Hi, Thanks for the prompt reply. i have tried your solution but anable to write netsed appendcols. Please send me sample exmaple for nested appendcols if possible. and also need to show unique and overall counts seperately. need following output. Date Unique/Overall Flow heats Completed 2015-05-17 overall Flow1 20 30 2015-05-17 overall Flow2 50 40 2015-05-17 Unique Flow1 20 30 2015-05-17 Unique Flow2 50 40 But i have getting following output Date Unique/Overall Flow heats Completed 2015-05-17 overall Flow1 20 30 2015-05-17 overall Flow2 50 40 2015-05-17 Unique Flow1 20 2015-05-17 Unique Flow2 50 Please help me out. Thanks in advance. Regards, Sandeep ... View more

Hi, Thanks for the reply. I have already installed the splunk from url which you provide but i cannot able to explore KVstore feature and received error. so my question is with the help of this license can i able to explore kvstore lookup. Thanks in advance. Regards, Sandeep ... View more

Hi, I ahve download Splunk 6.2 Trial version from below URL. I hav one question is this trial version support all splunk 6.2 features including KVstore. http://www.splunk.com/view/splunk-introduces-splunk-enterprise-6-2/SP-CAAANJR Thanks in advance. Regards, Sandeep ... View more

Hi, In my scenario i have created one Lookup file (.csv) which contains AccountNo's and from this Lookup file need to insert records into the kvstore_Lookup. Folowing is my search Query. | inputlookup lkpAttemptByAccount.csv | outputlookup mycollections_lookup Thanks in Advance. Regards, Sandeep ... View more

Hi Muryoutaisuu Thanks for the reply. I have one query where we store collections.conf and transforms.conf file, means on local directory or on somewhere inside Splunk home directory. Thanks in advance. Regards, Sandeep ... View more

Hi, Thanks for the prompt reply. I have already tried link which you mentioned but i have received following error. Error in 'outputlookup' command: The lookup table 'test' is invalid. ... View more

Hi, I am tried above but still unable to convert string into date it's just change the date format. ... View more

Hi, Thanks for the reply. Please find below sample data for your reference. Event1 server1 [17/Oct/2013:00:00:52 -0500] "IPAddress Event2 server1 [17/Oct/2013:01:02:59 -0500] "IPAddress Event3 server1 [18/Oct/2013:02:00:50 -0500] "IPAddress Please find search query index=Indexname sourcetype="Sourcetype" "Search Condition" | rex "[(?P [^ :\s*?]+)" | stats count As Total by Date Date Total 01-Oct-2013 2 01-Oct-2013 1 Above output date columns datetype is string and i reuqired this to convert into Date format ("dd-mm-yyy") Please help me. Regards, Sandeep ... View more

Hi Aholzer, sorry it's typo mistake, but still it's not working. Please suggest me my folloiwng query is right or i want to change something to work your suggetion. Rexindex="indexname" sourcetype="Sourcetype" Search condition | rex "[(?P [^ :s*?]+)" | eval date_time = strptime(Date, "%H:%M")| stats count by DatePlease Regards, Sandeep ... View more

Thanks for help Aholzerbut still i am facing issue with rex as i am extracing date field using rex, so can you told me how to aply eval function with rex beacuse i am trying the same and get error invalid rex command.please find query with Rexindex="indexname" sourcetype="Sourcetype" Search condition | rex "[(?P [^ :s*?]+)" | convert auto(Date) | stats count by DatePlease help me.Thanks in advance. ... View more

My scenario is i have one Index which conatins two source files for ex. Source type="A" and Source Type="B". Both files contains Account ID which will be extracted using rex command. Now i want to search if account ID from Source type "A" is present in Source Type "B" then i want to extract customer ID from Source Type "B". ... View more

Hi, Thanks for help I am already tryed this but it's not fulfilled my requirements and i want to search Acccount Number from Source type A and on the basis of that want some values and Account ID from source B. Please help as i am new to splunk. Thanks in advance ... View more