Note:  'TsidxStats': The tstats / mstats command cannot apply eval function to aggregation function. ... View more

Do NOT use regex because it does not map-reduce and you will pull all the values out only to throw them away and your search will take 1000x longer than the way that I just showed you. ... View more

Just use a lookup as a lookup. this presumes the data the value is src and the field in the lookup is Workstation_Name index="wineventlog*" CategoryString="Logon/Logoff Event" | lookup lars_file_computers_zonder_human_inlog.csv Workstation_Name as src OUTPUTNEW Workstation_Name as isFound | where isnotnull(isFound) ... View more

| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action" | search "Authentication.action"!="unknown" | transpose header_field=="Authentication.action" | eval division=success/failure Trying to only display division field, table division doesn't work Edit: Found out what the problem was, it's fixed ... View more

I was just playing around with it and it turns out you don't even need the timechart. You can get it done just by adding the _time field to your by clause: | tstats summariesonly=true count from datamodel=Authentication by "Authentication.action",_time | search Authentication.action!="unknown" | trendline sma5(count) AS trend ... View more

This seems to be a problem related to the number of elements that populate the multiselect. In order to make it smoothly, you could try to add some filters in order to get less data into the multiselect element. ... View more

Load the values into a lookup table. Use a multi-select input to load the lookup and format each value into a token. Add the token to a panel. ... View more

You need to accelerate your report. Mind that setting the schedule and time window for your acceleration should be according to your need. E.g. If you want this report monthly for the last month. I think you can probably set the acceleration schedule for last midnight of the day when you want this report. And set the time window of your search also to last month. Please upvote if this helps you 🙂 ... View more

I think those settings might make a single-value visualization (lol, which has two values on it!) compare the most recent hour with the previous hour? Your results would seem to sort of possibly fit with that. So try this: index="network" sourcetype="network:proxy" earliest=-2w@w | timechart span=1w eval(sum(bytes)/1024/1024) as totMBs Keep in mind that compares the last full week's data to this week so far, which could be only the first days's worth of data from this week. Better, perhaps, may be to press timewrap into service? The Usage and Basic Example section is pretty close to what you need, just that you have a slightly different base search. ... View more

I am seeing this across the whole of my Splunk ES 5.1.1/7.1.2 system - what version are you using, paddygriffin? ... View more

Glad it works ☺ ... View more