Finally here is my query which i want; <base search> | timechart span=1h count(REQUESTNAME) by ilce usenull=f useother=f | eval Time=strftime(_time,"%H:%M") | table Time,* | untable Time Xaxis Yaxis | xyseries Xaxis Time Yaxis Fyi.. ... View more

Hello, I changed the query but i doesn't work; <base search> | timechart span=1h count(REQUESTNAME) by ilce |transpose | addtotals |fields- Total |transpose header_field=column |fields -column   ... View more

Thank you for suggest but i can't found, how can i put the _time to x axis command.. Regards. Final search; <base search>  | timechart span=1h count(REQUESTNAME) by ilce |sort -count  Also i need to set threshold value like count >3 in this scenario.   ... View more

I want count events for each hour so i need the show hourly trend in table view. Regards. ... View more

I'm creating a report ( save as search results as a Report) and scheduling "send mail" like inline table, if it not possible may be attached file fine for me. Regards. ... View more

Hi,  - search | extract reload : didn't work - Server restart : didn't work - splunk show config props : I didn't try, i'm waiting for admin return because is enterprise product. Thank you for suggests Regards. ... View more

Hello, Now, i have some changes but still i can't list with lookup file's value; <base search> |eval user_info=host."".Huawei_int |lookup fttb_user.csv ipport as user_info OUTPUT user |search user_info=10.58.35.144GigabitEthernet0/0/7 | stats count by Date,user_info,Huawei_status | sort -count |where count>6 Stats without user field;   Stats with user field; lookup csv file;   ... View more

Sorry, i can't list with user info, i need lookup syntax which is check ip and port from lookup file. How can i do this with correct lookup syntax? I should check 2 multivalue field and than add to user info. I hope, understand. <base_search>  | lookup list.csv ip as host AND port as if_name OUTPUT user |stats count by host,if_name,user ... View more

Exactly, so highleted with red. if match host and if_name with lookup file, then list user info. Regards. ... View more

King regards , thank you again. ... View more

Hello  , It is working which i want but latest solution is more effortless and same result. just only adding | sort ONT. So i will accept this. Thank you very much, you are very kind.   Regards. ... View more

Hmm, you are right. Thank you for attention. Just only OLT_Port field values sorting without other mvalues fields. This is problem. Regards. ... View more

King Regards, it's ok now. Also thank you for all other replays.   I love this community. 🙂 ... View more

Sorry, i couldn't. Here is the real search query and result. I want the group or sort OLT_Port values; <base search> |rex field=ONT "^(?P<ONT>........)" | stats count as Toplam_Sikayet list(Saat) as Saat list(ONT) as OLT_Port list(H) as Hizmet_ID list(REQUESTNAME) as Sikayet by Date,OLT |sort -OLT_Port | where Toplam_Sikayet >= 10     ... View more

these are port numbers and i want sort port with same numbers, like this, 0/1/0/0 0/1/0/0 0/2/1/1 0/2/2/1 0/2/2/1 Regards. ... View more

this view also sort port but it is not sorting . ... View more

you are amazing, works fine. Thank you very much   I love splunk community.. ... View more

Thank you for answers. So, more details for this; I have lot of network devices and subscribers. So, i want to analyse subscriber compliants. When the total subscriber compliants count reach to 10 number by each device, than list. my field details; OLT=Network devices H = Subscriber IDs REQUESTNAME = Subscriber compliant types index=decoder M=NetworkMapDataInit C=GPONChecker OLT="*" | eval Date=date_month." ".date_mday | dedup H,U,S | join H,U,S type=inner [search index=decoder M=WF_CrmRequestAndNetflowTask C=OVERLAY P=checkResult NetflowResultMsg1=NetflowTaskCreated | dedup H,U,S ] | stats count by Date,OLT,H,REQUESTNAME   ... View more

Yes, i want to list , multi-value field B and want to count items within the field. Should i use stats command before ? I try this but not works for me; search | where mvcount(B)>3 | sort - A   ... View more

now i'm trying something like this;   search | stats count(B) by A,B |sort -A |where sum(count(B))>3 ... View more