This worked well. Last question: If i wanted to ensure the single record that i find only comes from search 1 and not from search 2. how would i do that. Thanks again Todd ... View more

Make your selector token "24hour", "7day", etc. Let's call it $span_tok$. This should do. index=myindex earliest=-$span_tok$-$span_tok$ | timechart span=$span_tok$ count | streamstats delta(count) as pct_change | eval pct_change = pct_change / (count - pct_change) * 100 The idea is simple, look back 2x $span_tok$, then calculate delta on the go.  ... View more

worked great, thanks! ... View more

Hello I will mark your comment as the answer, Im sure its something thats caused by us and not Splunk. Not sure why though. It still deletes all apps that arent deployed via the deployment server, including the default apps. This may not work for my sue case but I thought it would so it was worth trying. Thanks for the assistance ... View more

I suggest you check the following Splunk answer: https://answers.splunk.com/answers/105292/what-is-the-cause-of-these-socket-errors-reported-in-splunkd-log-since-upgrading-to-6-0.html I'd then check your splunkd.log logs for anything mentioning a limit being hit or something that might help explain that behaviour (probably for the HTTPListener component). As a last resort, you might want to do a network trace (Wireshark, NetMon, etc...) with or without the help of your network team. That should help you see what is happening from the network side and might help direct where to look for the issue's root cause next. ... View more

@tkwaller_2 if you use either scheduled search or dashboard there would be possibility to add Custom Logo. Any reason why either one of these can not be used? Scheduled Report can be used to enable Embedding and then you can create your own web page with your custom logo where report can be displayed. ... View more

it would be easier to help if you shared your query ... View more

No worries, thanks for accepting the answer ... View more

yep that worked, I just added "|fields Status" and then made it into a single value panel. Thanks for the help! ... View more

@tkwaller_2 Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting! ... View more

You need to do the relative_time(datefield,"@d") on both sides of the lookup. Also, there's a basic issue you might run into with "it's the Fourth of July holiday WHERE"? The records are stored in UTC, (which we'll pretend for the moment is London's time zone.) If a user is viewing the search in, say, San Francisco, then the interface may choose to determine what date/time the record occurred in San Francisco, or might not, depending on how the search and the system are set up. So, if converting the other dat field doesn't do the trick, then before you do any more the conversion and testing in the above search, you need to determine precisely how the data is stored and precisely how the system is interpreting relative_time( sometimefield,"@d"). ... View more

My only concern was with the data that was already there but it backfilled/reindexed just fine Thanks again ... View more

@somesoni2 Here's What I have to fix but haven't yet figured out how. In this search index=dev_tsv "BO Type"="assessments" |dedup "Workflow Name" "Workflow Phase" "Workflow Process Due Date" "Workflow Process Name" "Workflow Process Sort Order" "Workflow Started Date" "Workflow Step Name" "Step Due Date" "Workflow Step Sort Order" | table "Workflow Name" "Workflow Phase" "Workflow Process Due Date" "Workflow Process Name" "Workflow Process Sort Order" "Workflow Started Date" "Workflow Step Name" "Step Due Date" "Workflow Step Sort Order" | convert timeformat="%Y-%m-%d %H:%M:%S.%6N" mktime("Step Due Date") AS cumulativeDueDate | eval dueDateRange=mvrange(cumulativeDueDate,now(),86400) | mvexpand dueDateRange | convert ctime(dueDateRange) timeformat="%+" | where NOT match(dueDateRange,"(Sun|Sat).*") AND NOT [ | inputlookup exclude_holidays | eval holiday_date=strptime(holiday_date, "%Y-%m-%d %H:%M:%S") | rename holiday_date as dueDateRange | eval dueDateRange=strftime(dueDateRange, "%+") ] The initial value of dueDateRange here is formatted like "%Y-%m-%d %H:%M:%S.%6N" after input lookup it is "%Y-%m-%d %H:%M:%S" but the "%H:%M:%S" portion is always "00:00:00" so I don't think they are being excluded as the fields in the actual data have valid "%H:%M:%S" for example: "2018-07-04 07:51:25.966000" Any thoughts on how I can get this to work by not using the time inside the inputlookup value? Is it possbile to wildcard there? ... View more

@tkwaller_2 - if your issue has been solved, please accept the answer that solved it. Feel free to upvote any answers or comments that you found particularly helpful as well, on your own or other people's questions. ... View more

In was hoping this woudl work but it did not: | stats count(compMonth) as compMonth count("Projected Completion Date") as "Projected Completion Date" by values(compMonth) values("Projected Completion Date") AssessmentName RiskRank "Workflow Phase" "Workflow Process Name" "Workflow Step Name" stepStatus ... View more

For the win. I used the wrong search command. Thanks again ... View more

You could also use streamstats to set the last value of a field which gets passed on to the next event. Then you could use the value of that field if Status == "Not Started". Here is an example of using streamstats in this way. sourcetype="apache:access" action=* | streamstats current=f window=1 global=f last(action) as lastaction | where action != lastaction ... View more

Your stats command was destroying the field QF . Any field not listed in a stats command is gone. your base search | eval Compliant= case(QuestionAnswer == "Yes", 1) | eval NonCompliant= case(isnull(Compliant), 1) | stats count(status) as total, count(Compliant) as compliant, count(NonCompliant) as noncompliant by QF | eval risk= round(100*compliant / total,0) | chart values(risk) over LOB by QF Also, since you are not using Noncompliant in your chart, this simplifies to... your base search | eval Compliant= case(QuestionAnswer == "Yes", 1) | stats count(status) as total, count(Compliant) as compliant, by QF | eval risk= round(100*compliant / total,0) | chart values(risk) over LOB by QF ... View more

Good that it resolved. ... View more

OK I can see now what you mean, since its taking the most recent record and deduping BEFORE getting the info_tag its reduces the overall count. That makes sense. Thanks for that ... View more

Please dont think that Im upset haha Im not at all. I really just used this as a test while I was trying to figure out whether the issue I was having was on my end or not. Like I said, it told me it didnt post this due to timeout, which is totally fine, you can even delete it. ... View more