimes it takes a while for their information to appear.  Is there a way to add a loading notification / alert to advise colleagues that Splunk is retrieving the information but may take some time?  The delay unusually is only for their 1st search and thereafter the searches are pretty much instant.  Many thanks   Paula   ... View more

Hi All  I'd like some help please with a query thats been asked of me and its a little out of my depth  the current below query shows year total of helpdesk calls by year    index=mmuh_helpdesk sourcetype=mmuh_helpdesk_json | dedup id | fillnull value=NULL | search "problemtype.detailDisplayName"!=*AGRESSO* | eval problem_detail='problemtype.detailDisplayName' | eval problem_detail=replace(problem_detail, "&#8226","") | eval problem_detail=replace(problem_detail, ";","|") | eval techGroupLevel = 'techGroupLevel.levelName' | eval techGroupLevel = replace(techGroupLevel, " "," ") | eval techGroupLevel = replace(techGroupLevel, " ","") | eval techGroupLevel = replace(techGroupLevel, "Level"," Level") | eval location_Name = 'location.locationName' | eval status = 'statustype.statusTypeName' | eval priority = 'prioritytype.priorityTypeName' | eval techGroupId = 'techGroupLevel.id' | eval tech_Name = 'clientTech.displayName' | top limit=20 date_year | search date_year IN(2020,2021,2022,2023) | eval sort=case(date_year=="2020", "02", date_year=="2021","03", date_year=="2022","04", date_year=="2023","05") | sort sort | fields - sort | fields - percent | eval Year=case(date_year=="2020", "Y 2020", date_year=="2021", "Y 2021", date_year=="2022", "Y 2022", date_year=="2023", "Y 2023") | table Year count i would now like to show years only 2021 and 2022 in line chart  but ... i would like each year to have a separate line  if possible i'd like the time span for each year to be broken into a month  i can get this with the time picker (previous year chosen) and following query below for 2022 index=mmuh_helpdesk sourcetype=mmuh_helpdesk_json | dedup id | fillnull value=NULL | search "problemtype.detailDisplayName"!=*AGRESSO* | eval problem_detail='problemtype.detailDisplayName' | eval problem_detail=replace(problem_detail, "&#8226","") | eval problem_detail=replace(problem_detail, ";","|") | eval techGroupLevel = 'techGroupLevel.levelName' | eval techGroupLevel = replace(techGroupLevel, " "," ") | eval techGroupLevel = replace(techGroupLevel, " ","") | eval techGroupLevel = replace(techGroupLevel, "Level"," Level") | eval location_Name = 'location.locationName' | eval status = 'statustype.statusTypeName' | eval priority = 'prioritytype.priorityTypeName' | eval techGroupId = 'techGroupLevel.id' | eval tech_Name = 'clientTech.displayName' | timechart span=1mon count(id)    how can i get both years show ? thank you  🙂      ... View more

Hi all  i have a search running with the following results date_year                   count  2022                             44,814   how do i get the average count over the year?  I've tried to eval date_year by 12 but this doesnt look right.  Also have | timechart avg(date_year) and this is not working out  any ideas?       ... View more