I have this working query which needs some additional detailing. index=_internal earliest=-1h@h latest=@h | lookup api uri OUTPUT operation service | rex "duration=(?<response_time>[^,]+)" | multikv | eval ReportKey="Today" | append [ search index=_internal earliest=-7d-1h@h latest=-7d@h | lookup api uri OUTPUT operation service | rex "duration=(?<response_time>[^,]+)" | multikv | eval ReportKey="lastweek" | eval _time=_time+604800] | stats first(uri) as apiName avg(response_time) as avgresponse_time count by operationName ReportKey Is there a way to get like this where it will compare all average response time and then give the percentile differences. operation uri today_avg (response_time) lastweek_avg (response_time) % differrences avg(response_time) today count last week count abc /api/abc 222 333   12312 42343 xyz /api/xyz 867 4234   87978 67867 ... View more

How do i select All in multiselect which basically selects all the value in that field and display, is it possible? ... View more

I have a csv file which has field Account and it has over 1000+. In my logs it is named as yourAccount. how do i find the all the account logs from that csv file. Also can i rex the field and have the table for that as well in same query? ... View more

I have two regex and want to view both as like new name URLs and both displays on the same column. Is there a way to combine it? ... View more

operationName urls avg_time max_time count MethodUsingGET https://www.google.com/api/v1/571114808/CAR.202 https://www.google.com/api/v1/571114899 3255 3255 2 UsingGET https://www.googleA.com/api/v1/571114888/api/ https://www.googleB.com/api/v1/571114877/api/ 1316.889 5345 18 I would only want one url but it should count others as well. Is there a way? ... View more

I am trying to get the alert when Excerption error happens but there are many hosts and services. In splunk the services and host arent arranged so manually I added the service name and hosts in csv file. is there a way or similar condition to get log events saying this serivce is getting error is this host with the message ... View more

I have two different hosts . hostA-1, hostA-2, hostA-3, hostA-4, hostA-5 . hostB-5, hostB-6, hostB-7, hostB-8. I want to compare the specific value from the logs that are matched like Token which are unique but wanted to find if the value are matched between hostA and hostB and form a table based on that which will show hosts name A and B and below will be the matching token ... View more

I have created a multiselect dashboard which has a City and Address. If I select ABCadd from City i can see multiple addresses in Address, but when i add another BBCadd from City which now have two selection in 1st multiselect, i can only see 1st selected City addresses but when I select ALL and search i can see both two address. I want to have both selection shown in second multiselect where i can select only wanted address. I am using csv file and inputlookup for multiselect. here is my xml.  <input type="multiselect" token="City " searchWhenChanged="true"> <label>City </label> <fieldForLabel>City </fieldForLabel> <fieldForValue>City </fieldForValue> <search> <query>|inputlookup aaa.csv | dedup City | table City </query> <earliest>-15m</earliest> <latest>now</latest> </search> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <choice value="*">All</choice> </input> <input type="multiselect" token="ShopName" searchWhenChanged="true"> <label>Shop Name</label> <choice value="*">ALL</choice> <fieldForLabel>ShopName</fieldForLabel> <fieldForValue>ShopName</fieldForValue> <search> <query>|inputlookup aaa.csv | search City =$City$| dedup ShopName| table ShopName</query> <earliest>-15m</earliest> <latest>now</latest> </search> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> </input> <search> <query>index=*  City =$City $ ShopName=$ShopName$ |stats values(ShopName) as ShopName, count by Address</query> <earliest>$Timer.earliest$</earliest> <latest>$Timer.latest$</latest> </search> ... View more

how do i combine both these rex field into one and display the count? index=abc "exception":"CommonApplicationException" | rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)" | stats count by ABC_CODE, Message index=abc ABC-* |rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code, Message ... View more