Edited after I learned to read: You should be able to use the replace function for this:   | where customer="foo" AND like(Register,replace("$tok_reg_num$", "\*", "%"))   Original Reply: Try using searchmatch in your where statement.  It will take a regular SPL search statement and is compatible with the asterisk as the wild card.   | where customer="foo" AND searchmatch("Register=\"$tok_reg_num$\"")   ... View more

Right now you have the optional closing quote inside of your capture parenthesis. Try moving it outside with something like this: operation="?(?<operation>[^\,"]+)"?, See the working example here: https://rubular.com/r/KvJKsg4drQl51V ... View more

Try this: | makeresults | eval user="qwerty\foo" | eval ruser=replace(user,"\\\\","\\\\\\\\") In SPL, the escape has to be escaped so everything doubles. If you want to find a backlash, you would normally look for \. But in SPL you have to escape your escape: \ and then escape the backslash you are trying to find with another \. https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/SPLandregularexpressions ... View more

Are you trying to get the average for the previous month or the last ~30 days? For example, are you looking for June or June 16 - July 16? The easiest would be to pick your actual time range from the Time Picker controls. Taking your examples, you most likely want to do something like you specified: earliest=-1mon latest=now . But make sure this is doing what you want. You are telling Splunk to return the data since June 16th starting at the current time. If instead you want the previous month, you can do this instead: earliest=-1mon@mon latest=@mon . This will search for data between 2019-06-01 00:00:00 and 2019-06-30 23:59:59. bucket _time span=1mon is not going to do much for you unless your also include the _time in your stats command: | stats avg(sent_data) as sent_data avg(received_data) as received_data, values(SITE) as SITE by _time, USERNAME This will round each time stamp down to the first of each month. If you are trying to get the last 30 days, this won't quite do what you want. It will also depend on the time range specified. ... View more

You are REALLY close on this one. In a condition match, you need to wrap string values like "green" in quotes. The caveat is that they need to be sanitized quotes since the statement is already in quotes. It should look something like this: <condition match="$result.ManagedEntityStatus$ == &quot;green&quot;"> Otherwise it is looking for the ManagedEntityStatus field to match another field named green ... View more