Hi all, strange thing - when using mean() and avg() in the same stats command, whichever is written first is empty, while the second value  is shown with the correct result. ... | stats mean(Capacity) avg(Capacity) mean(Capacity) avg(Capacity)   20.71428   ... | stats  avg(Capacity) mean(Capacity) avg(Capacity)  mean(Capacity)   20.71428   I know they are basically the same values. But why can't I show them side by side? Each function on its own is working fine. Also adding any of the other statistical functions is no problem, just avg() and mean() don't go together. Why? I'm on 8.2.0 at the moment. Thank you very much and kind regards, Gunnar ... View more

Hi, we just tested the Splunk Add-on for Salesforce to pull some custom fields from custom database tables to use them in a Dashboard in Splunk.  We are using the "Salesforce Object" input and it is working fine so far. We get all the fields we need. What I am missing though is an option to set a filter for the SOQL query, because we don't want (and are not allowed) to fetch all entries from a certain object/table. When defining the input through the UI one can define the SELECT part of the query (object fields) and also the FROM part (object), but there is option to enter a WHERE statement. Is there a way to this? I've looked at the underlying scripts of the Add-on but didn't find anything obvious - I was hoping for a comment like "add your WHERE statement here if you need it"  😉 Thank you. ... View more

Hi, I have events similar to this example: 1) date1, id1, misc 2) date2, id2, misc 3) date3, , misc 4) date4, id3 and id4, misc The ids in 4) should be split into two separate lines.  The result should look like this: 1) date1, id1, misc 2) date2, id2, misc 3) date3, , misc 4) date4, id3 , misc 5) date4, id4, misc But when using makemv with tokenizer lines which do not match, the tokenizers are skipped in the result, e.g.: ... | makemv tokenizer="(id\d)" ID | mvexpand ID | ... Results in: 1) date1, id1, misc 2) date2, id2, misc 3) date4, id3 , misc 4) date4, id4, misc How can I keep the non-matching lines? Is there a way to only use makemv where it is necessary? My workaround at the moment is to append a second search that looks for events with an empty ID and adds those events again after the makemv, e,g,: first search | ... | makemv tokenizer="(id\d)" ID | mvexpand ID | append [ first search again | ... | search NOT ID="*" | ... ] | ... But searching twice can't be an optimal solution. Thank you, Gunnar ... View more