nice idea @harishalipaka! ... View more

Multivalue fields in Splunk do not contain elements with null values, so there would never be an output field that had a "null" in a multivalue slot. Thus, if you want to compare to the two items, you are going to have to extract them individually as a workaround. | spath output=my_one0 path=bean.test{0}.one | spath output=my_one1 path=bean.test{1}.one | spath output=my_two0 path=bean.test{0}.two | spath output=my_two1 path=bean.test{1}.two ... View more

Perfect! Thanks, I knew it was something to do with eventstats, but couldn't get it to work! ... View more

Append this to your search: ... | foreach server_a* [eval A = A + <<FIELD>>] | foreach server_b* [eval B = B + <<FIELD>>] | multireport | [stats dc(ID) AS dcIDbyA values(ID) AS valuesIDbyA BY A] [stats dc(ID) as dcIDbyB values(ID) AS valuesIDbyB BY B] ... View more

Thanks, it was almost right, but we have a URL we extract into different fields and it counted that as one, but we wanted each extracted part to be counted ... View more

Thanks, that's perfect ... View more

Like this: index=beacon Platform=mobile OR Platform=web | chart dc(USERID) over Action by Platform ... View more

Thanks a lot! ... View more

I have same problem too. mine just a simple question as there is an input to search data in 1 single sourcetype by using UID as now, the UID column only allow 1 UID to search how to make it to able multiple search , as my customer would like to input "uid1 uid2 uid3 uid4.." ... View more

Perfect! Thanks (a month after you answered it!!) ... View more

Try your search code like this : your search here .... | convert timeformat="%A %d %B " ctime(_time) AS c_time |chart count by c_time it will give you the date format that you want. E.g : Monday 10 february in X-Axis ... View more

The only possible explanation is that field new_add does not exist in BOTH search's datasets; double-check your spelling/punctuation of all fields. It looks like it is supposed to exist in the first/outer search's dataset and you are trying to create it for the second dataset but perhaps you are trying to create it for both datasets and in that case, you forgot to do so for the first/outer dataset! Using coalesce should work for either case. Also, Try to avoid join so how about this: index=beacon BeaconType=userevent type=addonselected OR index=clickstream | stats values(*) AS * by INID TEST | eval Message=max (pageid) | lookup TGIF Message | eval new_add=coalesce(new_add,Message." , ".'Location Number') | chart count by new_add providername ... View more

Thanks! That is perfect ... View more

Perfect, thanks a lot! ... View more

...if the form is made in advanced XML, that is. If it's not, you can convert simple XML to advanced XML. ... View more