I'm trying to do a strptime on this time, 2015-09-01T01:03:22 . This is the query I'm running, index=[redacted] sourcetype=[redacted] | eval date=strptime(DESCRIPTION, %Y-%m-%dT%H:%M:%S) | dedup date| head 5 | table date . But when I run the query, Splunk yells at me saying "Error in 'eval' command: The expression is malformed. An unexpected character is reached at '%Y-%m-%dT%H:%M:%S)'." ... View more

I'm trying to search by a specific date, so I wanted to return the date to an eval, but when I run it, I get the message: Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'. This is the search I'm running: | eval thedate=[return index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | stats first(_time) as _time] | table thedate -------------------------------------- EDIT: 8/27/15 9:49am -------------------------------------- So I realize now that I was using the return command incorrectly, here's what I'm getting now: | eval thedate=[search index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | return _time] | table thedate But I'm still getting the error: Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]) ... View more

I'm currently doing a DB Connect Dump every hour, and the query produces multiple rows. How do I display only those rows as a table? To explain the question in more detail, here is an example. For example, lets say the time currently is 4:38pm, the database was queried at 4:00pm, and I want to display the only the results from that query at 4:00pm. This is what the index could look like: _time | Count 8/11/2015 4:00pm | 1512456 8/11/2015 4:00pm | 1645241 8/11/2015 4:00pm | 5768575 8/11/2015 4:00pm | 2178565 8/11/2015 4:00pm | 5678688 8/11/2015 4:00pm | 8725768 8/11/2015 3:00pm | 4515351 8/11/2015 3:00pm | 6437567 8/11/2015 3:00pm | 1244795 8/11/2015 3:00pm | 2024553 8/11/2015 3:00pm | 8823452 So the Splunk search query should only return all results which occurred at 4:00pm. After looking around, I thought maybe I can use the return function to get the first timestamp and use that to create a search query, but splunk didn't like that. Below is the query I just mentioned: eval timestamp=[search index=[redacted] sourcetype=[redacted] | stats first(_time) as "time" | return time] | append [search index=[redacted] sourcetype=[redacted] _time=timestamp] | table [redacted] ... View more

I'm trying to get the average memory and CPU usage by the hour. Unfortunately, that information is stored on two different indexes, so I appended the CPU results with the memory results, and used bucket to get the result hourly. But I'm now getting the average of each hour. index=[redacted] host=[redacted] sourcetype=[redacted] earliest=-24h@h latest=@h | multikv fields memUsedPct | append [search index=[redacted] host=[redacted] sourcetype=cpu earliest=-24h@h latest=@h | multikv fields pctIdle | search CPU=all | eval cpuUsedPct=100-pctIdle] | sort _time | bucket _time span=60m | eval Time=strftime(_time, "%m/%d/%y %H:%M") | stats avg(cpuUsedPct) as "CPU Percent" by Time, avg(memUsedPct) as Percent by Time When I execute the search, I get the error: Error in 'stats' command: Repeated group-by field 'Time'. and I'm assuming this is because I get the average of two different fields by Time ... View more