Hi Everyone, I need to migrate the report from sumo logic to splunk . In sumo logic report we have time compare option The compare operator allows you to compare current search results with data from a past time period for aggregate searches For eg : if you wanted to compare the behavior of backfill errors count with the span of 5min of events per hour  along with the timeshift 3min . it gives the count of events for every 5min along with the count at 3 min prior to that events .The compare operator allows you to compare current search results with data from a past time period for aggregate searches How to achieve this in Splunk ? Here is the sample sumo logic query  (_sourceCategory=app (error OR fail*) AND exception) | "Quote Sequences Error"as ALERT_DESC | _sourcecategory as SUMO_SOURCE_CATEGORY | "APP-PROD" as APP_ID | _sourcehost as APP_SERVER_NAME | _sourcename as APP_SOURCE_CATEGORY | _sourcecategory as SUMO_SOURCE_CATEGORY | timeslice 3m | count by _timeslice,APP_ID,APP_SERVER_NAME,APP_SOURCE_CATEGORY,SUMO_SOURCE_CATEGORY,ALERT_DESC | formatDate(_timeslice, "HH:mm:ss:SSS") as EventTime | if(_count > "100","1", if(_count > "50","2", if(_count > "3" and EventTime > "12:00:00" and EventTime < "05:00:00", "4", if(_count > "3", "3","0")))) as sumo_severity | format ("%s total errors in the last 3 minutes", _count) as notes | compare with timeshift 3m | if (isBlank(sumo_severity_3m) , "0", sumo_severity_3m) as sumo_severity_3m | where sumo_severity != sumo_severity_3m and !(isblank(sumo_severity)) | sort by _timeslice desc | fields - EventTime, EventTime_3m   ... View more

Hello, Splunkers!  Need help in finding the alternative to the append command. I have a data with 8 fields [say A,B,C,D,E,F,G,H] in one index, Out of 8 fields in which 6 fields have the same field values say [A=High, A=low, A=medium],[B=High, B=Low, B=medium].etc ,remaining 2 fields have the value of [true and false]. I need to count the field values with respect to the field. I achieved this using append, but it is taking too much time due to large data sets. Looking for an alternative solution. below is the sample query. index=Test | eval 1="A" chart count  over 1 by "A" append[index=Test | eval 1="B" chart count  over 1 by "B"] append[index=Test | eval 1="C" chart count  over 1 by "C"] ....... The output should be like this Field  High Low Medium TRUE FALSE A 10 3 2     B 8 4 3     C 8 7 0     D 8 0 7     E 8 3 4     F 9 2 3     G       5 10 H       7 8   ... View more