Hi all, I have some value under geologic_city fields as below, but it has some problems. For example, actually Anshan and Anshan Shi is the same city, and i have multiple cities have this issue. I want to remove all "Shi" if the string has. Can anyone help me on this? Thanks ... View more

Hi all, I have a saved search which is directly extracted from the database, the date formate is like below: 13:02:01 2016-03-28, now i want to extract the date and only display those records for yesterday, but nothing happened when I create a new column with below search: |savedsearch ** |eval day=strftime(date,"%Y-%m-%d") |eval now=strftime(now(), "%Y-%m-%d") |eval time_interval=now-day |where time_interval="1" The problems is that "day" field can't be created using this, it seems that strftime function can't works on saved search or something. I also tried another search to extract date, but it also failed, "complete_day" could be created and display as "2016-03-28" for instance, but when I create time_interval, it can't be calculated as a number. |savedsearch rt_visits |eval temp=split(date," ") | eval complete_day=mvindex(temp,1) |eval nowstring=strftime(now(), "%Y-%m-%d") |eval time_interval=nowstring-complete_day Can anyone help me on this question? Thanks a lot. ... View more

Hi all, I want to convert a table for further calculation, there are two columns and they came from different part and join by appendcols command. database_count is a standard number in my database, which is directly extracted from database and then saved as a saved report. Now I want to compare the difference in each hour of real working number. After run my search, my result is as displayed, but it only has a standard number in the first row. What I want is to fill all the rows with that number, so later I can calculate the difference by each hour. Please kindly help. thanks. What I want: hour current_reporting database_count 00 33 494 01 25 494 02 19 494 03 15 494 My search: NOT Reference |eval hour=strftime(_time,"%H") | stats values(name) as name_values by hour | stats dc(name_values) AS current_reporting by hour |appendcols [|savedsearch monitoring_data|search tags="*" | stats dc(name) as database_count] ... View more

hi all, i have one filed called value, it is a value like : 1006718, but it contains two information, 10067 is the real score, 18 is another filed called steps. May i know how can I separate this value into two fields, one is called real_value, another is called move_steps? my search: (label="Score*") value |stats count(_raw) by value |rename value AS Score my result: Score 1006718 ... View more

hi all, May i know if there is a function to get the system current weekday ? for example, the system time ="2015-09-09 10:00:00" but what i want is wednesday,because i just want to show those results. my thing command: where weekday= relative_time(now(),"%A") , but it is not working, currently i just use where weekday="@w3" in command, but till tomorrow, i need change it to Thursday manually. that is why i want to get the system current weekday, so it can change automatically. Please kindly help this, thanks Best Regards ... View more

Hi all, i want to calculate and display percentage for each category not the records, based on below search , i can get the result of records number, but i want to display as percentage, could you pls kindly let me know how to calculate? Thanks **|stats count as count by Q |addtotals col=t row=f labelfield="Q" label=all result: Q count A 220 B 387 C 228 D 247 E 268 all 1350 ... View more

hi all, I want a new column which calculates the percentage change over a month. In the below snapshot, the change rate should equal to the diff/sum of last month. One example is percentage=41703/299981 . however, if I add a new command behind : |eval percentage=round(dif/sum,1) , it will calculate by 41703/341684, which is not correct. could any one help me out of this? thanks in advance. ... View more

Hi all, I have below data extracted from splunk: 2015-02 1000 2015-03 1340 2015-04 1600 2015-05 2000 I want to calculate and display my deviation number for every month, could any one guide me how to calculate it? for example, the deviation of the first and second month is :(1340-1000)/1000, the deviation of second and third is (1600-1340)/1340 my current search is below: ** | chart sum(sum_count) as "Number of count" by month Thanks in advance ... View more

Hi all, May i know if there is any way to change the colors of the bars in this screenshot? I want the grey part to display on the bottom, and the orange part should be on top. Can I do this by modifying the Simple XML? Thanks in advance ... View more