I have a table that looks like this   Day Percent 2024-11-01 100 2024-11-02 99.6 2024-11-03 94.2 ... ... 2024-12-01 22.1 2024-12-02 19.0   From this table I am calculating three fields: REMEDIATION_50, _80, and _100 using the following   |eval REMEDIATION_50 = if(PERCENTAGE <= 50, "x", "")     From this eval statement, I am going to have multiple rows where the _50, and _80 rows are marked, and some where both fields are marked.  I'm interested in isolating the DAY of the first time each of these milestones are hit.  I've yet to craft the right combination of stats, where, and evals that gets me what I want. In the end, I'd like to get to this of sorts Start 50% 80% 100% 2024-11-01 2024-11-23 2024-12-02 -   Any help would be appreciated, thanks! ... View more

I have a working dashboard that displays a number of metrics and KPIs for the previous week.  Today, I was asked to expand that dashboard to include a dropdown of all previous weeks over the last year   Using this query I was able to fill in my dashboard dropdown pretty easily | makeresults | eval START_EPOCH = relative_time(_time,"-1y@w1") | eval END_EPOCH = START_EPOCH + (60 * 60 * 24 * 358) | eval EPOCH_RANGE = mvrange(START_EPOCH, END_EPOCH, 86400 * 7) | mvexpand EPOCH_RANGE | eval END_EPOCH = EPOCH_RANGE + (86400 * 7) | eval START_DATE_FRIENDLY = strftime(EPOCH_RANGE, "%m/%d/%Y") | eval END_DATE_FRIENDLY = strftime(END_EPOCH, "%m/%d/%Y") | eval DATE_RANGE_FRIENDLY = START_DATE_FRIENDLY + " - " + END_DATE_FRIENDLY | table DATE_RANGE_FRIENDLY, EPOCH_RANGE | reverse Using this I get a dropdown with values such as  10/07/2024 - 10/14/2024 09/30/2024 - 10/07/2024   And so on, going back a year. Adding it to my search as a token has been more challenging though. Here's what I'm trying to do: index=someIndex earliest=$token_epoch$ latest=$token_epoch$+604800  Doing this I get "Invalid latest_time: latest_time must be after earliest_time."   I've seen some answers around here that involve running the search then using WHERE to apply earliest and latest.  I'd like to avoid that because the number of records that would have to pulled before I could filter on earliest and latest is in the many millions.  I've also considered using the timepicker but my concern there is the users who use this dashboard will pick the wrong dates.  I'd like to limit that by hardcoding the first and last days of the search via the dropdown. Is there a way to accomplish relative earliest and latest dates/times like this? ... View more

I have a lookup table that we update on daily basis with two fields that are relevant here, NAME and ID.  NAME ID Toronto 765 Toronto 1157 Toronto 36   I need to pull data from an index and filter for these three IDs. Normally I would just do  <base search> | lookup lookup_table ID OUTPUT NAME | where NAME = "Toronto" This works, but the search takes forever since the base search is pulling records from everywhere, and filtering afterward.  I'm wondering if it's possible to do something like this (psuedo code search incoming) index=<index> ID IN ( |[inputlookup lookup_table where NAME = "Toronto"]) Basically, I'm trying to save time by not pulling all the records at the beginning and instead filter on a dynamic value that I have to grab from a lookup table.  ... View more

Hello everybody, I'm working on a query that does the following: 1. Pull records, mvexpand on a field named INTEL. This is a multi-value field that could have anywhere from 1 to 11 different values. 2. Once expanded, perform a lookup using INTEL to retrieve a field WEIGHT. A weight is assigned to each INTEL value, between 1 and 5. 3. After the lookup, collapse the split records back into one record.  At first glance I figured I could do `... | mvexpand | lookup | mvcombine | nomv` but since the records are no longer identical because both INTEL and WEIGHT are different, I don't think I can use mvcombine anymore. To Visually demonstrate the issue ID INTEL 12345 A, B, C, D   After mvexpand ID INTEL 12345 A 12345 B 12345 C 12345 D   After Lookup ID INTEL WEIGHT 123456 A 1 123456 B 2 123456 C 3 123456 D 4   Ultimately, I would like to get back to this ID INTEL WEIGHT 123456 A,B,C,D 1,2,3,4   Any tips? ... View more

We pull weekly vulnerability reports from Splunk associated with our Qualys data.  I am trying to filter out all records associated with a hostname if the status field equals "Fixed". The data for a couple hosts might look like this:   Date Host Status 2024-07-22 host1 NEW 2024-07-22 host2 NEW 2024-07-23 host1 ACTIVE 2024-07-23 host2 ACTIVE 2024-07-24 host1 ACTIVE 2024-07-24 host2 ACTIVE 2024-07-25 host1 FIXED 2024-07-25 host2 ACTIVE 2024-07-26 host2 ACTIVE 2024-07-27 host2 ACTIVE 2024-07-28 host2 ACTIVE 2024-07-29 host2 ACTIVE   Both host1 and host2 discover a new vulnerability on 7-22.  On 7-23, the status for both flip to "ACTIVE".  On 7-25, however, host1 is now showing a FIXED status. Host2 remains vulnerable through the remaining date range of the report. Since host1 fixed the vulnerability during the timeframe, how could I go about removing all host1 events based on the status field being equal to "Fixed" on the most recent data pull? ... View more