Thanks. Done. https://ideas.splunk.com/ideas/EID-I-51 ... View more

So very close -- only thing missing was a couple closing parens! | eval Delta=null() | foreach 2* [| eval Delta=if(isnull(Delta),'<<FIELD>>' ,(('<<FIELD>>'-'Delta')*100/'Delta')) ] TYVM!!! I'm happy for another 979 years! ... View more

Old thread, I know, but here's an answer for anyone looking for this in the future. Our fiscal year starts in October. I use the following in our DateTime Picker (defined in User Interface > Time Ranges😞 This Fiscal Year: earliest=-3q@y+3q latest=+q@y+3q Previous Fiscal Year: earliest=-y-3q@y+3q latest=-y+q@y+3q Haven't extensively tested it through a full year's range, but at least on paper it looks good, at least for those instances where the fiscal year boundary corresponds to a quarterly boundary. For This Fiscal Year, the calculation basically is to back up 3 quarters from the current date, snap to the year, and add 3 quarters to it; the latest is to add one quarter to the current date, get the year, and add 3 quarters to that. Previous FY just backs up a year before doing the same calculation. e.g. #1: Jan 1, 2020, earliest = (Jan 1, 2020 - 3 quarters) = Mar 1, 2019 = snap to 2019 + 3 quarters = Oct 2019 e.g. #2: Sep 30, 2020, earliest = (Sep 30, 2020 - 3 quarters) = Dec 30, 2019 = snap to 2019 + 3 quarters = Oct 2019 Other examples and customizing for your fiscal year boundaries are left to the reader. But do let me know if you find a flaw with this approach! ... View more

Would this setting have any pertinence? Should it be "none" instead of "json"? Will that accomplish the same as setting the AUTO_KV_JSON, but for this one sourcetype only? ... View more

Here's the results of the btool command; I don't know how to parse this, hope you can let me know if there's anything pertinent: /Applications/Splunk/etc/apps/search/local/props.conf [dateTimeJSON] /Applications/Splunk/etc/system/default/props.conf ADD_EXTRA_TIME_FIELDS = True /Applications/Splunk/etc/system/default/props.conf ANNOTATE_PUNCT = True /Applications/Splunk/etc/system/default/props.conf AUTO_KV_JSON = true /Applications/Splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE = /Applications/Splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE_DATE = True /Applications/Splunk/etc/system/default/props.conf CHARSET = UTF-8 /Applications/Splunk/etc/apps/search/local/props.conf DATETIME_CONFIG = /Applications/Splunk/etc/system/default/props.conf DEPTH_LIMIT = 1000 /Applications/Splunk/etc/system/default/props.conf HEADER_MODE = /Applications/Splunk/etc/apps/search/local/props.conf INDEXED_EXTRACTIONS = json /Applications/Splunk/etc/system/default/props.conf LEARN_MODEL = true /Applications/Splunk/etc/system/default/props.conf LEARN_SOURCETYPE = true /Applications/Splunk/etc/apps/search/local/props.conf LINE_BREAKER = ([\r\n]+) /Applications/Splunk/etc/system/default/props.conf LINE_BREAKER_LOOKBEHIND = 100 /Applications/Splunk/etc/system/default/props.conf MATCH_LIMIT = 100000 /Applications/Splunk/etc/system/local/props.conf MAX_DAYS_AGO = 5000 /Applications/Splunk/etc/system/default/props.conf MAX_DAYS_HENCE = 2 /Applications/Splunk/etc/system/default/props.conf MAX_DIFF_SECS_AGO = 3600 /Applications/Splunk/etc/system/default/props.conf MAX_DIFF_SECS_HENCE = 604800 /Applications/Splunk/etc/system/default/props.conf MAX_EVENTS = 256 /Applications/Splunk/etc/system/default/props.conf MAX_TIMESTAMP_LOOKAHEAD = 128 /Applications/Splunk/etc/system/default/props.conf MUST_BREAK_AFTER = /Applications/Splunk/etc/system/default/props.conf MUST_NOT_BREAK_AFTER = /Applications/Splunk/etc/system/default/props.conf MUST_NOT_BREAK_BEFORE = /Applications/Splunk/etc/apps/search/local/props.conf NO_BINARY_CHECK = true /Applications/Splunk/etc/system/default/props.conf SEGMENTATION = indexing /Applications/Splunk/etc/system/default/props.conf SEGMENTATION-all = full /Applications/Splunk/etc/system/default/props.conf SEGMENTATION-inner = inner /Applications/Splunk/etc/system/default/props.conf SEGMENTATION-outer = outer /Applications/Splunk/etc/system/default/props.conf SEGMENTATION-raw = none /Applications/Splunk/etc/system/default/props.conf SEGMENTATION-standard = standard /Applications/Splunk/etc/system/default/props.conf SHOULD_LINEMERGE = True /Applications/Splunk/etc/apps/search/local/props.conf TIMESTAMP_FIELDS = DateDeleted /Applications/Splunk/etc/system/default/props.conf TRANSFORMS = /Applications/Splunk/etc/system/default/props.conf TRUNCATE = 10000 /Applications/Splunk/etc/apps/search/local/props.conf category = Structured /Applications/Splunk/etc/apps/search/local/props.conf description = Get the right date from record with multiple dates included. /Applications/Splunk/etc/system/default/props.conf detect_trailing_nulls = false /Applications/Splunk/etc/apps/search/local/props.conf disabled = false /Applications/Splunk/etc/system/default/props.conf maxDist = 100 /Applications/Splunk/etc/system/default/props.conf priority = /Applications/Splunk/etc/apps/search/local/props.conf pulldown_type = 1 /Applications/Splunk/etc/system/default/props.conf sourcetype = ... View more

Yes, all the CSV data which goes back 1 year have single entries. Only the JSON we input today is duplicated. I was only able to find the one props.conf with [dateTimeJSON] in it, in etc/apps/search/local/. Should also mention, 8.0.1. ... View more

[dateTimeJSON] DATETIME_CONFIG = INDEXED_EXTRACTIONS = json LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true TIMESTAMP_FIELDS = DateDeleted category = Structured description = Get the right date from record with multiple dates included. disabled = false pulldown_type = 1 ... View more

We were having this problem with 7.2.6, and the issue was resolved with the 7.3 update -- though I could not find any reference to it in the release notes. The contents of the sendemail.py program look markedly different, so obviously a lot of code therein was touched by this update. Just glad it's working again, Aaron ... View more

Oh, sure they do, but that’s easy, and in a different panel on their dashboard; they get to see the whole of the previous 3 years with an annual timewrap. This single month over month is just a single panel on that dashboard that they’re used to seeing from our old manually collected and processed stats report. ... View more

Nope. Still way too complex. The users don't need to be able to select a month, we just need to be able to show them last month's data over the same month a year ago. We have a very seasonal business, and we want them to see how things have changed year over year for the most recent month. That's why I need to be able to limit the search to just the specified month name/number. If this were June of 2018, I want to display the sum of the counts for May of 2018 AND May of 2017. Accordingly, I went on a dig and read a lot more documentation and examples, and came up with this: tag=PeopleCounters earliest=-13mon@mon latest=@mon | eval lastMonth=strftime(relative_time(now(),"-1mon@mon"),"%B") | where match(date_month,lower(lastMonth)) | chart sum(count) as Traffic by date_year This does what I wanted. Thanks for trying! ... View more

Nice try, but I've already limited the range of years with the -13mon@mon. Instead, I need a variable with the month name so that I can search for date_month=$lastmonth$. Hope that makes more sense. Thanks. ... View more