This run-anywhere example should explain the process. | makeresults | eval STime="9:45" | rex field=STime "(?<hrs>\d+):(?<mins>\d+)" | eval Hours=hrs + round(mins/60,2) ... View more

This is output for a splunk query returning search results ... View more

You can fetch results of lookup using search: | inputlookup your_lookup.csv Replacing lookup data would be: ```your search here``` | outputlookup your_lookup.csv And then you can add(append) rows using: ```your search here``` | outlookup append=true your_lookup.csv ... View more

It looks like there may be something else going on in your search. Please share the full search (in a code block </>). It would also be helpful (and quicker) if you could share some sample anonymised representative events. ... View more

It would be better to give us some more context - its helps with trying to help and answer you question. I guess you are trying to remove / filter out some data? This is just guessing on what you maybe wanting to do. This is an example using make results, this filters the ticket_id=5678 (so apply same princples for your code)  | makeresults | eval _raw="ticket_id, priority,status 123,P1,Closed 5678,, 8765,P2,Closed" | multikv forceheader=1 | search ticket_id!=5678 | table ticket_id, priority, status ... View more

You could do something like this | eval sameday=if(relative_time(starttime,"@d")=relative_time(endtime,"@d"),"true","false") ... View more

Thanks, this worked 🙂   ... View more

regex101.com is a good site to test and understand regular expressions I have set this one up to show your extraction https://regex101.com/r/mBRfJF/1   ... View more

how to calculate incident end day SLA hours in splunk? I mean if Inc_Resolved_Time="27.02.2024 08:00" and TeamWorkTimings="Mon-Fri 7AM to 6PM", then the end day SLA hours should be 1business hour. Could you please help me with splunk query to achieve this result. I am trying to use this query but not getting proper results:: | eval Ending_Day_SLA_Hours=if(((incidentEndTime1-incidentStartTime1)<86400 AND Inc_Open_Days=Inc_Resolved_Actual_Days),0,if((Inc_Resolve_Date=Weekend_1 OR Inc_Resolve_Date=Weekend_2 OR Inc_Resolve_Date=Weekend_3 OR Inc_Resolve_Date=Weekend_4),0,if((incidentEndTime1>Inc_SLA_Start_Day_Epoch AND incidentEndTime1>Inc_SLA_End_Day_Epoch),(660-((incidentEndTime1-Inc_SLA_End_Day_Epoch)/1440))/60,if(incidentEndTime1<Inc_SLA_Start_Day_Epoch,11,0)))) ... View more