Hi all, I have some value under geologic_city fields as below, but it has some problems. For example, actually Anshan and Anshan Shi is the same city, and i have multiple cities have this issue. I want to remove all "Shi" if the string has. Can anyone help me on this? Thanks ... View more

Hi all, I have a saved search which is directly extracted from the database, the date formate is like below: 13:02:01 2016-03-28, now i want to extract the date and only display those records for yesterday, but nothing happened when I create a new column with below search: |savedsearch ** |eval day=strftime(date,"%Y-%m-%d") |eval now=strftime(now(), "%Y-%m-%d") |eval time_interval=now-day |where time_interval="1" The problems is that "day" field can't be created using this, it seems that strftime function can't works on saved search or something. I also tried another search to extract date, but it also failed, "complete_day" could be created and display as "2016-03-28" for instance, but when I create time_interval, it can't be calculated as a number. |savedsearch rt_visits |eval temp=split(date," ") | eval complete_day=mvindex(temp,1) |eval nowstring=strftime(now(), "%Y-%m-%d") |eval time_interval=nowstring-complete_day Can anyone help me on this question? Thanks a lot. ... View more

Hi all, I want to convert a table for further calculation, there are two columns and they came from different part and join by appendcols command. database_count is a standard number in my database, which is directly extracted from database and then saved as a saved report. Now I want to compare the difference in each hour of real working number. After run my search, my result is as displayed, but it only has a standard number in the first row. What I want is to fill all the rows with that number, so later I can calculate the difference by each hour. Please kindly help. thanks. What I want: hour current_reporting database_count 00 33 494 01 25 494 02 19 494 03 15 494 My search: NOT Reference |eval hour=strftime(_time,"%H") | stats values(name) as name_values by hour | stats dc(name_values) AS current_reporting by hour |appendcols [|savedsearch monitoring_data|search tags="*" | stats dc(name) as database_count] ... View more

hi all, i have one filed called value, it is a value like : 1006718, but it contains two information, 10067 is the real score, 18 is another filed called steps. May i know how can I separate this value into two fields, one is called real_value, another is called move_steps? my search: (label="Score*") value |stats count(_raw) by value |rename value AS Score my result: Score 1006718 ... View more

hi all, May i know if there is a function to get the system current weekday ? for example, the system time ="2015-09-09 10:00:00" but what i want is wednesday,because i just want to show those results. my thing command: where weekday= relative_time(now(),"%A") , but it is not working, currently i just use where weekday="@w3" in command, but till tomorrow, i need change it to Thursday manually. that is why i want to get the system current weekday, so it can change automatically. Please kindly help this, thanks Best Regards ... View more

Hi all, i want to calculate and display percentage for each category not the records, based on below search , i can get the result of records number, but i want to display as percentage, could you pls kindly let me know how to calculate? Thanks **|stats count as count by Q |addtotals col=t row=f labelfield="Q" label=all result: Q count A 220 B 387 C 228 D 247 E 268 all 1350 ... View more