Could it be significantly simplified if you use, to derive the date category information "01-January", some variation of ... ... | eval date_month=strftime(_time, "%m-%B") ... See this run-anywhere example: | makeresults | eval date_month=strftime(_time, "%m-%B") Which gives you a date_month equal to, right now, 07-July . Refer to Splunk date and time format variables) ... View more

try this: index=webex_sentiment "A desk or huddle room (9 or fewer seats) phone" | eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") | eval YearWeek=strftime(surveyDate,"%Y-%U") | eval Country=upper(Country) | lookup CountryDetails Country OUTPUT Region | stats count(Rating) as NumberRatings by YearWeek Rating Region | eventstats sum(NumberRatings) as TotalRatings by YearWeek Region | eval PercentageRatings=round(NumberRatings/TotalRatings,3) | where Rating=1 OR Rating=2 | chart sum(PercentageRatings) as NegativeSentiment by YearWeek Region that should narrow down your search to what you're looking for before you actually start evaluating anything. ... View more

That's exactly what I was looking for! Thanks so much. Here is the final product: http://imgur.com/a/ERVTQ ... View more

This is the error I get when I try to set the path directly: http://imgur.com/a/hAStX When I navigate to the Users folder and then my username, all the folders are empty. I think the permissions might not allow, and I'm not sure how to fix that. ... View more

you could anticipate all possible hex values like this too s/\\x[A-F0-9]{2}//g ... View more

you'll need to be on splunk version 6.6 to use the trellis option. https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Viz/VisualizationTrellis When you're on the Visualization tab, you'll see a Trellis button next to Format. When you click on it, you'll see a checkbox for Use trellis layout. There is a Split by option and you can choose to split by various available fields or the aggregation of your fields. There is a syntaxing note that I'll forewarn you about, and it's that I recommend you end the syntax with a command like stats, chart, timechart, etc. and not an eval command, because the split by option sometimes will only allow you to split by the aggregation in those cases. ... View more

Hey Matt, Sorry for the delay in getting back to you. The data is looking good now! The timestamp is being extracted properly and is Splunk is converting the timestamp to the local timezone you have set under your account settings (which appears to be UTC -5). So we are almost there....2 things: 1) Can you confirm the webex timestamps are UTC? 2) Confirm your account settings are UTC-5 and that Splunk is correctly translating the original UTC timestamp to your local time in the _time field Also, once this is done, please remember this will only affect the data that is ingested AFTER the changes. Any old data will need to be re-indexed to correct the issues. Also, have your admin keep in mind, these props.conf need to be placed on the forwarder as you are dealing with indexed_extractions (i put it on the UF and IDX for continuity sake) ... View more

Sorry, broke my arm so I am way behind on things that require typing. Add this to the end of your search: | eval PercentNegativeSentiment = (NegativeSentiment * 100) / NumberRatings Or you could make this the next-to-the-last line an compute the moving average based on the Percent... at the end you might want to use | fields - NegativeSentiment or something like it to clean up the graph. You might consider removing the number of ratings as well, because the difference in scale may make the graph hard to read. You could always put total ratings on a separate graph... ... View more