The Result is false even though the fields are empty. Looks like Splunk does not consider these fields as NULL 😮 ... View more

Weird!! Still the same 😞 ... View more

Thanks a lot @tiagofbmm It worked 🙂 However the last line does not seem to work. I receive one or 2 lines with RunID and StartTime as NULL. What could be the reason. ... View more

Hello @tiagofbmm I have executed your search query and the result I have extracted to a CSV and it's screenshot "result.jpeg" has been attached to the question now. Please refer to that. The count is coming as 1 only even though the EndTime field has multiple values. Thanks ... View more

1 is assigned to all the fields, even though they have multiple values (like the ones in attached screenshot). ... View more

Hello @tiagofbmm, It doesn't work 😞 First the null fields are not removed and the mvcount is assigned to these MultiValue Columns also and they are also getting displayed in the final output. Earlier also I tried removing the nulls, but for some reason it is not removing. ... View more

Thanks a lot @elliotproebstel. It worked 🙂 ... View more

Hello @elliotproebstel I have tried using Transpose earlier. However it is not showing the complete results. Some of the sources and months are missing in the final result and that is the reason I went for xyseries. Using Transpose, I get only 4 months and 5 processes which should be more than 10 each. Thanks ... View more

Very simple. Pity I didn't even think of it 😞 Thanks @chitturics. ... View more

Hello @cmerriman Below is a sample event which is a successful one. If the EventCode is 2222, it is to be considered as a failed one. 02/21/2018 01:12:43 PM LogName=Microsoft* SourceName=Microsoft* EventCode=1111 EventType=4 Type=Information ComputerName=abcd.local User=NOT_TRANSLATED Sid=S** SidType=0 TaskCategory=The operation completed successfully. OpCode=Info RecordNumber=xxxx Keywords=None Message=Remote Desktop Services: User authentication succeeded: User: Domain: Source Network Address: 1.1.1.1 Collapse host = hostname1 source = WinEventLog:* sourcetype = WinEventLog* Do I need to use the makeresults option for all the separate hosts, we have around 20. Is there any other way? And also when I tried the sample code given by you, the counts I am getting is 1 for all the hosts and EventCodes even though the actual results are more than 600. Could you please check what is wrong with the code 😞 Thanks Maria Arokiaraj ... View more

You're Awesome @somesoni2. Thanks a lot. It worked 🙂 ... View more

This still doesn't work as expected @somesoni2. _time Expected timesran change 2017-05 78132.59 77359 1 2017-06 53189.63 52663 -32 2017-07 29365.8 43185 -18 2017-08 14549.26 17743 -59 2017-09 12291.39 29979 69 2017-10 59391.67 35143 17 2017-11 53966.25 46125 31 2017-12 59421.6 45360 -2 2018-01 71246.98 72701 60 The Expected is not calculated with Previous line's Timesran and Percentage. The 2017-05's timesran+(timesran*change/100) should the Expected for 2017-06. 2017-06's timesran+(timesran*change/100) should be the Expected value for 2017-07 row. Very sorry that I did not explain it clearly in my previous comments 😞 Please help. Thanks Maria Arokiaraj ... View more

Hello @somesoni2 Looks to be a small syntax issue. There was an error ) is missing, hence I added it like in below line. | eval change=if (isnull(prev),1,round((timesran-prev)*100)/prev,0)) Now the error is The arguments to the 'if' function are invalid. I tried to find the root cause but for me everything seems to be proper. Can you find the root cause? Thanks ... View more

@somesoni2 & everyone Is there any way in Splunk to achieve my above requirement? Please help! Thanks ... View more

Hello @somesoni2 I am still getting the same old results 😞 I have added change field in the result table to explain you more in detail. _time Expected timesran change 2017-05 78132.59 77359 1 2017-06 35810.84 52663 -32 2017-07 35411.7 43185 -18 2017-08 7274.629999999999 17743 -59 2017-09 50664.509999999995 29979 69 2017-10 41117.31 35143 17 2017-11 60423.75 46125 31 2017-12 44452.8 45360 -2 2018-01 116321.6 72701 60 In the above table every line's Expected is calculated with the timesran and the same row's change. I need it to be calculated with it's previous row's change. For eg, for 2018-01 row the Expected is 116321.6 because the timesran is calculated with change 60 which is on the same row. It is a change from previous timesran. What I need is, the timesran to be calculated from the previous month's -2. The same way for all other rows. Is it possible in any way? Thanks Maria Arokiaraj ... View more

Hello @elliotproebstel This does not seem to be working 😞 Not getting any results when using these commands. ... View more

Thanks a ton @micahkemp. Got the results 🙂 Finally understood the logic behind it. ... View more

Hello @micahkemp I have a restriction here to display some set of sources and only their first five characters. Hence I have updated the source for the checkbox like below. <input type="checkbox" token="source" searchWhenChanged="true"> <label>Source</label> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search> <query>sourcetype=ROI | where source like "GS01%" OR source like "CIS%" OR source like "CS%" OR source like "BoldChat%" OR source like "EC%" OR source like "ED%" OR source like "EIT%"OR source like "GPT%" OR source like "GS%" | eval source=substr('source',1,5) | stats count by source</query> <earliest>0</earliest> <latest></latest> </search> <choice value="">ALL</choice> <delimiter> OR </delimiter> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>source like "</valuePrefix> <valueSuffix>"</valueSuffix> <default>ALL</default> <initialValue>ALL</initialValue> </input> And changed the search query for panels like sourcetype=* | where $source$. However I get result(wrong one) only when I select ALL. Selecting other options not even returning results. Please help! Thanks ... View more

I have tried it without success @micahkemp. I have to use the below search query search query since we should be showing only the first five characters and need to avoid few sources. sourcetype=error | where source like "GS01%" OR source like "CIS%" OR source like "CS%" OR source like "BoldChat%" OR source like "EC%" OR source like "ED%" OR source like "EIT%"OR source like "GPT%" OR source like "GS%" | eval source=substr('source',1,5) | stats count by source Hence, I have modified the source like below. <input type="checkbox" token="source" searchWhenChanged="true"> <label>Source</label> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search> <query>sourcetype=ROI | where source like "GS01%" OR source like "CIS%" OR source like "CS%" OR source like "BoldChat%" OR source like "EC%" OR source like "ED%" OR source like "EIT%"OR source like "GPT%" OR source like "GS%" | eval source=substr('source',1,5) | stats count by source</query> <earliest>0</earliest> <latest></latest> </search> <choice value="">ALL</choice> <delimiter> OR </delimiter> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>source like "</valuePrefix> <valueSuffix>"</valueSuffix> <default>ALL</default> <initialValue>ALL</initialValue> </input> And changed the panel query as sourcetype=* | where $source$ Even now the results are not as expected. Only when selecting ALL 2 results appear which is wrong. And others do not return any result. Please help! Thanks Maria Arokiaraj ... View more

Tried adding a space after OR, @micahkemp. No luck 😞 ... View more