The following search gives me a table that contains the number of lines of code on the first of each month and calculates the number of lines changed over the month: index=foo date_mday="1" | dedup lineCount sortby +_time | sort -_time | delta lineCount AS linesChanged | fieldformat linesChanged=linesChanged*-1 | table _time date_month lineCount linesChanged This works great as long as there is a log generated on the 1st. I'm looking to add a condition that will add the log from that last day that one was generated if there was none on the 1st of the month. For example, there is no data for June because nothing was generated on the 1st (see attached picture). The last day that a a log was generated was May 30th, which I would like to include. I know that date_mday=1 filter will have to be dropped but don't know where to start otherwise. Any help would be much appreciated! ... View more

I have a transaction with mvlist set to true which results in a table where a number of fields display multiple NULL values: Col1 Col2 Col3 12345 NULL 1111 NULL XYZ 2222 NULL NULL 3333 Note: this is all 1 row I would like it filtered to the following: Col1 Col2 Col3 12345 XYZ 1111 2222 3333 In splunk docs I read that mvfilter in combination with isnotnull or !isnull functions can be used when you want to return only values that are not NULL from a multivalue field. Neither of these appear to work for me: y=mvfilter(isnotnull(x)) y=mvfilter(!isnull(x)) While this does: y=mvfilter(x!="NULL")) Any ideas on why the former doesn't work? Are there any performance differences between each method? ... View more

I'm looking to calculate the elapsed time between 2 events of different types that potentially share a common value but in a different field. The format is something like this: Event1: eventtype=export_start, selected_WO=XXXXXX Event2: eventtype=export_in_progress, period_WO=XXXXXX For successful exports, there will be an export_in_progress event that has a period_WO value matching export_start event's selected_WO value. I would like to be able to calculate the time elapsed between the export_start event and the export_in_progress event with the same value in their respective fields. Note: the events are different enough in format that both WO's couldn't be extracted using the same field What I have: index=... eventtype="export_start" | eval workorder=selected_WO | append [ search index=... eventtype="export_in_progress" | eval workorder=period_WO ] | stats count by workorder _time | sort - _time This gives me one long list of all workorder numbers that appear in either field and their timestamps sorted descending order. As an export times out after 30 seconds, my thought was to try and match duplicate workorder numbers within a 30 second time period and calculate the elapsed time. If this method is reasonable, some help on the last matching piece would be much appreciated. If there is a simpler method to accomplish the same thing, that would be even better! Thanks in advance. ... View more