@woodcock, I tried your solution, combined with what I have: index=csl_dblogs | rename TRUNC_CREATION_TIME as Date | rename SOURCE_SYSTEM_NAME as Source_System| eval Date=strftime('Date', "%m-%d-%Y") | chart values(COUNT) over Source_System by Date | addtotals fieldname=Total | eval 5_Day_Avg=round(Total/5) | fillnull value=0 | addtotals row=true| addtotals col=true | eval prev=0 | foreach *2015 [ eval <<FIELD>>_changePct=100*((<<FIELD>>-prev)/prev) | eval prev=<<FIELD>>] So it sort of works, but I only need 1 specific column that displays %Difference based on "Today's Date -1"(Excluding Weekends). So for today, the difference (1 column) would show for all systems where the date is Nov 6. ... View more

I am required to show the days in that format unfortunately. ... View more

I reazlized the problems is that after running the Chart command, I couldnt see anymore fields so I worked backwards to extract eachfield I needed. The problem is I can't seem to use or add these fields. index=csl_dblogs | rename TRUNC_CREATION_TIME as Date | rename SOURCE_SYSTEM_NAME as Source_System | eval Date=strftime('Date', "%m-%d-%Y") | eval t2=relative_time(now(), "-2d@d" ) | eval t2=strftime('t2', "%m-%d-%Y") | eval today_count=if(Date>=t2, COUNT, 0) | eventstats avg(COUNT) as Average sum(COUNT) as Sum by Source_System | eval ten_Day_Avg=round(Sum/10) | eval Diff=((ten_Day_Avg-today_count)/ten_Day_Avg)*100 | chart values(COUNT) as Vals over Source_System by Date So how can I add additionals Column fields afer using a Chart or Stats command? ... View more

Hi woodcock, thanks for your answer. I was able to modify my query but am still having touble with the % Difference. The query is below but I need a need the "Difference" column to work as such: 100*((5_Day_Avg-Current_Day/5_Day_Avg)). The Current Day being today's date, and then calculating when tomorrow is the new current date. I tried an if statement for eval, but can't seem to quite figure out why it wont work. index=csl_dblogs | rename TRUNC_CREATION_TIME as Date | rename SOURCE_SYSTEM_NAME as Source_System| eval Date=strftime('Date', "%m-%d-%Y") | chart values(COUNT) over Source_System by Date | addtotals fieldname=Total | eval 5_Day_Avg=round(Total/5) ... View more

So the dbquery output is 3 columns : Creation_Time Source_System Count 10/2/2015 ADP 2483 10/2/2015 CSL 10039 10/2/2015 DIVP 2032 10/2/2015 RECON 7 10/2/2015 SHRS 621 10/2/2015 T24 587 10/2/2015 TPE 64702 10/3/2015 ADP 2519 10/3/2015 CSL 138 10/3/2015 DIVP 420 10/3/2015 TPE 3 It shows like this in the database and when I run the query into Splunk before adding or making any additonal changes to it. ... View more

Thanks! I was just reading up on the possibilities of regex with setting a match when I saw this. ... View more

This worked when I plugged it in and tweaked a bit. Thanks! ... View more

Below are some log examples: Fri Jul 17 14:22:15 2015 0 139.149.36.161 10032 /sbclocal/InternalSecureFileTransfer/users/ETDIT/gmiprod2skctest/chi/global_idt/comm/idts_00104.zip **b s i r** gmiprod2skctest ssh 0 * Fri Jul 17 11:28:10 2015 0 localhost 0 /sbclocal/InternalSecureFileTransfer/users/ETDIT/gmi_test_ftp/gmi_to_skc/gmi/SKCU02/asia_memo/account_types.zip **b n p r** gmi_test_ftp folder 0 * Fri Jul 17 11:03:29 2015 8 151.191.80.226 3341520 /sbclocal/InternalSecureFileTransfer/users/ETDIT/tpt_ftp_test/outbox/rexuat/ldn/GMI_OBS_IRSCME_POS_20150716.txt **a n i r** tpt_ftp_test ftp 0 * Fri Jul 17 11:03:29 2015 1 rex_ldn_uat1_cmp.ldn.swissbank.com 3341520 /sbclocal/InternalSecureFileTransfer/users/ETDIT/tpt_ftp_test/outbox/rexuat/ldn/GMI_OBS_IRSCME_POS_20150716.txt **a s o r** tpt_ftp_test ssh 0 * It allows me to extract the combinations as individual characters into a field until I add I add the character "b". Also I was wondering if there is a way to extract different combinations(as shown in examples) and the single characters of the combos all into one field? I have a regex that pulls all combinations now. I just wanted to combine them. index=gfs_etd_mft source="/opt/TMWD/SecureTransport/var/logs/xferlog" | rex field=_raw "(?i)\..*? (?P<FIELDNAME>\w+\s+\w+\s+\w+\s+\w+)\s+\w+" | dedup FIELDNAME | table FIELDNAME ... View more