You are right - I misunderstood what you were trying to do - try this | eval row=mvrange(0,2) | mvexpand row | eval sent=if(row=0,AMOUNT,null()) | eval received=if(row=1,AMOUNT,null()) | eval account=if(row=0,ACCOUNT_FROM,ACCOUNT_TO) | eventstats sum(sent) as total_sent sum(received) as total_received by account | fillnull value=0 total_sent total_received | where total_sent > total_received ... View more

Try something like this | eventstats sum(AMOUNT) as total_sent by ACCOUNT_FROM | eventstats sum(AMOUNT) as total_received by ACCOUNT_TO | table _time ACCOUNT_TO ACCOUNT_FROM TRACE total_sent total_received INFO AMOUNT | where total_sent > total_received ... View more

You need to split process up if you want to treat the parts of the command line up as separate things. Try this | eval parts=split(process," ") | search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT parts IN ($exclude_command$) ... View more

You could do something like this | chart sum(FRCount) as totalHourCount by QSDateOfTxn, QSHourOfTxn limit=1000 | eval row=mvrange(0,2) | mvexpand row | eval _metric=QSDateOfTxn." ".mvindex(split("totalHourCount,PPM",","),row) | fields - QSDateOfTxn | rename row as _row | foreach * [| eval <<FIELD>>=if(_row=0,'<<FIELD>>',round('<<FIELD>>'/60,2))] | eval QSDateOfTxn=mvindex(split(_metric," "),0) | eval metric=mvindex(split(_metric," "),1) | table QSDateOfTxn metric * ... View more

Try something like this (index=aws-cpe-scl source=*winserver* "methodPath=POST:/scl/v1/equipment/router/*/claim/pods" responseJson "techMobile=true") OR (index=aws-cpe-osc ConnectionAgent "Node * connected:" model=PP203X) | rex "responseJson=(?<json>.*)" | eval routerMac = routerMac | eval techMobile = techMobile | eval status = status | spath input=json path=claimed{}.boxSerialNumber output=podSerialNumber | spath input=json path=claimed{}.locationId output=locationId | eval node_id = substr(podSerialNumber, 0, 10) | eval winClaimTime=if(index="aws-cpe-scl",strftime(_time,"%m/%d/%Y %H:%M:%S"),null()) | rex field=_raw "Node\s(?<node_id>\w+)\sconnected" | eval nodeFirstConnectedTime=if(index="aws-cpe-osc",strftime(_time,"%m/%d/%Y %H:%M:%S"),null()) | stats first(winClaimTime) as claimTime first(routerMac) as routerMac first(nodeFirstConnectedTime) as connectionTime by node_id ... View more

This is really a Windows question not a Splunk question! ... View more

Please provide (anonymised) examples of your events in code blocks </> to preserve formatting information and a description of what you are trying to get out of them, for example, why are you using dedup? Also, what do your expected results look like (for the example events you have provided)? ... View more

Another thing to bear in mind is what the _time (stamp) means. If it is interpreted from the data in the event, then it is the time that the application has chosen to put into the data. For example, with Apache HTTPD logs (and other logs), the timestamp is when the request was received, but the logged event is written when the response was sent back, so is already lagging by whatever the response time of the request was. 12:01:00 - request received by Apache (_time) 12:01:10 - response received by Apache 12:01:11 - event logged by Apache (request time and duration time of 10 seconds) 12:01:14 - event indexed by Splunk (_indextime) As you can see in this example, the difference between _time and _indextime is 14 seconds, but the lag between when the event was written and when it was indexed is only 3 seconds. So, unless the _time value is the time (or as close as possible to the time) that the application wrote the event (so it was available to the forwarders to send to Splunk), calculating the difference between _time and _indextime can represent a number of factors and you need to understand what the values represent to determine whether they are of any value. Having said that, comparing the difference with historic differences may at least give you an insight as to whether there is any degradation/variation, which might be worth investigating. ... View more

Can you open the search (from the dashboard table) in a separate table and share the search being used? ... View more

What is with the asterisks? Remove them and try again ... View more

Your field names possibly have dots in them? Try this way | eval Name_B=json_array_to_mv(json_keys(json_extract_exact(field,Name_A))) ... View more

OK the method works with some data as shown by this runanywhere example based on your sample data: | makeresults format=json data="[{ \"key1\": { \"field1\": \"x\" }, \"key2\": { \"field2\": \"xx\" }, \"key3\": { \"field3\": \"xxx\" } }]" | rename _raw as field | table field | eval Name_A=json_array_to_mv(json_keys(field)) | mvexpand Name_A | eval Name_B=json_array_to_mv(json_keys(json_extract(field,Name_A))) This would seem to suggest that it is something to do with your actual data, which you have hidden. Please provide some anonymised representative samples so we can progress the solution. ... View more

| search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process IN ($exclude_command$) Note that your user will have to enter the terms as quoted strings delimited by commas e.g. "commandA","commandB" ... View more

Depending on how you have set up your exclude_command token (which you haven't shared with us yet), you could try something like this | search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process IN $exclude_command$ ... View more

| eval Name_A=json_array_to_mv(json_keys(field)) | mvexpand Name_A | eval Name_B=json_array_to_mv(json_keys(json_extract(field,Name_A))) ... View more

Here is a simple mockup demonstrating the feature { "visualizations": { "viz_WuaoFRne": { "type": "splunk.table", "dataSources": { "primary": "ds_67f8SogQ" }, "hideWhenNoData": true } }, "dataSources": { "ds_67f8SogQ": { "type": "ds.search", "options": { "query": "| makeresults count=10\n| eval group=mvindex(split(\"Inactive,Active\",\",\"),random()%2)\n| eval groupId=\"Group \".random()%9\n| search group=\"$groups$\"" }, "name": "groups" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, "input_hM19F0Rl": { "options": { "items": [ { "label": "All", "value": "*" }, { "label": "Inactive groups", "value": "Inactive" }, { "label": "Active groups", "value": "Active" } ], "token": "groups" }, "title": "Display", "type": "input.dropdown" } }, "layout": { "type": "absolute", "options": { "width": 1440, "height": 960, "display": "auto" }, "structure": [ { "item": "viz_WuaoFRne", "type": "block", "position": { "x": 0, "y": 0, "w": 830, "h": 300 } } ], "globalInputs": [ "input_global_trp", "input_hM19F0Rl" ] }, "description": "", "title": "Hidden" } If you are still having problems please share you dashboard source code in a code block </> (as demonstrated above). ... View more

Ideally, don't use join! You could try searching both indexes in your initial search and then "join" the data from the events using stats. ... View more

You can calculate the latency like this | eval latency=_indextime - _time However, this is for the events already in the event pipeline. You could use this to find a maximum latency over a period and apply this statically to your earliest value in your next search. However, this is still only a static value and there is no guarantee that you won't have missed some events with higher latencies. You could periodically rerun the latency calculator to see if you are missing any events and adjust your search accordingly. ... View more

What does that even mean? _indextime is not calculated, it is the time when the event was indexed. It is like saying what is the average hour of the day? Earliest and latest relate to _time not _indextime. Usually, _indextime is after _time as it takes time for the event to be logged, transmitted, parsed and indexed. Having said that, _time usually comes from the data in the event, which could be in the future as far as the event is concerned. Please explain what your goal is in more detail. ... View more

Try looking in inputs.conf ... View more

Perhaps your example is not large enough, but from the subject, perhaps you could try this | stats count as count_B by "Field A" "Field B" | eventstats count as count_A by "Field A" | where count_A = 1 ... View more

It is not clear to me what exactly you want to check. Please can you clarify? ... View more