Hi all, I have 2 multiselect dropdowns. One is dependent on other dropdown. The first drop down has groups and second has sub groups. I am facing some problem in appending the subgroup value to the respective group. For example, lets assume that group has values a b c and only c has subgroup that is x ,y. I want to append that subgroup as c_x and c_y and pass it to the query. I tried adding suffix in dropdown itself. But when the tokens are selected in any order it is adding the sub group to whole token, that is if i select b,c,a it will add subgroup as b,c,a_x and b,c,a_y.   Any suggestions on how can i correctly append the sub group to respective groups and use it in the query. ... View more

Hi all, I have a csv file which contains the some of the counts. I have a set of groups like a,b,c,d which are the values of multiselect dropdown and it is dynamic and the columns in the csv is new_a_Total,new_a_added,new_a_removed,new_b_Total,new_b_added,new_b_removed,new_c_Total,new_c_added,new_c_removed,new_b_Total,new_b_added,new_b_removed. When i select more than one value from the multiselect dropdown i want to add all the respective total, added and removed of the selected groups to show it in the timechart. For example if a and b is selected, it should add new_a_Total and new_b_Total will be renamed as Total, new_a_added and new_b_added will be renamed as added, like this all the respective datas will be added and shown as single result. How can i achieve this? Currently i am trying it out using for each. Any suggestions would be really helpful. ... View more

Hi Everyone, I want to plot a chart according to the calendar week. I plotted a timechart like this,   |timechart span=7d distinct_count(Task_num) as Tasks by STATUS   But this doesn't give the exact calendar weeks. Also i am keeping this charts data to last 3 months. Anyone have idea how to plot a bar chart based on calendar week? instead of date i want to see the data for current calendar weeks of last 3 months. I got from the splunk community on how to get the Calendar week. But i am not to plot a graph out of it. | eval weeknum=strftime(strptime(yourdatefield,"%d-%m-%Y"),"%V")     ... View more

Hi Everyone, I have to extract a file path from a path. The path will be in the format C:\a\b\c\abc\xyz\abc.h. I want to skip first 4 folders. That is in this example i want to extract \abc\xyz\abc.h. How can i dot it using regex?   ... View more

I have a CSV file which has a some columns. There is one column named GROUP and the data in that column are in the format {'a':1,'b':2}, there can be any number of strings. There is another column VALUE and the data are in the format {'a','b'}. I want to check if the strings in VALUE column are present in GROUP column and create a separate column named DATA with the strings not present. I am not sure how to achieve it in Splunk using commands. Can anyone have any suggestions? Example: Group                     Value              Data {'a':'1','b':'2'}            {'a','b'} {'a':1,'b':'2'}              {'a'}                {'b'} {'a':1,'b':'2','c':'3'}    {'a'}                {'b','c'} There are many columns like these and strings present in GROUP column can be more.   ... View more