This has been asked a million times. I've been digging through the various postings but haven't figured out what I'm doing wrong.  I'm able to do a search time extraction using the rex command to get a field exactly the way I want it. But then when I try to add it to the field extractors, it's including too much information. I need to extract the LINK_TARGET value from the event below but the USER details are also being included in the field extractor setup.  Hopefully my redactions don't make this impossible for gurus to assist. Search command:    index="index" search_term | rex field=_raw "LINK_TARGET\s:\s(?<link_target>.*)\n"     Data:   2021-11-10 16:03:14.631 INFO [blah] [Country=US] [User=user] [ip] [DefaultLynxMetricsLogger] [blah] [blah] Metrics logging start: key blah_SEARCH_ORIGIN LINK_TARGET : https://www.blah.com/en_US/blah?utm_source=copy&utm_medium=blah&utm_campaign=blah USER : 9999999 Metrics logging end     ... View more

Hi everyone, I have a very basic search outputting two types of entries into a field called "event". I need to get a count of each type per hour. I've been able to get the view I want using the pivot but don't really want to burden the system maintaining the data model if I don't need to. So here's my question: How can I create a table (assuming using stats) to show two rows (one for each type) and columns for each hour's total (descending)?   Desired format: Desired format using pivot Current output when I try to use stats:  Current stats output ... View more

I feel like an idiot because this should be simple. I'm trying to get a basic graph showing unique user logins per day for our Splunk Cloud environment. This search came from the "Utilization Monitor for Splunk" app and I thought it would be as easy as adding "by day" to the stats segment but that didn't work. index=_audit user!="splunk-system-user" user!="N/A" user=* host=* NOT (action=log* info=fail*) | stats dc(user) as "Splunkers" If I were the only user to log in and I only work mon-fri then I would expect the chart to be something like 0,1,1,1,1,1,0. Can someone please point out what I'm missing before I lose the little hair I have left? ... View more

I dump Splunk daily indexing into a summary index for long term retention and quicker searching. But now I'm trying to chart the data and I'm stuck trying to get the summed data to sort properly. Not a huge deal but does make it more visually appealing. Here's my search: index=corp_splunk_license_details day="12-11-2019" | eval Volume_gb = round(volume_gb,3) | chart sum(Volume_gb) as "Amount Indexed (GB)" by day, orig_index And here are my results: Here is an example of the raw events in the index as well: 12/11/2019 00:00:00 -0500, search_name=corp_splunk_license_index_per_day, search_now=1576130400.000, info_min_time=1576040400.000, info_max_time=1576126800.000, info_search_time=1576131051.720, day="12-11-2019", orig_index=index1, volume_gb="0.21123013552278280000000" I would really like to have the chart sorted from largest to smallest. Thanks for the help as usual! ... View more