Hello All, Regards Shailendra Patil ... View more

Hello All, Suppose I want a search results for past 60minutes, how spunk works now is if there is any event in past 60mins then that is displayed. But what i want is Suppose time is 4pm and I give past 60mins, Splunk should start the data from 4:00, 4:01...... and so on till 5:00 irrespective of data is present or not, if data is not present then the result should give time with corresponding columns blank. Can someone please help mw on this. ... View more

Hello All, I have a search query as below: index="alpha_all_aal_event" type=twaReport|search callId=0 userId=a2ebd4aa-f91a-4088-8667-60143707c368|fields *|rename eventTime.$date as eventTime|eval eventTime=(eventTime/1000)|append [search index="alpha_all_careport_event" userId=a2ebd4aa-f91a-4088-8667-60143707c368|fields *|rename eventTime.$date as eventTime|eval eventTime=(eventTime/1000)|streamstats min(eventTime) as limit]|table eventTime eventData.preLimiterSplEstimate eventData.postLimiterSplEstimate eventData.twaThreshold limit And the data is shown below : The limit column has just a single value min(eventTime) from one of the search queries, and its null everywhere else. I want to replace the null value of limit, with already existing single value in limit. Can someone please help me how to do this, as this is appended search I am not getting the expected results. ... View more

Hello Guys, I have a column _time Ex Values (Suppose the search has 4 events here): 2017-08-11 12:06:51 2017-08-11 12:06:54 2017-08-11 12:06:56 2017-08-11 12:06:58 Now my intention is I want _time to increment by one second, that even though there is not row with 2017-08-11 12:06:52, I want to add a row with all other columns to be 0, So my new data should look like 2017-08-11 12:06:51 2017-08-11 12:06:52 2017-08-11 12:06:53 2017-08-11 12:06:54 2017-08-11 12:06:55 2017-08-11 12:06:56 2017-08-11 12:06:57 2017-08-11 12:06:58 So all the appended time which was not there should have the other column entries of search as 0. The new search should have 8 events now. Can someone please help me with this, as I am not able to understand how to do it. Regards Shailendra Patil ... View more

Hey , get the duplicate conflict error. I already check few posts here and tried changing field by label and field by value , i still get the error. There are no duplicates. Below is the xml <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="field1" searchWhenChanged="true"> <label>username</label> <choice value="spatil">default</choice> <search> <query>index="alpha_all_callsummary_ds" user.username=* call.lineType=VOIP|dedup user.username|table user.username</query> <earliest>0</earliest> <latest></latest> </search> <fieldForLabel>user.username</fieldForLabel> <fieldForValue>user.username</fieldForValue> <default>spatil</default> </input> </fieldset> Can someone please help me where am i going wrong in this. ... View more

Hello All, I have a search query which gives the below results: Now the same query when my friend runs in his system, the number of events is same, but the events are not in same order: Like in my system the first entry is as shown above : eventData.txLevelIn =-52 But in my friends system the first entry is eventData.txLevelIn =-56 Can someone tell me what is the issue. We have not changed any setting, we both are on same Server. Regards Shailendra Patil ... View more

Now when i use mvexpand i just get 600 results in statistics, instead of getting 1412 alll the events as below: So i am not sure what is causing this problem. ... View more

Hello All, I have a data as below : Where for every callId there are list of values in next column. So I have some 10 callId and for every callId and I have list of values in column 2 Now I want to plot a line chart , for the values in column 2 such that every callId corresponds to a separate line in visualization. Can someone please tell me how can we achieve this. Regards Shailendra Patil ... View more

Hi, Suppose I have a column having list of values and i want to plot it as continuous data. How am i supposed to do it The data is like below : And i want to plot a continous data graph something as below. I tried it using timechart but the problem is all this data points have same _time. So can someone please help me with this Regards Shailendra Patil ... View more