Hi, I have built a lookup table, definition & automatic lookup. I've set the definition to; Min Matches - 1 Max Matches - 1 Default Matches - None The additional lookup fields appear in the appear data as expected with 1 result having the value of "None". However, when I click the "None" value it appears as no results found. If I then add a wildcard value before the "*None", the one result in question appears. Has anyone else come across same issue? Thanks ... View more

I have an Incident "Open Date" in following format DD/MM/YYYY HH:MM and an Incident "Close Date" in same format. I want to calculate the amount of time between the two dates. However, I only want to calculate the hours between 09:00 and 17:00 on those dates. Can any one advise? Thanks ... View more

Hi, I am wanting to calculate the average count of "incidents" per hour/day (i.e. Mon-07:00, Mon-08:00) over a 12 month period. I am using a date field that is not my timestamp. This is the syntax I have so far, any help would be appreciated. sourcetype=sourcetype1 | eval log_day=strftime(strptime(DATE_ENTERED,"%Y-%m-%d %H:%M"),"%a-%H:00") | eval sort_field=case(log_day LIKE "%Mon%",1, log_day LIKE "%Tues%",2, log_day LIKE "%Wed%",3, log_day LIKE "%Thu%",4, log_day LIKE "%Fri%",5, log_day LIKE "%Sat%",6, log_day LIKE "%Sun%",7) | stats count by log_day sort_field So essentially at the moment this search is telling how many incidents I have had in total for Mon-07:00 etc. but I need the average amount per day across the 12 month window. The sort field is only there to ensure the days of the week are in order (Mon to Sun). Thanks ... View more

I am displaying some data by Month for 2018/2019 (i.e. 01-2018, 02-2018) on a barchart. Search Query: ( sourcetype=sourcetype1) OR (sourcetype=sourcetype2) OR (sourcetype=sourcetype3) | chart sum(eval(if(sourcetype="sourcetype1",ICOS,NULL))) as Actuals sum(eval(if(sourcetype="sourcetype2",ICOS,NULL))) as Forecast sum(eval(if(sourcetype="sourcetype3",ICOS,NULL))) as Budget over "Month" However I also want to be able to overlay 2017 data so that 2017-01 is shown above 2018-01 without adding to the x-axis. Any ideas how I could do that? ... View more

I am displaying some data by Month for 2018/2019 (i.e. 01-2018, 02-2018) on a barchart. Search Query: ( sourcetype=sourcetype1) OR (sourcetype=sourcetype2) OR (sourcetype=sourcetype3) | chart sum(eval(if(sourcetype="sourcetype1",ICOS,NULL))) as Actuals sum(eval(if(sourcetype="sourcetype2",ICOS,NULL))) as Forecast sum(eval(if(sourcetype="sourcetype3",ICOS,NULL))) as Budget over "Month" However I also want to be able to overlay 2017 data over the same period without changing the above x-axis of Month. The 2017 data will come from sourcetype1. Any ideas how I could do that? ... View more

Hi, I have created a show in Slideshow to run a number of dashboards in an order of my choice. However it appears to skip my first dashboard and go straight to the second one. It will then display the one first in list last? These are the two dashboards: 1. app/wemeia/caixa_live_dashboard__average_time_on_site_f0000 2. app/wemeia/caixa_live_dashboard__average_time_on_site_f3800 So 1 in list above should display first but does not! Any advice? ... View more

I am running a Summary Index based on a lookup table. However I want to change the summary index timestamp to "Month/Year" field (see below). | inputlookup inventory.csv | stats values(count) as count by Month/Year Month FamilyCod ProductCod Month/Year field is in following format "%Y/%m". Could someone please advise? Tghanks ... View more

I am attempting to create a new "Week" field based on an external lookup. However, the date field in my sourcetype and lookup DO NOT match. The date field in the sourcetype is in following format %d/%m/%Y %H:%M (e.g. 31/05/2018 00:05). The Date field in my lookup table is in following format %d/%m%/Y (e.g. 31/05/2018). Can I use Match Type in lookup definition to use a wildcard on Date field in order to return "Week" field? Can't seem to get it to work. Thanks, Jack ... View more

Hi, I am trying to build a multi-level pivot table in SPLUNK, where you can have multiple rows under one another like you can in an excel pivot table. Is this possible? Thanks ... View more

I have an issue where I have a number of fields in my data in following format of "%H:%M:%S" and they are stored as text. Therefore I cannot do any stats calculations such as avg on these fields. I am trying to convert these fields in EPOCH time using the strptime, this then allows me to calculate an average & convert back to "%H:%M:%S" format. However, some of the calculations aren't converting back correctly. Full search query: sourcetype=diags_yesterday Priority=A "Next Ind"!=C Team=DIAG | eval actual_stack_time1=strptime(actual_stack_time,"%H:%M:%S") | eval handling_time1=strptime(handling_time,"%H:%M:%S") | stats count as "Call Volume" avg(actual_stack_time1) as "actual_stack_time1" avg(handling_time1) as "handling_time1" by Day DOW | eval "Avg. Time on Stack"=strftime(actual_stack_time1, "%H:%M:%S") | eval "Avg. Handling Time"=strftime(handling_time1,"%H:%M:%S") | fields Day DOW "Call Volume" "Avg. Handling Time" "Avg. Time on Stack" EXAMPLE before adding the strftime syntax: Day DOW Call Volume actual_stack_time1 handling_time1 06/03 Tue 24 1521072478.75 1521072078.1666667 This should then convert to 01:01:18 and 01:07:58 but currently is returning as 00:01:18 and 00:07:58. Can anyone help? Thanks, Jack ... View more