I'm attempting to use stats to process some data before further calculations are performed. I have too many events for transaction and would like to "keep" certain data from certain values of foo. | stats values(eval(if('foo'="bar", A, null())) The above expression runs, but returns multiple values if there is more than one foo event with different values of A. Sometimes the values are the same for a certain value of foo, but not always. Each field that gets passed through needs mv handling on the other side to get it back down to just one value. That's not ideal as there are 20+ fields that are needed after this stats command. Based on the context of foo I often know whether I want to keep the first or the last value. The expression | stats values(eval(case('foo'="bar", A))) Returns only one value, from the first event where the condition in the case statement is met. However, this doesn't work when what I want is the last occurrence of 'foo'="bar" and not the first. I've checked the eval+stats documentation and splunk answers, but I'm having trouble finding an example of dynamic fields that uses first() last() earliest() or latest() instead of a sum or count function. Ideally I'd do something like: |stats last(eval(if('foo'="bar", A, null())) Which would return the value of A for the last event matching the condition foo="bar". However, if foo="bar" is not the last event then no data is returned. Is there a way to nest the last inside the eval statement? Should I be looking at match() instead? ... View more

I'm counting exceptions over a 24 hour period. My search looks like this: index=exceptionsindex | bin _time span=24h | stats sum(Exception) as TotalE by Area, _time | sort by _time -TotalE The output of this search is ~40 events for each day, one for each Area, with a sum of TotalE. What I'd like to be able to do is keep only the top 5 offending areas per day. Ideally something like | head 5 TotalE by _time , but head doesn't accept arguments like that. Thoughts? ... View more

I am using a search of real-time data and a lookup to check whether certain problems exist based on the data. For example: SensorA SensorB SensorC ifStringfromLookup 3 5 10 SensorC<3 AND SensorB<1 3 5 10 SensorA>1 AND SensorC<12 What I would like to be able to do is check to see if the current sensor values match any of the conditions of interest. I've tried | eval Problem=if(ifStringfromLookup, 1, 0) | eval Problem=if($ifStringfromLookup$, 1, 0) | eval Problem=if(tostring(ifStringfromLookup), 1, 0) And none of these work. I would like the string stored in the field ifStringfromLookup to be used to evaluate the if function. I've tried searching splunk answers and the help but haven't found anything that works. ... View more

tl;dr : Need to manipulate rows / cols of a table in a specific way to avoid using subsearch, can't figure out how. Scroll to bottom and look at tables. I'm working with some sensor data and I'd like to "shift" _time for some events, so that they are correctly correlated with an appropriate ItemID. I have previously done this with a subsearch (which I'll include below) but I'm trying to get rid of the subsearch because of it's limitations. Here are the fields present in the data: _time FieldName Value There's a field called ItemID which identifies when the item is entering the processing queue. The queue runs at Speed. Some amount of time later, based on Speed and a fixed distance, the item of interest passes under the Sensors, (up to 100s). The raw data does not include the _time that an item is under these sensors, but it can be calculated with an equation from the Speed and the distance. Here's the subsearch spl: index=* Speed ItemID | timechart span=1m avg(Measurement) by FieldName | filldown | timeshift=(##/Speed)*60 | append [ search SensorA | timechart avg(Measurement) span=1m | filldown | table _time Measurement FieldName ] | sort _time | filldown timeshift | eval _time=if(FieldName==SensorA,_time-timeshift,_time) | sort _time | filldown Measurement | rename Measurement as SensorA | stats avg(SensorA) by ItemID This search works because you have two sets of _time, one you're shifting by subtracting the shift (SensorA) and one you're not. However, when you get a large number of sensors over a longer period of time, the limitations of subsearch come into play. Here's the new search, which eliminates subsearch: index=* ItemID OR Speed OR Sensor* | bin _time span=1m | stats avg(Measurement) as Measurement by _time, FieldName | table * | xyseries _time FieldName Measurement | filldown * | eval timeshift=(##/Speed)*60 This search produces a table with records that look like this: _time ItemID timeshift SensorA SensorB SensorC 8:00 9385723423 3333333 33.3 33.3 33.3 What I'd like to do is create a table like this: _time FieldName Measurement timeshift 8:00 ItemID 9385723423 3333333 8:00 SensorA 33.3 3333333 8:00 SensorB 33.3 3333333 8:00 SensorC 33.3 3333333 8:00 SensorD 33.3 3333333 I can then manipulate this table to timeshift only the sensor data, xyseries everything to put it back together, and use stats against the results. Any advice? I've looked at untable docs & examples but I think it only handles 3 fields, and I need timeshift to stay on every sensor record. ... View more

I have user-generated data that I am trying to splunk to show whether or not an audit or check has been performed in a certain time range. Example rows look like this ... _time Field A Field B Field C #1 Complete Complete #2 Complete #3 Complete Complete Current state: I have a search that creates a table showing complete and incomplete checks: earliest=-24h sourcetype=_json source="AuditData" index=auditindex | stats values(*) as * | appendpipe [ stats count | where count==0] |`AuditFillNull` | transpose | rename column as "Audit" | rename "row 1" as Status Audit Status Field A Complete Field B Incomplete Field C Complete The above shows the table the search produces if the search time frame covered the #1 event but not #2 or #3. The fill null macro has an eval + coalesce expression for each field that fills in Incomplete in the place of null values. What I would like to show is a table like this: Audit Last Done Status Field A #1 Complete Field B #3 Incomplete Field C #1 Incomplete Where the "Last Done" shows the time of the last complete value in the data set. I'm sure there must be a way to accomplish this task but I'm not sure what commands to look at. ... View more