Hello Community, I evaluate the values of a single field which comes with values such as: OUT; IN; DENIED and can get counters for each of those values. Now I want to subtraction "OUT" minus "IN" ( or maybe even minus "DENIED") index="application-license" sourcetype=application License_User_device=* License_feature_status=* License_user=* | fields _time,License_user,License_User_device, License_feature_status,License_feature,tag,eventtype, | eval User=(License_user) | eval LicenseTaken-OUT=mvfilter(match(License_feature_status, "OUT$")) | eval LicenseTaken-IN=mvfilter(match(License_feature_status, "IN$")) | eval LicenseTaken-DENIED=mvfilter(match(License_feature_status, "DENIED$")) | eval LicenseTaken=(License_feature_status) | eval LicenseTaken-AVG=mvfilter(match(License_feature_status, "OUT$") OR match(License_feature_status, "IN$") ) | eval License_feature=(License_feature) | eval Time=strftime(_time, "%d-%m-%Y %H:%M:%S") | bucket Time span=100d | timechart count(LicenseTaken-OUT) as "Application-LicenseTaken(OUT)" count(LicenseTaken-IN) as "Application-LicenseTaken(IN)" count(LicenseTaken-DENIED) as "Application-License-DENIED" count(LicenseTaken) as "Application-License Taken(sum)" count(LicenseTaken-AVG) as "License_avg" | predict License_avg algorithm=LLT upper40=high lower40=low future_timespan=45 holdback=3 in above sample ... I like to implement: | eval LicenseTaken=(License_feature_status) - | eval field1=mvfilter(match(field, "IN$")) or .... mvfilter(match(License_feature_status, "OUT$")) MINUS mvfilter(match(License_feature_status, "IN$")) Field substraction wasn't working; turned back always 0 (zero) Any ideas? thanks in advance Kai ... View more

Hello, I am running below search; daily (last 24h) .... which returns results and "outputlookup" results into a csv based on "xyz_NO_of_day" Runs fine....if I am running such search on same day (i.e. close to midnight) but the source get inputs after midnight so I miss data and had to run such search next day..... i.e. running 04:30am following day Running next day same search and setting it will return a file name based of the day (next-day) So I like to run the search on next day.... i.e. running the search on day 09 @ 04:30am (search day before, which is day8) ... it should | eval filename=strftime(now(), "Application-license-usage-per_day_%d.csv") %d must be counted as the day before =8 not 9. I tried without results to: | outputlookup [ | stats count | eval filename=strftime(now(), "-1d", "Application-license-usage-per_day_%d.csv") | return $filename] Do you have any idea how to fix it? below is the initial search index="application-license" sourcetype=application License_User_device=* License_feature_status="OUT" License_user=* | eval License_feature_status=(License_feature_status) | eval License_User_device=split(License_User_device,",") | eval License_user=split(License_user,",") | makemv delim="," License_user | mvexpand License_user | sort License_user | dedup License_user | stats list(License_user) as "User" list(License_User_device) as "Computer" count(License_feature_status) as "LicenseTaken" by _time | outputlookup [ | stats count | eval filename=strftime(now(), "Application-license-usage-per_day_%d.csv") | return $filename] Thanks in advance ... View more