I hate hardcoding dynamic things. Sooner or later those thing break. I have data with fields   ... forecast_2020=400, forecast_2021=500, forecast_2022=650, forecast_2023=800 ...   and in some search I need to use the correct forecast for the current year. What I could do is   ... | eval year=strftime(now(),"%Y"), forecast=case(year==2021, forecast_2021, year==2022, forecast_2022, year==2023, forecast_2023, 1==1, 0)   This definitely results in problems in 2024; by then I will have a field forecast_2024 but nobody will remember to update the search. I'd rather use something along these lines:   ... | eval year=strftime(now(),"%Y"), forecast=coalesce(forecast_{year}, 0)   However, the {} trick can only be used on the left hand side in eval. Is there any similar cool trick which works on the right hand side? ... View more

Can anybody enlighten me on why the form below (shortened) works when it's designed exactly this way, but not in any other? (using splunk 4.3.6) Specifically, in the <searchPostProcess> I wanted to use something like stats sum(r) as "requests" by $resolution$ or even move the whole second stats part into the <serachPostProcess> section, or use fields $resolution$ requests instead of spelling out all possibilities for $resolution$, but $resolution$ is not picked up in there. The same when trying with multiple searches, placing into each visualization will not pick up $resolution$ either. Bug in my thinking? Bug in the software? No bug at all? (Either way bugging me...) <form> <label>Longtime Statistics</label> <searchTemplate> index=xxx_xxxxxxx_app_summary search_name="summaryfill_longtime_statistics" | eval day=strftime(_time, "%Y-%m-%d") | eval week=strftime(_time, "%Y-wk%V") | eval month=strftime(_time, "%Y-%m") | stats count AS r dc(sessionid) as u sum(is_longrunning) as d by day, week, month | stats avg(r) AS avg_r avg(u) AS avg_u avg(d) AS avg_d sum(r) AS requests sum(u) as "unique sessionid's" sum(d) as "duration > 10s" by $resolution$ | eval "requests avg/day"=round(avg_r,0) | eval "unique sessionid's avg/day"=round(avg_u,0) | eval "duration > 10s avg/day"=round(avg_d,0) | rename search_documentation AS " 01) select index and search_name (from summary index filling search) 02-04) calculate a day, week and month fields used to segment by later on 05-09) create a statistics table with - total count of requests (r) - number of unique sessionid's (u) - total of requests with the longrunning flag set (d) by day, week and month identifiers (for further segmentation further down) 10-17) take the statistics table just produced and expand it with averages so it contains the following fields, by resolution (resolution is day/week/month as selected by radiobutton) - average of requests per day (avg_r) - average of unique sessionid's per day (avg_u) - average of longrunning requests per day (avg_d) - total number of requests (requests) - number of unique sessionid's (unique sessionid's) - total of requests with the longrunning flag set (duration > 10s) 18-20) the averages are floating point, but we want integers, so they are rounded " </searchTemplate> <fieldset autoRun="true" submitButton="false"> <input type="time" searchWhenChanged="true"> <label>Timerange:</label> <default>Year to date</default> </input> <input type="radio" token="resolution" searchWhenChanged="true"> <label>Resolution:</label> <default>monthly</default> <choice value="day">daily</choice> <choice value="week">weekly</choice> <choice value="month">monthly</choice> </input> </fieldset> <row> <chart> <searchPostProcess>fields month week day requests</searchPostProcess> <!-- chart options removed --> </chart> </row> <!-- remaining visualizations removed --> </form> ... View more