I have data from a sourcetype that I am searching with a map command like so: source=outersearch | map search="search source="innersource" | stats avg(Param)" This search runs correctly and returns the expected number of events from innersource. However, I would like to be able to search for a fieldname with a space in the inner search source. i.e. "Field Name"="String Value". When I isolate the inner search, it works just fine. When I include it in the map string: source=outersearch | map search="search source="innersource" "Field Name"="String Value" | stats avg(Param)" The map search returns no results. The documentation says that the map search string is 'literal' but I can't find any documentation on what that means or how it constrains how the search has to be written. ... View more

I have dense sensor data (~75k events in a 3 week period) from multiple sensors that I would like to correlate to a sparse set of data (~100 events in the same time period). The data span several different sensors. Sensor data events have these fields: _time, SensorName=SensorA, Data=394 Sparse data events have these fields: _time, ImportantProperty=583 Sensor data logs at a specific interval when nothing interesting is happening, or records a value if there is a significant change in the Data value. What I would like to do is have Splunk tell me what the Data value was for each SensorName at the time that an ImportantProperty event occurred. In the past, when I was looking at only one sensor, I have used transaction: (source=densedata AND SensorName=SensorA) OR source=sparsedata | transaction maxspan=10m maxevents=-1 | search ImportantProperty=* | stats avg(Data) avg(ImportantProperty) by _time However, this doesn't work when multiple SensorNames are involved. It seems like what I would want to do is subsearch for the sensor data around the time the ImportantProperty events occur, but I can't find any documentation on how I would do that for multiple time ranges (i.e. each of the 100 sparse events) and find all the sensor data events at those times. Help! I am constrained by my position and can't show my actual data, only generalized searches like the above. ... View more

I have a timechart on a dashboard that sums Things by Description* with a span of a week. Since my first Thing event is on a Thursday, my week seems to run Thursday to Thursday on the timechart. If a different chart on the same dashboard has its first Thing event on a Tuesday, it will start on Tuesday. I've looked at other questions that used earliest, and tried something like earliest=-3y@w1, which does snap everything to Monday. Unfortunately, it also plots a bunch of blank space to the left of all my data in the timechart. I can work around that by using chart instead of timechart: source=* earliest=-3y@w1 | reverse | bin _time span=1w | eval time=strftime(_time, "%m-%d-%y") | chart sum(Thing) by time,Description Which will work great for all time, but will not work if there is a time picker on the dash board, since the earliest in the search will override the time picker. Also, the chart renders with white space between columns for Description, time combos where there are no Things. I'd like to get rid of that white space, without stacking the columns. *I am only able to provide generalized examples of my data ... View more

I have a time in the following format: 2015-08-11 16:31:25.973 in a field called "Last Modified On". The data comes from a log with several columns containing date time information. What I'd like is to get a field at search-time that has just the date from the "Last Modified On" field, so I can group other fields by that date at search-time. Here is my search: host=* | eval test=strptime('Last Modified On',"%Y%m%d") | table test "Last Modified On" The output is a table with blanks for all the test field values, and the date time in the Last Modified On field. I have read other questions, but can't seem to find a similar example where strptime returns a blank for a string date. Is there a way to confirm that "Last Modified On" contains string data? ... View more