Hi folks, I have 2 searches that return equivalent values based on the result of a lookup, as such: Search 1 index=alpha tag=email SenderAddress=*@domain.com | table *Email_Address*, Name Search 2 index=alpha sourcetype="activities" | spath | search "tags{}.category_id"=USBTFR |rex field=User_Name "(?\w{3,6})" |eval User_Name=upper(User_Name) |lookup tablename LogonID as User_Name OUTPUT *EmailAddress* How can I join the result of the two searches based on the EmailAddress field? ... View more

Hi folks, I've struggled for a couple of days parsing a file that looks like this: { "status": { "timestamp": "2018-10-10T23:40:26.101Z", "error_code": 0, "error_message": null, "elapsed": 14, "credit_count": 1 }, "data": [ { "id": 1, "name": "Bitcoin", "symbol": "BTC", "slug": "bitcoin", "circulating_supply": 17315325, "total_supply": 17315325, "max_supply": 21000000, "date_added": "2013-04-28T00:00:00.000Z", "num_market_pairs": 6324, "cmc_rank": 1, "last_updated": "2018-10-10T23:39:30.000Z", "quote": { "USD": { "price": 6593.07839577, "volume_24h": 3781676977.17942, "percent_change_1h": 0.299567, "percent_change_24h": -0.633751, "percent_change_7d": 0.95377, "market_cap": 114161295173.23618, "last_updated": "2018-10-10T23:39:30.000Z" } } }, { "id": 1027, "name": "Ethereum", "symbol": "ETH", "slug": "ethereum", "circulating_supply": 102492584.749, "total_supply": 102492584.749, "max_supply": null, "date_added": "2015-08-07T00:00:00.000Z", "num_market_pairs": 4471, "cmc_rank": 2, "last_updated": "2018-10-10T23:39:42.000Z", "quote": { "USD": { "price": 225.917892111, "volume_24h": 1382931374.09404, "percent_change_1h": 0.569086, "percent_change_24h": -0.704234, "percent_change_7d": 1.85499, "market_cap": 23154908703.502106, "last_updated": "2018-10-10T23:39:42.000Z" } } }, { "id": 52, "name": "XRP", "symbol": "XRP", "slug": "ripple", "circulating_supply": 39997634397, "total_supply": 99991817275, "max_supply": 100000000000, "date_added": "2013-08-04T00:00:00.000Z", "num_market_pairs": 230, "cmc_rank": 3, "last_updated": "2018-10-10T23:40:09.000Z", "quote": { "USD": { "price": 0.461478997819, "volume_24h": 411665959.164198, "percent_change_1h": 0.445149, "percent_change_24h": -3.5819, "percent_change_7d": -13.0624, "market_cap": 18458068236.65832, "last_updated": "2018-10-10T23:40:09.000Z" } } }, { "id": 1831, "name": "Bitcoin Cash", "symbol": "BCH", "slug": "bitcoin-cash", "circulating_supply": 17395525, "total_supply": 17395525, "max_supply": 21000000, "date_added": "2017-07-23T00:00:00.000Z", "num_market_pairs": 342, "cmc_rank": 4, "last_updated": "2018-10-10T23:39:36.000Z", "quote": { "USD": { "price": 512.630430925, "volume_24h": 369198906.22134, "percent_change_1h": 0.365485, "percent_change_24h": -0.745641, "percent_change_7d": -1.26889, "market_cap": 8917475476.91661, "last_updated": "2018-10-10T23:39:36.000Z" } } }, { "id": 1765, "name": "EOS", "symbol": "EOS", "slug": "eos", "circulating_supply": 906245117.6, "total_supply": 1006245119.9339, "max_supply": null, "date_added": "2017-07-01T00:00:00.000Z", "num_market_pairs": 174, "cmc_rank": 5, "last_updated": "2018-10-10T23:39:36.000Z", "quote": { "USD": { "price": 5.88204493255, "volume_24h": 532584590.023657, "percent_change_1h": 0.326144, "percent_change_24h": -0.205986, "percent_change_7d": 4.79873, "market_cap": 5330574501.627259, "last_updated": "2018-10-10T23:39:36.000Z" } } }, { "id": 512, "name": "Stellar", "symbol": "XLM", "slug": "stellar", "circulating_supply": 18890616791.6665, "total_supply": 104363617748.491, "max_supply": null, "date_added": "2014-08-05T00:00:00.000Z", "num_market_pairs": 120, "cmc_rank": 6, "last_updated": "2018-10-10T23:39:19.000Z", "quote": { "USD": { "price": 0.241243489647, "volume_24h": 40002371.0719364, "percent_change_1h": 0.417773, "percent_change_24h": -1.36287, "percent_change_7d": -0.740479, "market_cap": 4557238316.405842, "last_updated": "2018-10-10T23:39:19.000Z" } } }, What I need to do is: -extract the timestamp, which I'm doing successfully - extract each coin and all the related information, including the nested "quote" as single event (the actual coin info starts after each "id", and finishes on the }, ) -all info before "data" can be suppressed My current sourcetype looks like this: [lalaland] DATETIME_CONFIG = KV_MODE = json NO_BINARY_CHECK = true SHOULD_LINEMERGE = true TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NT TIME_PREFIX = \"timestamp\": TZ = Australia/Sydney category = Custom pulldown_type = 1 BREAK_ONLY_BEFORE = \s*{\s*\"id\": disabled = false MAX_EVENTS = 10000 What am I doing wrong? Tks! ... View more

Hi splunkers, Suppose I have the following table: Date ItemsPurchased UnitPrice 1/1/1111 20 0.5 2/1/1111 10 1 3/1/1111 -7 0 4/1/1111 8 0.2 Which is basically a representation of my stock, where the -7 means that 7 items have been sold. So now I want to calculate the Median Unit Price, which I do by using the following query: | streamstats sum(ItemsPurchased) as GTotal |streamstats sum(eval(ItemsPurchased*UnitPrice)) as UTotal |eval MedianUnitPrice= UTotal / GTotal |table date ItemsPurchased UnitPrice GTotal UTotal MedianUnitPrice This works fine, calculating the MedianUnitPrice as required, HOWEVER, it also tries to calculate it for my Sale (-7), which skews the results thereon.. Date ItemsPurchased UnitPrice MedianUnitPrice 1/1/1111 20 0.5 0.5 2/1/1111 10 1 0.6667 3/1/1111 -7 0 (-0.475) 4/1/1111 8 0.2 (wrong result since it's adding -0.475 to the calculation) What I'd like to do is to keep calculating the MedianUnitPrice EXCEPT when ItemsPurchased is a negative value. Thanks! ... View more