I see a column with name search and value (""field1"") Do we need to have field1 inside parentheses and two double quotes? Field label "search" in a subsearch is a pseudo keyword for "use as is literal" in a search command.  No, they should NOT have two quotation marks on each side.  Maybe your lookup values insert one additional set of double quotes?  If so, we can get rid of one set. Here is my emulation   | makeresults format=csv data="id,Messages ,a ,b ,c ,d" ``` the above emulates | inputlookup messages.csv ``` | fields Messages | rename Messages as search | format "(" "\"" "" "\"" "," ")" | rex field=search mode=sed "s/ *\" */\"/g"     Output only contains one set of double quotes search ("a","b","c","d") ... View more

Hello,I have this type of data, and I'd like to extract the following fields with a rex command: Two words: Don't.  The data you show is clearly a fragment from a JSON object.  Do not treat structured data such as JSON as text because the developer can change format at any time without changing syntax and render your rex useless.  Splunk has robust, QA-tested commands like spath.  Follow @ITWhisperer's advice to share valid, raw JSON data. (Anonymize as needed.)  If your raw data is a mix of free text and JSON, show examples of how they are mixed so we can extract the valid JSON, then handle JSON in spath or fromjson (9.0+) Specific questions: I have a strong suspicion that your data illustration is not a faithful representation of raw data.  Because it contains lots of parentheses "(", ")", instead of curly brackets "{" and "}" as in compliant JSON. It is almost impossible for a developer to make this kind of mistake to mix parentheses and curly brackets randomly.  Can you verify and clarify? If your raw event is pure JSON, your highlighted snippets should have already been extracted by Splunk as multivalued data{}.from, data{}.to, data{}.intensity.forecast.  Do you not get those? Alternatively, is that illustrated data from a field that is already extracted (but misrepresented with mixed parentheses and curly brackets)? Lastly, in a common logging practice is to append JSON data at the end, following some other informational strings that do not contain opening curly bracket.  If this is the case, you can easily extract that JSON part with the following and handle it robustly with spath: | rex "^[^{]*(?<json_data>.+)" | spath input=json_data path=data{} | mvexpand data{} | spath input=data{} After this, your highlighted values would be in fields from, to, and intensity.forecast, respectively. ... View more

Lastly I will figure out how to organize this by Day in desc order; right now it is sorting the results by another column...  Yes, Splunk has some weird obsession with alphabetic/ASCII ordering unless you tell it otherwise. (It kind of surprises me when the "natural" sorting order is already set in groupby (numeric on original value of "day") but Splunk changes it after adding character string "day -".)  All you need to do is to insert sort after stats and before that string conversion. When you say in desc order, I imagine that you want the reverse numeric order.  Is this correct? index=*app_pcf cf_app_name="mddr-batch-integration-flow" "posbatch04" earliest=-14d@d latest=-0d@d | eval dayback = mvrange(0, 14) | eval day = mvmap(dayback, if(_time < relative_time(now(), "-" . dayback . "d@day") AND relative_time(now(), "-" . tostring(dayback + 1) . "d@day") < _time, dayback, null())) | stats min(_time) as Earliest max(_time) as Latest by day | sort - day | fieldformat Earliest = strftime(Earliest, "%F %T") | fieldformat Latest = strftime(Latest, "%F %T") | eval day = "day -" . tostring(day + 1) | eval Elapsed_Time=Latest-Earliest, Start_Time_Std=strftime(Earliest,"%H:%M:%S:%Y-%m-%d"), End_Time_Std=strftime(Latest,"%H:%M:%S:%Y-%m-%d") | eval Elapsed_Time=Elapsed_Time/60 If you want to last day first, just  | sort day. ... View more

This is a Jmeter question, then.  Other than manual export, what other capabilities/interfaces does Jmeter provide?  Any API call that will allow you to query all test cases? (Scripted input.)  Any way to trigger export after each test?  Or simply allow scheduled export? (File input.)  Is there a hook-like mechanism to trigger an arbitrary script after test? (HEC, file input, scripted input.)  There can be other possibilities.  If you know the answer but are unfamiliar with Splunk mechanisms, What data can I index? is a good place to start.  If you do not, present the documentation to a Jmeter expert and ask. Additionally, this is a search forum.  The subject is more suitable in Getting Data In.  Even there, I doubt if many people will be intimately familiar with Jmeter. ... View more

OK, I can see what you mean now.  And I can confirm with this emulation   | makeresults format=csv data="a,b,c,d va,vb ,,vc,vd" | head 1   a b c d va vb     With little information from its official documentation, I can argue either way as to this is a feature or a bug.  But you must have a use case in mind.  How will head be used in your application, and what is your expected result? ... View more

You need to qualify your question with dataset (mockup or sanitized), SPL, and results.  I cannot reproduce what you described based on my mind-reading of your question.  But you must not rely on volunteers reading your mind. (It is never good to force people to read your mind.) ... View more

The following may look like voodoo but give it a try:-) index="test1" source="test2" run="test3" | transaction source run startswith IN [inputlookup messages.csv | fields Messages | rename Messages as search | format "(" "\"" "" "\"" "," ")" | rex field=search mode=sed "s/ *\" */\"/g"] endswith="status: PASS" #forematmagic👽 ... View more

We have a table where i see no data for few coloumns tried fillnull value=0 but its not working. Now I see this must be a tricky homework that everybody is fishing for an answer.  Let me point out that in none of your code illustrations have you demonstrated HOW you "tried" fillnull.  Could you show one example you tried, and show actual results? ... View more

What have you tried?  What is the result of your trial(s)?  Or is this some sort of homework that everybody is posting for an answer? (Yes, this exact same question came up again and again in recent days.) The syntax of fillnull is no secret: |fillnull App1 App2 App3 App4 Now, you just show us how you use it and what results do you get.  No cheating:-) ... View more

Not just Splunk.  Python also obligatorily treat "\xHH" in double quotes as escape sequences and rejects this data as JSON.  Like Splunk, it doesn't do this with "\n" if they are in input. I've no idea where those control characters (\n, \x etc.) are coming from. They are not in the data that the mainframe send to Splunk. Could you clarify the method you use to verify that \xHH are not in mainframe data?  What do you use to inspect that data?  Do you see newlines in places where "\n" shows in Splunk?  As @ITWhisperer says, Splunk doesn't have the habit of inserting characters into ingested data.  Meanwhile, mainframes use an IBM-specific character set (EBCDIC) internally.  So, when it sends data out, something has to perform conversion.  But most importantly, if you view data in mainframe terminal and do not see those characters, that's not proof that those are not in the data; even if you view data in an intermediary terminal emulator such as those on a Unix machine, those emulators can also interpret translated control characters according to IBM's definition.  After all, control characters are used to control visual effect in terminals and by definition invisible to terminal users of the native platform, and a terminal emulator is expected to interpret converted control characters according to their native functions. My hypothesis is that those control characters are present in data stream sent from mainframe.  The best solution is to either fix that on mainframe, or insert a pre-processor to escape/strip control characters. In the short term, instead of resorting to regex in a structured dataset, I recommend using regex to escape those control characters, then let Splunk's robust functions do its job.   | fields _raw | rex mode=sed "s/\\\\x/\\\\\\x/g" | spath   Using the sample data, my output is ACTION CONSOLE DATETIME JOBID JOBNAME MFSOURCETYPE MSGNUM MSGREQTYPE MSGTXT SYSLOGSYSTEMNAME SYSPLEX _raw INFORMATIONAL INTERNAL 2024-04-24 13:34:47.92 +0100 STC15694 RDSONLVP SYSLOG IEC147I   IEC147I 613-04,IFG0195B,RDSONLVP,RDSONLVP,IIII4004,449F,JE5207, RDS.VPLS.PDLY0001.PFDRL.U142530.E240220\x9C \x80\x80 A090 UKPPLX01 {"MFSOURCETYPE":"SYSLOG","DATETIME":"2024-04-24 13:34:47.92 +0100","SYSLOGSYSTEMNAME":"A090","JOBID":"STC15694","JOBNAME":"RDSONLVP","SYSPLEX":"UKPPLX01","CONSOLE":"INTERNAL","ACTION":"INFORMATIONAL","MSGNUM":"IEC147I","MSGTXT":"IEC147I 613-04,IFG0195B,RDSONLVP,RDSONLVP,IIII4004,449F,JE5207,\nRDS.VPLS.PDLY0001.PFDRL.U142530.E240220\\x9C\n \\x80\\x80","MSGREQTYPE":""} (Note all "\xHH" sequences becomes "\\xHH" in _raw.) This is an emulation you can play with and compare with real data   | makeresults | eval _raw = "{\"MFSOURCETYPE\":\"SYSLOG\",\"DATETIME\":\"2024-04-24 13:34:47.92 +0100\",\"SYSLOGSYSTEMNAME\":\"A090\",\"JOBID\":\"STC15694\",\"JOBNAME\":\"RDSONLVP\",\"SYSPLEX\":\"UKPPLX01\",\"CONSOLE\":\"INTERNAL\",\"ACTION\":\"INFORMATIONAL\",\"MSGNUM\":\"IEC147I\",\"MSGTXT\":\"IEC147I 613-04,IFG0195B,RDSONLVP,RDSONLVP,IIII4004,449F,JE5207,\\nRDS.VPLS.PDLY0001.PFDRL.U142530.E240220\\x9C\\n \\x80\\x80\",\"MSGREQTYPE\":\"\"} " ``` data emulation above ```   ... View more

@yuanliu wrote: Do you get all 0 from this? What I meant was for you to run that query standalone, not embedded in a complex search.  The purpose is to directly confirm/demonstrate that your Splunk instance performs fillnull as designed.  Nevertheless, your results with my silly test still demonstrates that fillnull works perfectly in your Splunk. Read appendcols to see why only DMM, Rej_log, and Reject have 0s, and why only three rows have zeros. But let me give some hints: Your search does not return events with the following strings:  "Letter published correctley to DMM subject", "Letter rejected due to: DOUBLE_KEY", and "Letter rejected due to: UNVALID_LOG"; but it does return events with "Letter rejected due to: UNVALID_DATA_APP". (You can verify this by, e.g., search without stats and observe; there are many other ways to verify.) makeresults in appendcols subsearch only fills 3 rows. (Do run it standalone so you understand what it does.) Now that we have established that fillnull works correctly, let me point out that this latest illustrated output contains no "empty" cells in ATM (aka "Letter published correctley to ATM subject") and Rej_app (aka "Letter rejected due to: UNVALID_DATA_APP"), the only two columns where your present search actually returns results.  Can you reproduce the problem you described? (No appendcol-makeresults business.) I also want to point out that your OP illustrated drastically different column names as your later comments.  This type of unexplained differences make volunteers' mind-reading a lot more difficult.  Always explain your dataset, desired results, logic between the two in plain language (preferably without SPL), attempted SPL and actual results, then explain how actual results differ from desired results if that's not painfully obvious - oftentimes it is not to outsiders.  If you need to change mock data/results from a previous message, immediately point out and explain those changes. The biggest discrepancy I see in your case is that, it is impossible for count in any stats command (including chart and timechart) to give "empty" output.  So, there must be some other commands AFTER stats that gives bad output.  You need to first examine/exemplify output from chart, then scrutinize every command after that to find which one/ones. ... View more

I cannot understand why you say you are not getting a "table".  Using the lookup sample you gave and the two code samples @bowesmana gave, these are results from my instance 1. Transpose alone 2. Transpose + foreach Both are just like table.  Are they not? ... View more

If I understand your question correctly, you want group matching messages to be displayed as a single string like “file put successfully”, not separately as "Inbound file processed successfully GL1025pcardBCAXX8595143691007",  "File put Succesfully GL1025pcardBCAXX8595143691007", and so on.  This is a common requirement.  But in addition to unnecessary asterisks in regex's as @ITWhisperer points out, you should group them before performing stats.  Here is the code   | eval message = if(match(message, "File put Succesfully|Successfully created file data|Archive file processed successfully|Summary of all Batch|processed successfully for file name|ISG successful Call|Inbound file processed successfully|ISG successful Call"), "file put successfully", message) | stats values(message) as message   Suppose you have events with the following values of message: message Inbound file processed successfully GL1025pcardBCAXX8595143691007 Inbound file processed successfully GL1025pcardBCAXX8595144691006 Inbound file processed successfully GL1025pcardBCAXX8732024191001 Inbound file processed successfully GL1025transBCAXX8277966711002 File put Succesfully GL1025pcardBCAXX8595143691007 File put Succesfully GL1025pcardBCAXX8595144691006 File put Succesfully GL1025pcardBCAXX8732024191001 File put Succesfully GL1025transBCAXX8277966711002 some unmatching value some other unmatching value The result will be message file put successfully some other unmatching value some unmatching value Is this what you are looking for? Here is an emulation that you can play with and compare with real data   | makeresults | eval message = mvappend("Inbound file processed successfully GL1025pcardBCAXX8595143691007", "Inbound file processed successfully GL1025pcardBCAXX8595144691006", "Inbound file processed successfully GL1025pcardBCAXX8732024191001", "Inbound file processed successfully GL1025transBCAXX8277966711002", "File put Succesfully GL1025pcardBCAXX8595143691007", "File put Succesfully GL1025pcardBCAXX8595144691006", "File put Succesfully GL1025pcardBCAXX8732024191001", "File put Succesfully GL1025transBCAXX8277966711002", "some unmatching value", "some other unmatching value") | mvexpand message ``` data emulation above ```     ... View more

Thank you for posting mock data emulation.  Obviously the app developers do not implement self-evident semantics and should be cursed. (Not just for Splunk's sake, but for every other developer's sanity.)  If you have any influence on developers, demand that they change JSON structure to something like   { "browser_id": "0123456", "browsers": { "fullName": "blahblah", "name": "blahblah", "state": 0, "lastResult": { "success": 1, "failed": 2, "skipped": 3, "total": 4, "totalTime": 5, "netTime": 6, "error": true, "disconnected": true }, "launchId": 7 }, "result": [ { "id": 8, "description": "blahblah", "suite": [ "blahblah", "blahblah" ], "fullName": "blahblah", "success": true, "skipped": true, "time": 9, "log": [ "blahblah", "blahblah" ] } ], "summary": { "success": 10, "failed": 11, "error": true, "disconnected": true, "exitCode": 12 } }   That is, isolate the browser_id field into a unique key for browser, results, and summary.  The structure you shared cannot express any more semantic browser_id than one.  But if for some bizarre reason the browser_id needs to be passed along in results because summary is not associated with browser_id in each event, expressly say so with JSON key, like   { "browsers": { "id": "0123456", "fullName": "blahblah", "name": "blahblah", "state": 0, "lastResult": { "success": 1, "failed": 2, "skipped": 3, "total": 4, "totalTime": 5, "netTime": 6, "error": true, "disconnected": true }, "launchId": 7 }, "result": { "id": "0123456", "output": [ { "id": 8, "description": "blahblah", "suite": [ "blahblah", "blahblah" ], "fullName": "blahblah", "success": true, "skipped": true, "time": 9, "log": [ "blahblah", "blahblah" ] } ] }, "summary": { "success": 10, "failed": 11, "error": true, "disconnected": true, "exitCode": 12 } }   Embedding data in JSON key is the worst use of JSON - or any structured data. (I mean, I recently lamented worse offenders, but imaging embedding data in column name in SQL!  The developer will be cursed by the entire world.) This said, if your developer has a gun over your head, or they are from a third party that you have no control over, you can SANitize their data, i.e., making the structure saner using SPL.  But remember: A bad structure is bad not because a programming language has difficulty.  A bad structure is bad because downstream developers cannot determine the actual semantics without reading their original manual.  Do you have their manual to understand what each structure means?  If not, you are very likely to misrepresent their intention, therefore get the wrong result. Caveat: As we are speaking semantics, I want to point out that your illustration uses the plural "browsers" as key name as well as singular "result" as another key name, yet the value of (plural) "browsers" is not an array, while the value of (singular) "result" is an array.  If this is not the true structure, you have changed semantics your developers intended.  The following may lead to wrong output. Secondly, your illustrated data has level 1 key of "0123456" in browsers, an identical level 1 key of "0123456" in result, a matching level 2 id in browsers "0123456", a different level 2 id in result "8".  I assume that all matching numbers are semantically identical and non-matching numbers are semantically different Here, I will give you SPL to interpret their intention as my first illustration, i.e., a single browser_id applies to the entire event.  I will assume that you have Splunk 9 or above so fromjson works. (This can be solved using spath with a slightly more cumbersome quotation manipulation.) Here is the code to detangle the semantic madness.  This code does not require the first line, fields _raw.  But doing so can help eliminate distractions.   | fields _raw ``` to eliminate unusable fields from bad structure ``` | fromjson _raw | eval browser_id = json_keys(browsers), result_id = json_keys(result) | eval EVERYTHING_BAD = if(browser_id != result_id OR mvcount(browser_id) > 1, "baaaaad", null()) | foreach browser_id mode=json_array [eval browsers = json_delete(json_extract(browsers, <<ITEM>>), "id"), result = json_extract(result, <<ITEM>>)] | spath input=browsers | spath input=result path={} output=result | mvexpand result | spath input=result | spath input=summary | fields - -* result_id browsers result summary   This is  the output based on your mock data; to illustrate result[] array, I added one more mock element. browser_id description disconnected error exitCode failed fullName id lastResult.disconnected lastResult.error lastResult.failed lastResult.netTime lastResult.skipped lastResult.success lastResult.total lastResult.totalTime launchId log{} name skipped stats success suite{} time ["0123456"] blahblah true true 12 11 blahblah blahblah 8 true true 2 6 3 1 4 5 7 blahblah blahblah blahblah true 0 true 10 blahblah blahblah 9 ["0123456"] blahblah 9 true true 12 11 blahblah blahblah9 9 true true 2 6 3 1 4 5 7 blahblah 9a blahblah 9b blahblah true 0 true 10 blahblah9a blahblah9b 11 In the table, "id" is from results[]. This is the emulation of expanded mock data.  Here, I decided to not use format=json because this will preserve the pretty print format, also because Splunk will not show fromjson-style fields automatically. (With real data, fromjson-style fields are not used in 9.x.)   | makeresults | eval _raw =" { \"browsers\": { \"0123456\": { \"id\": \"0123456\", \"fullName\": \"blahblah\", \"name\": \"blahblah\", \"state\": 0, \"lastResult\": { \"success\": 1, \"failed\": 2, \"skipped\": 3, \"total\": 4, \"totalTime\": 5, \"netTime\": 6, \"error\": true, \"disconnected\": true }, \"launchId\": 7 } }, \"result\": { \"0123456\": [ { \"id\": 8, \"description\": \"blahblah\", \"suite\": [ \"blahblah\", \"blahblah\" ], \"fullName\": \"blahblah\", \"success\": true, \"skipped\": true, \"time\": 9, \"log\": [ \"blahblah\", \"blahblah\" ] }, { \"id\": 9, \"description\": \"blahblah 9\", \"suite\": [ \"blahblah9a\", \"blahblah9b\" ], \"fullName\": \"blahblah9\", \"success\": true, \"skipped\": true, \"time\": 11, \"log\": [ \"blahblah 9a\", \"blahblah 9b\" ] } ] }, \"summary\": { \"success\": 10, \"failed\": 11, \"error\": true, \"disconnected\": true, \"exitCode\": 12 } } " | spath ``` the above partially emulates index="github_runners" sourcetype="testing" source="reports-tests" ```     ... View more

Do you get all 0 from this?   | makeresults format=csv data="Income, Rej_app, ATM, DMM, Reject, Rej_log< Rej_app ,,,,, ,,,,, ,,,,," | fillnull   This is what I get ATM DMM Income Rej_app Rej_log< Rej_app Reject 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0   ... View more

How did you apply fillnull?  Do you mean to say that the following doesn't give you 0 when the value is null? index=app-index source=application.logs |rex field= _raw "application :\s(?<Application>\w+)" | rex field= _raw "(?<Msgs>Initial message received with below details|Letter published correctley to ATM subject|Letter published correctley to DMM subject|Letter rejected due to: DOUBLE_KEY|Letter rejected due to: UNVALID_LOG|Letter rejected due to: UNVALID_DATA_APP)" |chart count over Application by Msgs |rename "Initial message received with below details" as Income, "Letter published correctley to ATM subject" as ATM, "Letter published correctley to DMM subject" as DMM, "Letter rejected due to: DOUBLE_KEY" as Reject, "Letter rejected due to: UNVALID_LOG" as Rej_log, "Letter rejected due to: UNVALID_DATA_APP" as Rej_app |table Income Rej_app ATM DMM Reject Rej_log Rej_app |fillnull Income Rej_app ATM DMM Reject Rej_log Rej_app   ... View more

Can you illustrate how you obtain incomingcount rejectedcount invalidcount topcount trmpcount topiccount?  As a habit, always share how data looks like.  If you just count stuff, there should be no "empty" column. (Also, are you asking about empty row or empty column?) For example, if you have this data set Application incoming invalid rejected top trmp top Login come something   some other     Login   some more   some stuff     Login       stuff stuff     Success come in     more stuff     and you use this to produce those count columns   | stats count(incoming) as incomingcount count(rejected) as rejectedcount count(invalid) as invalidcount count(top) as topcount count(trmp) as trmpcount count(topic) as topiccount by Application   Splunk should give you Application incomingcount rejectedcount invalidcount topcount trmpcount topiccount Login 1 0 2 3 0 0 Success 1 0 0 1 0 0 Here is my data emulation to produce that mock input.   | makeresults format=csv data="Application, incoming, rejected, invalid, top, trmp, topic Login, come, , something, some other Login, , , some more, some stuff Login, , , , stuff stuff Success, come in, , , more stuff"     ... View more

I get the impression that your requirement can be reinterpreted as listing the last two installed version and their installed times.  Is this accurate? As @bowesmana suggested, this problem would be best solved by maintaining a lookup table, then work from there.  Any search that does not use a static dataset like lookup is bound to be inefficient because your lookback period cannot be predetermined. As a proof of concept, here is a literal implementation of my interpretation of your requirement.  The premise is that you make a search with sufficient coverage for last two versions of packages of interest.  Assume that the search returns something like the following _time host package version 2024-01-21 host1 somesoft1 1.2.1 2024-01-21 host2 somesoft2 2.2.3 2024-03-02 host1 somesoft1 1.2.5 2024-03-03 host2 somesoft2 2.3.0 2024-04-10 host1 somesoft1 1.2.10 You then apply the following:   <some search with sufficient history> | stats max(_time) as _time by package version | eval version = json_object("version", version, "install_time", _time) | stats list(version) as version_installed by package | eval version = json_extract(mvindex(version_installed, -1), "version"), "installed date" = json_extract(mvindex(version_installed, -1), "install_time") | eval last_version = json_extract(mvindex(version_installed, -2), "version"), "last installed date" = json_extract(mvindex(version_installed, -2), "install_time") | fieldformat "installed date" = strftime('installed date', "%F") | fieldformat "last installed date" = strftime('last installed date', "%F") | fields - version_installed   This should give a table like this package installed_date last installed date last_version version somesoft1 2024-03-02 2024-04-10 1.2.10 1.2.5 somesoft2 2024-03-03 2024-01-21 2.2.3 2.3.0 What the code really illustrates is the general approach of a semantic "join" without using join command.  stats is a lot more efficient in SPL.  lookup, using binary search, is another very efficient method. Here is an emulation that produces the mock search output above.  Play with it and compare with real data.   | makeresults format=csv data="_time,host,package,version 2024-01-21,host1,somesoft1,1.2.1 2024-01-21,host2,somesoft2,2.2.3 2024-03-02,host1,somesoft1,1.2.5 2024-03-03,host2,somesoft2,2.3.0 2024-04-10,host1,somesoft1,1.2.10" | eval _time = strptime(_time, "%F") ``` data emulation above ```     ... View more

Do you mean to say that each event contains a row of headers and another row of values like the following? Test1 Test2 Test3 Test4 Test5 Test6 Test7 Test8 Test9 Test 10 101 102 103. 104. 105. 106. 107. 108. 109. 110 The easiest is like @gcusello suggested, create a form to match this format, then use kvform. No matter which method you use, you have to answer one question: What is the delimiter?  Obviously there is no comma.  But it is totally unclear whether the delimiter would be one space character, one tab character, or any number of white space characters can be interpreted as one delimiter.  Suitable solution can be different when delimiter is different. Here I illustrate a solution without using kvform that works with any number of white spaces between fields.   | rex mode=sed "s/\n/::/ s/\s+/,/g s/::/ /" | multikv   Your sample data will give you Test1 Test10 Test2 Test3 Test4 Test5 Test6 Test7 Test8 Test9 101 110 102 103. 104. 105. 106. 107. 108. 109. As I said, this is just one possible solution, and is most suitable if the number of white spaces (and even type of white spaces) between fields cannot be predetermined AND that field names and values do not contain any white space. Here is an emulation that you can play with and compare with real data   | makeresults | eval _raw = "Test1 Test2 Test3 Test4 Test5 Test6 Test7 Test8 Test9 Test10 101 102 103. 104. 105. 106. 107. 108. 109. 110" ``` data emulation above ```   ... View more

You are avoiding answer the question everybody asks: What is your actual data structure?  Is it close to what I speculated?  Further, you have never illustrated what is expected output.  So, the two screenshots with only timestamps means nothing to volunteers.  How can we help further? Specifically,  WHY should the output NOT have multiple timestamps after deduping application, name and target url?  In your original SPL, the only dedup is on x, which is Application+Action+Target_URL.  How is this different?  Anything after mvexpand in my search is based on my reading of your intent based only on that complex SPL sample.  Instead of making volunteers to read your mind, how about expressing the actual dataset, the result you are trying to get from the data, and the logic to derive the desired result and dataset in plain language (without SPL)? ... View more

First, some quick comment.  Judging from your attempted SPL, and your tendency to think "join", Splunk is not laughing.  It is just a stranger to you.  And strangers can be intimidating.  I often keep a browser tab open with https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ so I can easily lookup what's available, and what syntax any command or function requires.  For example, Time modifiers describe in much detail what you can give as earliest and latest.  MaxTime is just not a thing in SPL.  If MaxTime is a field you calculated previously, you cannot easily pass it into a subsearch (which is what join command must call).  For this latter point to strike home, you will need some more familiarity about how Splunk work.  Splunk's Search Manual can be a good start point to learn those. Back to your actual use case, technically you can make Splunk do exactly what you wanted.  But as I hinted above, Splunk - and Splunk practitioners like me, intimidate, nay bully those who dare to join.  Unless absolutely necessary, just use a Splunk-friendly query to achieve the same goal.  It will benefit you in the short term as well as long. You mention time periods you tried to connect the two searches, but give no indication as to what is the link between the two searches.  It seems obvious that you are not trying to "join" the two searches by _time.  So, there must be some other logic other than just wanting to set time interval differently.  Can you describe the actual logic in your use case?  What is the output you are trying to get?  What are some data characteristics that help you arrive at your output?  Illustrate in concrete terms or mockup data. ... View more

You recognize that this is a Splunk forum where volunteers offer help related to Splunk, right?  As I said, Splunk does not "color" search results. (The only coloring function in Splunk is provided in dashboard visualization.)  If you want to color text, you will need to develop something external to Splunk.  As you suggested, you can possibly achieve this by modifying sendmail.py (not recommended).  Alternatively, you can develop a custom command for this.  Either way, this is not the right forum. ... View more

mvzip, mvexpand and mvindex are simply wrong tools for your data structure. (Well, mvexpand will be needed, but only after you properly handle the array in your data.)  As everybody in this post has pointed out: You need to post sample or precise mock data to reveal the structure. (In text, never screenshot.) This is extremely important when asking question about data analytics in a forum.  When you force volunteers to read your mind, not only will they get FRUSTRATED, but even if they are willing, most of the time their mind reading will be incorrect. This said, based on your code, I kind of picture together a rough structure of your data.  I will use JSON to illustrate.  Something like   { "userActions": [ { "application": "app1", "name": "action1", "targetUrl": "url1", "duration": 1234, "type": "actiontype1", "apdexCategory": "SATISFIED" }, { "application": "app1", "name": "action2", "targetUrl": "url1", "duration": 2345, "type": "actiontype1", "apdexCategory": "DISATISFIED" }, { "application": "app1", "name": "action3", "targetUrl": "url2", "duration": 3456, "type": "actiontype2", "apdexCategory": "FRUSTRATED" } ], "userExperienceScore": "FRUSTRATED", "events": [ {"application": "xxx", "irrelevant": "aaa"}, {"application": "yyy", "irrelevant": "bbb"} ] }     Your event could be in JSON or it could be in XML, but it contains at least two arrays, events[] and userActions[].  Is this correct?  The array events[] is not what frustrates you because its elements and components are no longer needed after initial search.  Your end goal from the above three elements of userActions[] is to pick out   { "application": "app1", "name": "action3", "targetUrl": "url2", "duration": 3456, "type": "actiontype2", "apdexCategory": "FRUSTRATED" }   and display it in this format: _time Application Action Target_URL Duration_in_Mins User_Action_Type useractions_experience_score 2024-04-18 22:45:22 app1 action3 url2 0.06 actiontype2 FRUSTRATED If the above looks close, the first thing you need to do is to forget all about Splunk's flattened fields userActions{}.*; in fact, discard them all.  Use spath to reach elements of this array, then mvexpand over the elements, no funny mvzip business.  After that, everything becomes trivial. Using my speculated data, I can reconstruct your SPL into the following to obtain my illustrated output:     index="xxx" sourcetype="xxx" source=xxx events{}.application="xxx" userExperienceScore=FRUSTRATED | fields - userActions{}.* | spath path=userActions{} | mvexpand userActions{} | spath input=userActions{} | dedup application name targetUrl | search apdexCategory = FRUSTRATED application = * name = * | sort - _time | rename application as Application, name as Action, targetUrl as Target_URL, type as User_Action_Type, apdexCategory as useractions_experience_score | eval Duration_in_Mins = round(duration / 60000, 2) | table _time, Application, Action, Target_URL,Duration_in_Mins,User_Action_Type,useractions_experience_score   Hope this helps. Here is an emulation of my speculated data.  Play with it and compare with real data | makeresults | eval _raw = "{ \"userActions\": [ { \"application\": \"app1\", \"name\": \"action1\", \"targetUrl\": \"url1\", \"duration\": 1234, \"type\": \"actiontype1\", \"apdexCategory\": \"SATISFIED\" }, { \"application\": \"app1\", \"name\": \"action2\", \"targetUrl\": \"url1\", \"duration\": 2345, \"type\": \"actiontype1\", \"apdexCategory\": \"DISATISFIED\" }, { \"application\": \"app1\", \"name\": \"action3\", \"targetUrl\": \"url2\", \"duration\": 3456, \"type\": \"actiontype2\", \"apdexCategory\": \"FRUSTRATED\" } ], \"userExperienceScore\": \"FRUSTRATED\", \"events\": [ {\"application\": \"xxx\", \"irrelevant\": \"aaa\"}, {\"application\": \"yyy\", \"irrelevant\": \"bbb\"} ] }" | spath ``` data speculation for index="xxx" sourcetype="xxx" source=xxx events{}.application="xxx" userExperienceScore=FRUSTRATED ``` ... View more

Have you tried my previous code? | eval route = if(match(request_path, "^/orders/\d+"), "/order/{orderID}", null()) This does exactly what you ask: create a new field named route that has a fixed pattern "/order/{orderID}".  Is there anything wrong with this? In fact, because you really only care about first segment of the path - that fixed string "{orderID}" is just a decoration, the command could be simplified to slightly less expensive | eval route = "/" . mvindex(split(request_path, "/"), 1) . "/{orderID}" You can do whatever analysis against this field. ... View more