I have the below sample data Groups Values G1 1 G1 2 G1 1 G1 2 G3 3 G3 3 G3 3 I am looking to sum up the values field grouped by the Groups and have it displayed as below . Groups Values Sum G1 1 8 G1 5 8 G1 1 8 G1 1 8 G3 3 9 G3 3 9 G3 3 9 the reason is that i need to eventually develop a scorecard model from each of the Groups and other variables in each row. All help is appreciated. thank You to all the splunk gurus here. ... View more

Hi I have the below data , and am trying to extract the below Start lsakjdf sdlkj sd CODE=CODE1 ksdjf ksajfd sakjdf Start $jdf$ ssfjdlkj sd CODE=CODE2 ksdjf ksajfd sakjdf Start lsakjdf CODE=CODE3 ksdjf ksajfd sakjdf Start lsakj44 sdlkj sdah sd CODE=CODE4 ksdjf ksajfd sakjdf CODE=CODE1 CODE=CODE2 CODE=CODE3 CODE=CODE4 ... View more

I have a question where in I have inputs as below in a file f1.csv JOB NAME Start_Time End_Time Job1 S11 Job2 S2 Job3 S3 Job1 S12 Job4 S4 Job1 E11 Job2 E3 Job3 E3 Job1 E12 Job4 E4 and when i run the below command on the data |inputlookup f1.csv |stats values(End_Time) as End_Time values(Start_Time) as Start_Time by "JOB NAME" i get the output as below JOB NAME End_Time Start_Time Job1 E11 S11 E12 S12 Job2 E3 S2 Job3 E3 S3 Job4 E4 S4 Whereas i am looking to create an output as below JOB NAME Start_Time End_Time Job1 S11 E11 Job2 S2 E3 Job3 S3 E3 Job1 S12 E12 Job4 S4 E4 ... View more

I am working on a monitoring tool where in I have to monitor the job completion and calculate the estimates in accordance. Till now I have kind of been able to capture the start and endtime of the jobs as below and have written them to a file as job_monitor.csv. I do this search repeatedly evey two minutes and append the relevant jobs. sl_no,JOBNAME,START_TIME,END_TIME 1,S3,,15.51.42 2,S2,,15.21.35 3,J3,,14.52.28 4,J2,,14.51.22 5,S1,,15.01.28 6,J1,,14.31.02 7,S3,15.21.42, 8,S2,15.01.34, 9,S1,14.51.28, 10,J3,14.51.28, 11,J2,14.31.22, 12,J1,14.30.02, Once the above details are captured, I am looking to convert this into a below format. There could be jobs with same JOBNAME, but two jobs cannot run in parallel, ie , if there is an entry for start_time , then the next End_time is relevant to the same job itself. I am not able to map these to look as below. sl_no,JOBNAME,START_TIME,END_TIME 1,S3,15.21.42,15.51.42 2,S2,15.01.34,15.21.35 3,J3,14.51.28,14.52.28 4,J2,14.31.22,14.51.22 5,S1,14.51.28,15.01.28 6,J1,14.30.02,14.31.02 Any guidance would be appreciated. Thank You in Advance to all here. ... View more

Hi All, I have a question that I am trying to solve … I have two files which I can upload to be used as inputlookup.csv Sample as below tab1.csv Date Col1 Col2 Col3 Col4 Col5 1-Jan-18 Y N N N N 2-Jan-18 Y N N N N 3-Jan-18 Y Y Y Y Y 4-Jan-18 Y Y Y Y Y 5-Jan-18 Y Y Y Y Y 6-Jan-18 Y Y Y Y Y 7-Jan-18 Y N N N Y 8-Jan-18 Y N N N Y 9-Jan-18 Y Y N Y Y 10-Jan-18 Y Y Y Y Y tab2.csv Date Col1 Col2 Col3 Col4 Col5 1-Jan-18 Y N N N N 2-Jan-18 Y N N N N 3-Jan-18 Y Y Y Y Y 4-Jan-18 N Y Y Y Y 5-Jan-18 Y Y Y Y Y 6-Jan-18 Y Y Y Y Y 7-Jan-18 Y N N N Y 8-Jan-18 Y N N N Y 9-Jan-18 Y Y Y Y Y 10-Jan-18 Y Y Y Y Y I am looking for a way to join these two tables and sort the areas where there is a change as below Date Col1 Col2 Col3 Col4 Col5 Output 4-Jan-18 N 9-Jan-18 Y |inputlookup tab1.csv |lookup tab2.csv Date Col1 Col2. this gives me a complete set of results along with the mismatched columns. How can i remove all except the mismatched columns. thank You in advance. ... View more

I have such a ‘savedsearch’ and I would want to pass on 3 variables into the query when I select an option from the dropdown menu. For Example – When I Select Option 1 – I should be able to run the below query with CODE1=A1 CODE2=B1 and CODE3=C1 Option 2- I should be able to run the below query with CODE1=A2 CODE2=B2 and CODE3=C3 The below query is saved as Mismatch_Report index=myindex MFSOURCETYPE= $code1$ | append [search MFSOURCETYPE ="code2$" ] | replace "DATA" with "" in DATA as DATA | replace "," with "" in DATA as DATA |replace "." with "-" in DATA as DATA | replace $code1$ with "Neighbour Dates" in MFSOURCETYPE as MFSOURCETYPE | replace "$code2$" with "My Dates" in MFSOURCETYPE as MFSOURCETYPE | table DATA MFSOURCETYPE | dedup DATA MFSOURCETYPE | chart count over DATA by MFSOURCETYPE | foreach * [eval "<>"=case('<>'=0,"Not in list ", '<>'=1,"Matched ",true(),'<>') ] | eval keep="Y" | foreach * [eval keep=if('<>'="Not in list ","N",keep)] | where keep="N" | fields - keep |eval country = "$code3$" | eval _status = "Non Matched Row" Also I have the below query – eval_codes |eval app=case($REGION$ = "VAL1","MF11", $REGION$ = "VAL2" ,"MF12", 1==1,"0") |eval ca7=case($REGION$ = "VAL1","MF21 ", $REGION$ = "VAL2" ,"MF22", 1==1,"0") |eval ctry=case($REGION$ = "VAL1","N1", $REGION$ = "VAL2" ,"N2", 1==1,"0") Dashboard as below, and my intention here is to take the user input via the dropdown and then evaluate the codes as per in eval_codes and then send then re-use them in savedsearch Mismatch_Report <input type="dropdown" token="REGION" searchWhenChanged="true"> <label>Select a User:</label> <default>CBS</default> <!-- Define the choices in code --> <choice value="VAL1">OPT 1</choice> <choice value="VAL2">OPT 2</choice> </input> <panel> <title>COUNTRY CALENDAR</title> <table> <search> <query> |savedsearch eval_codes REGION=$REGION$ |append [search savedsearch Mismatch_Report appcode=app ca7code=ca7 ccntry=ctry] </query> </search> </table> </panel> ... View more