You can simply do a search like index=abc OR index=XYZ | your condition(s) here | transaction _time maxspan=something | search index=XYZ | where ... And do some additional conditioning. Maybe you need tuning maxspan to get the events ininside your transaction you want. For further details lookt at transaction. Skalli ... View more

Hi mayurr98, Apologies but I didn't explain the whole thing: the login/logout words don't always appear, so I should rather use the session key as what defines a session. Does that make sense? ... View more

Hi @ADRIANODL , The refresh_token doesn't gets saved in conf file because you may have missed this permission in Salesforce Connected App. Adding this in Salesforce would have the refresh_token in response and thus it will get saved in conf file and thus resolve this error in the end. Reference Screenshot:- ... View more

Find a way to get combined results starting with a base search like this: (index=o365 tag=email SenderAddress=*@mycompany.com RecipientAddress!=*@mycompany.com) OR (index=beta sourcetype="activities") | ... Then wrap it up as shown in this stand-alone demo here: |makeresults | eval _raw="SenderAddress=john@mycompany.com,FullName=John Doe,JobTitle=Clerk,ManagerNameJoe Bloggs,Location=London,JobLevel=3,Recipients=email@email.com,Subject=Re:Confidential,NameInSubject=John_Doe,num_days=3" | append [|makeresults | eval _raw="DisplayName=John Doe,EmailAddress=john@mycompany.com,Mobile=+444444444444,JobTitle=Clerk,BusinessUnit=Sales,Department=North,JobLevel=3,Number_of_Transfered_Files=56000" ] | kv | eval JOINER = coalesce(EmailAddress, SenderAddress) | stats values(*) AS * BY JOINER ... View more

Thanks for the prompt response folks, however I'm looking to return calculated values from both indexes. I'll create another question to include it. ... View more

@ADRIANODL Yeah. Bcoz trend expects numerical values to calculate difference over different time periods. If we convert it to String then trend doesn't work. But you can try a workaround. Use your existing code block and do following changes. 1) append dummy search YOUR_SEARCH | append [ | makeresults | eval count="" | table count ] . Change precision to 0 . It will show you zero value with a trend. 2) Now, we need our value with 8 digit precision. Execute a search separately and set XML token token_abc . Use this token in unit option of the single view. <option name="unit">$token_abc$</option> You will see just extra 0 in the chart as I believe. ... View more

How does your location matter for the TZ you set? If the information is logged in UTC timezone (which the Z indicates), you should tell splunk to interpret it as UTC, not as Australia time. If you want things displayed in australia time, you do that with your user's timezone settings in splunk web, not with the props.conf. Telling splunk to index UTC logs as Australia/Sidney, will cause splunk to put skewed values into _time. ... View more

Hi Renjith, I managed to solve this one using the filldown function. Thank you very much anyways. ... View more

base query | eval purchase_price = (unit_price * no_of_items) | stats avg(purchase_price) ... View more

Hi ADRIANODL, I think in my case it is working just by writing cont=false, nothing else is required. Can you tell me which Splunk version are you working on? ... View more

sorry I meant the ServiceNow version too. Jakarta/London versions are emitting too much data, especially fields starting with dv_* We are receiving about 60+ fields for incident table ... View more