There are no data on Mondays so my timecharts always dip to 0.   {search string} | eval date_wday=lower(strftime(_time,"%A")) | where NOT (date_wday=monday) | timechart span=1d count by ColName   Is there any way to make the timechart skip Mondays (not just set it to 0)?  ... View more

My current search is:   index=rtm* source=/prod/msp/logs/private-auto-loan-credit* | regex "The rule (?<field1>[a-zA-Z0-9]+_[a-zA-Z0-9]+)_(?<field2>[a-zA-Z0-9]+) with" | table field1, field2   In verbose mode, it finds the correct entries, but my table is full of nulls. What am I doing wrong?  ... View more

I need to do one search with value A in the logs to get value B, then search on value B in another, independent search to get other information. How do I do this in Splunk (ideally without a join)? ... View more

I'm currently running the query (changed to a dog-themed query) where I want to join two logs together by the Dog's name and end up getting the dog's id: search "something within logs" | join dog_name_field [search "Dogs Name: "]| table "dog_id" I want another column in the table, which is a subset of the results of the above search, where I get a true or false on whether or not that id belongs to a Golden Retriever. To get the id's for the golden retrievers, I can do something like: search "something within logs" | join dog_name_field[search "Dogs Name: " AND "Golden Retriever"]| table "dog_id" How do I get the ids of all the dogs and have another column saying whether or not that dogs is a golden retriever efficiently. ... View more

I have 3 fields: "Runtime_A", "Runtime_B", and "guid". My current query is: search | chart values(guid) AS "Guid", values(Runtime_A) AS "Total Runtime", values(Runtime_B) AS "Partial Runtime" My graph is empty, and there is only one xvalue in the xaxis and its a comma seperated list of all the guids. What's wrong with my query? ... View more

I have 3 extraction fields: "guid", "runtime_general", "runtime_specific" . There is also a value "A" that I will search to get the values I need. I want to overlay runtime_general and runtime_specific (y-axis) and have the x-axis be guid . I have two pertinent log types: 1) "A: guid, runtime_general" where A is always the same (as I'm searching on A) 2) "guid, runtime_specific" How do I chart all the guids I get by searching for value A, and overlay it with both runtimes? I'm very unfamiliar with Splunk so any help would be appreciated. ... View more