I have the following query that gives me week-over-week comparisons for the past month:   index="myIndex" earliest=-1mon "my query" | timechart count as Visits | timewrap w   I have added dropdowns to my dashboard to filter this data by a user-selected time window for every day in the one month range.  The four dropdowns correspond to the start hour, start minute, end hour, and end minute of the time window in military time.  For example, to filter the data by 6:30 AM - 1:21 PM each day, the tokens would have the following values:   $start_hour_token$: '6' $start_minute_token$: '30' $end_hour_token$: '13' $end_minute_token$: '21'   How would I modify the original query to make ths work? Thanks! Jonathan ... View more

What's the simplest regex that will match any character including newline? I want to be able to match all unknown content between two very specific capture groups. Thanks! Jonathan ... View more

I'm using the rex command to parse a value out of the results of a transaction command. Is there an easy way to restrict the resulting capture from searching either the start or end block of the transaction? This would be much easier than doing it in the regex itself, since both blocks of text returned are very similar. Thanks! Jonathan ... View more

Let's say I have data in an event that looks like this:       NAME: John NAME: Mary NAME: Sue       Assuming I have no idea how many names will exist in the event, is it possible to use the rex command to parse out all the names and display them in separate fields? Thanks, Jonathan ... View more

I have two independent/unrelated queries (same index, though) , and I want to create a timechart where there are two bars in each time bucket, one for each of the two queries. Is this possible? Thanks! Jonathan ... View more

I have a transaction command which correlates two log entries. If I pipe this result into a timechart command, which log entry's timestamp does it use to bucketize the results (the first or the second)? Also, is there a way to specify this? Thanks! Jonathan ... View more

I have a Splunk query that does a lot of computation and eventually returns only two calculated fields:  _time and STORE_ID via the table command. The _time field is formatted exactly like the the built-in _time field (e.g., "2022-01-17 23:50:25,897"). I want to do a timechart showing the count of how many times each unique STORE_ID appears in a given time bucket, using my calculated _time variable to fill the buckets.  What do I put in the timechart clause to accomplish this?  Thanks! Jonathan ... View more

I am using the timechart command to create a graph with one bar for each day in the month, and I would like each day of the week to display in the same color, so I can easily identify week-over-week changes. For example, Mondays would be blue, Tuesdays would be green, etc. Is this possible? Thanks in advance! Jonathan ... View more

I'm using the bin command to get a distribution of values, and each grouping is in increments of 10,000. I have a few outliers way at the upper end, and I don't want to see all the empty buckets in the middle. Is it possible to put all values above a desingated cutoff value into the final bin? Thanks, Jonathan ... View more

I'm creating an extracted field using a regex, and I want to use a literal pipe "|" character in the regex. My understanding is to use a backspace as an escape character as follows: \| When I save the regex and return to it, however, the backslash has been removed. What am I doing wrong? Thanks, Jonathan ... View more

I have a Splunk query that returns the duration of each service call, and I want to plot each value on the y-axis, and a time-stamp on the x-axis. The last part of the query is a rex command parsing out DURATION ... View more

Is it possible to save a piece of a query that you use over and over again? For example, I want to exclude certain test IPs from all of my dashboard queries, so I might want to save and re-use the following fragment in a number of queries: IP!="Some IP" IP!="Some Other IP" Thanks, Jonathan ... View more