This I know is a stupid question, but here it goes anyways, hoping someone solved this problem in the past. Does anyone know how to undo the changes to a lookup when accidently using | outputlookup ? I accidently overwrote and committed changes to my lookup and have been trying to find a way to revert my changes. Please help anyone...  ... View more

Hi All, I have a field with the following field with values: Field_Values=case(Red="Low", 10, Blue="Medium", 28, Green="High", 14) How can I create a token in the dashboard that will have these values? This token will not be used for a filter in the dashboard or a drilldown. I am not sure if there is a default token to assign this to.  I am using the below code, but using job.resultCount is only giving me the highest value which is 3600 I need it to give me the corresponding Field_Value for when its Low, Medium or High..... any advise?  <condition match=" 'job.resultCount' &gt; 0"> <set token="Field_Values">$result.Field_Values</set> </condition>   ... View more

Hello All,  Anyone know how I can get the latest date from a lookup file? I am using the script below: | inputlookup append=t Blue_Marbles_Report.csv | rename "Last Scan Date" as "Last_Scan_Date" | eval updated=strptime(Last_Scan_Date,"%FT%T%:z") | eval desired_time=strftime(updated, "%B %d, %Y") | stats latest(desired_time) as desired_time | table Marbles, desired_time But the latest(desired_time) does not deliver any results. This is what I have on my original file: Marbles Last_Scan_Date Blue 08/01/2020 Blue 10/04/2020 Blue 11/08/2021 Desired Result: Marbles desired_time Blue 11/08/2021 Hope to get some help on this, thanks in advance.  ... View more

Hello Splunk Community  I have managed to use REST to add some columns from my CSV files. However, not all the columns are uploaded. I am using the below script:  | rest /servicesNS/-/-/data/lookup-table-files search="*_Weather.Lookups.csv" But the issue is that I am not getting all the fields associated with *_Weather.Lookups.csv anybody out there  know how I can het all the fields or a specific field from the lookup ? Thanks in advance.  ... View more

Hello All,  This may seem easy, but its been quite tedious. How can I create one field that has common values from two separate strings: Example:  Field 1=123_yyy  Field 2=777_x_123_0 Desired Results= New Field = 123  I have tried the below, but it only gives me false --- I know they dont match - I just want what is matching - any suggestions anyone?  | eval matched=if(like(Field1,"%".Field2."%"),"True","False")   ... View more

Hi Splunk Community, How does Spunk prioritize conditional case functions? Lets say I have a case function with 2 conditions - they work fine, and results are as expected, but then lets say I flip the conditions. What I see happen when I flip the conditions in the case function the results are not correct. Shouldn't Splunk be able to still check which condition it applies to even though I have flipped the conditions?  Example below: Case: TimeSchedule should output the closest 7th min or 37th min - so every half hour past the 7th min or 37th min from the zipTime_epoch. Works Fine as output TimeSchedule should be 2021-03-06 23:37:59.000000   | makeresults | eval zipTime="2021-03-06 23:35:59.000" | eval zipTime_epoch=strptime(zipTime, "%Y-%m-%d %H:%M:%S.%6N") | eval lastunzip_hour=tonumber(strftime(zipTime_epoch, "%H")) | eval lastunzip_min=tonumber(strftime(zipTime_epoch, "%M")) | eval lastunzip_sec=round(zipTime_epoch%60,6) | eval TimeSchedule=strftime(case(lastunzip_min%30 < 7, zipTime_epoch-zipTime_epoch%1800+420+lastunzip_sec,lastunzip_min!=37 AND lastunzip_min!=7, zipTime_epoch-zipTime_epoch%1800+2220+lastunzip_sec,1=1,zipTime_epoch),"%Y-%m-%d %H:%M:%S.%6N") | table TimeSchedule, zipTime, lastunzip_hour, lastunzip_min, lastunzip_sec, zipTime_epoch     Does not work fine when case in conditions are flipped- output should be 2021-03-06 23:37:59.000000 instead.   | makeresults | eval zipTime="2021-03-06 23:35:59.000" | eval zipTime_epoch=strptime(zipTime, "%Y-%m-%d %H:%M:%S.%6N") | eval lastunzip_hour=tonumber(strftime(zipTime_epoch, "%H")) | eval lastunzip_min=tonumber(strftime(zipTime_epoch, "%M")) | eval lastunzip_sec=round(zipTime_epoch%60,6) | eval TimeSchedule=strftime(case( lastunzip_min!=37 AND lastunzip_min!=7, zipTime_epoch-zipTime_epoch%1800+2220+lastunzip_sec,lastunzip_min%30 < 7, zipTime_epoch_epoch-zipTime_epoch_epoch%1800+420+lastunzip_sec,1=1,zipTime_epoch),"%Y-%m-%d %H:%M:%S.%6N")     ... View more