I currently am building a dashboard and want to take two of my single value pannels results and divide them. I want this result to show in the third pannel. This is what I have: <form> <label>Customer Stats. Clone</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="account_drop" searchWhenChanged="true"> <label>Account Name</label> <fieldForLabel>Account Name</fieldForLabel> <fieldForValue>Account Name</fieldForValue> <search> <query>source="LMCustomerRevLicense.csv" | dedup "Account Name" |</query> <earliest>0</earliest> <latest></latest> </search> </input> <input type="text" token="field1"> <label>License Key</label> <default></default> </input> </fieldset> <row> <panel> <single> <title>License Key</title> <search> <query>source="LMCustomerRevLicense.csv" $account_drop$ | dedup "Account Name" | table "License Key Identifier"</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">none</option> <option name="height">116</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> <row> <panel> <single> <title>Total Annual Revenue</title> <search> <query>source="LMCustomerRevLicense.csv" $account_drop$ | dedup "Account Name" | table "Total Active Subscription Revenue _converted"</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> <panel> <single> <title>Documents Processed</title> <search> <query>source="c:\\users\\ragate\\desktop\\splunk\\jsondump.txt" OR source="LMCustomerRevLicense1.csv" $field1$ | eval "LicenseKeyID"=substr('context.custom.dimensions{}.LicenseKey' ,4,7) | eval LicenseKeyID= coalesce(LicenseKeyID, 'License Key Identifier') | table "LicenseKeyID" "Account Name" "context.custom.dimensions{}.DocumentSessionId" | stats distinct_count("context.custom.dimensions{}.DocumentSessionId")</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> <row> <panel> <single> <title>Documents per $</title> <search> <query></query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> <row> <panel> <title>Distinct Users</title> <chart> <search> <query>host="ragate-lt1" $field1$ | chart count by context.user.anonId</query> <earliest>1529280000</earliest> <latest>1529539200</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.chart">bar</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>Distinct Sessions</title> <chart> <search> <query>sourcetype="jsondump" $field1$ | top limit=20 "context.session.id"</query> <earliest>1529280000</earliest> <latest>1529539200</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.chart">bar</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> </form> I would like to divide the Total Annual Revenue by the Documents Processed and have this result show up in the Documents per $. Anyone know how this could be done. Thanks in advance. ... View more

I currently have this search query: source="C:\Users\ragate\Desktop\splunk\JsonDump.txt" | eval "LicenseKeyID"=substr('context.custom.dimensions{}.LicenseKey' ,4,7) | table "context.custom.dimensions{}.DocumentSessionId" "context.user.anonId" by LicenseKeyID | I want to merge it with this one: source="LMCustomerRevLicense.csv" $account_drop$ | dedup "Account Name" | table "License Key Identifier" "Account Name" "Total Revenue" I made the License Keys be the same as the first source. I want to merge these two together and have everything sorted from the license key. I also want anything that does not match with the license keys in the first search to be removed. Is this possible? ... View more

Hi. I have two sources that I am trying to merge and dedup similar data. They both have a license key, one was longer than the other but had the main 7 variables that I used substr to make them both the same. Currently the syntax looks like this: source="LMCustomerRevLicense.csv" OR source="C:\\Users\\ragate\\Desktop\\splunk\\JsonDump.txt" Dykema | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey',4,7) | dedup "Account Name" | table "LicenseKeyID" "Account Name" "context.custom.dimensions{}.DocumentSessionId" | where "License Key Identifier"="LicenseKeyID" I want to merge these two license keys together to then be able to have everything else in the csv file will be able to be sorted with this key and anything that does not match with the one I used substr for is removed from the data. This might seem a little confusing so let me know if I need to explain a little better. I am new to splunk if that hasn't been made obvious already. Thanks in advance. ... View more

I have two sources of data. One that has an Account Name, License Key, and Account Revenue. The other has License Key and an Item_Count field. Current it shows like this LicenseKey Item_Count 200IGN3 4 200IGN3 10 342mD3D 8 342mD3D 6 I would like to remove the duplicate keys and add up there item counts. How would this be done? Thanks in advance. ... View more

I have joined two searches together. My search only returns one event that everything matches up but there are more than just one. This is my search: source="C:\\Users\\ragate\\Desktop\\splunk\\LMCustomerRevLicense.csv" | join type=left substr('context.custom.dimensions{}.LicenseKey',4,7) [search source="c:\\users\\ragate\\desktop\\splunk\\jsondump.txt"] | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey',4,7) | where 'LicenseKeyID'='License Key Identifier' | Any suggestions? ... View more

Currently I have two data sources with different names for the same IDs. One is called License Key Identifier and the other is called LicenseKeyID. As of right now I have this: source="c:\\users\\ragate\\desktop\\splunk\\jsondump.txt" | join type=left substr('context.custom.dimensions{}.LicenseKey',4,7) [search source="C:\\Users\\ragate\\Desktop\\splunk\\LMCustomerRevLicense.csv"] | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey',4,7) | It only pulls from the bottom row of the excel sheet for the License Key Identifiers but gives me the correct LicenseKeyID. How do I get it to pull all the rows for the License Key Identifiers and then get rid of the ones that do not match up with the LicenseKeyID? ... View more