Hi all, I was preparing my data to be visualised. However, I met with a challenge. The below is an extract of my data: My desire output would be: Note that the key value is dynamic, there could be 10 to 20 numbers of keys. Anyone has any idea to achieve this? Thanks in advance! ... View more

Hi all, I had been using splunk for a period of time. However, I notice that the performance started to degrade as more indexes are added. Do anyone have any recommended script or steps that i can do daily to improved performance. I had search through this forum, there are many recommendation but mostly are specific to an issue. I am asking for some sort of general maintenance for splunk. Thanks in advance. ... View more

Hi, I had been wanting to change events that are unique over month but to no avail. I will give an illustration below: ''month'' ''event'' ''1'' ''a'' ''1'' ''b'' ''1'' ''c'' ''2'' ''a'' ''2'' ''c'' ''2'' ''z'' ''2'' ''d'' ''2'' ''z'' ''3'' ''a'' ''3'' ''z'' ''3'' ''b'' ''3'' ''g'' ''3'' ''h'' ''3'' ''u'' ''3'' ''z'' ''3'' ''b'' assuming the index=someIndex index=somIndex | timechart dc(event) as ''Unique new count'' by month give you: ''month'' ''Unique new count'' ''1'' ''3'' ''2'' ''4'' ''3'' ''6'' The result I want would be: ''month'' ''Unique new count'' ''1'' ''3'' ''2'' ''2'' ''3'' ''3'' Any one can help? ... View more