Hello Everyone! I have a use case to receive the the year(s) and(or) quarter(s) as inputs from user and calculate the reports with a date field based on them in the Splunk dashboard For example, Year Input multiselect dropdown : y1, y2, y3,y4, y5(current year) Quarter Input multiselect dropdown : q1, q2, q3, q4 Let the date field be d1  Let the values of x - axis be a1, a2, a3, a4,... Let the calculated values of y - axis be b1, b2, b3, b4,.... Input Selection Scenario 1: If the user selects y2, y3 and y5 , Then the report should have 3 three columns for each value of x-axis with one column for one selected year with the values of d1 falling within the respective year x-axis          y-axis - Expected Output Columns a1                                                  y2 - calculated value where d1 falls within y2                                                         y3 - calculated value where d1 falls within y3                                                         y5 - calculated value where d1 falls within y5 a2                                                  y2                                                        y3                                                        y5 a3.... Input Selection Scenario 2: If the user selects y2, y3 , y5, q1, q2,q3 , Then the report should ideally have 9 three columns for each value of x-axis with one column for one selected year and quarter combination with the values of d1 falling within the respective year and quarter combination. x-axis          y-axis - Expected Output Columns a1                                                  y2, q1 - calculated value where d1 falls within q1 of y2                                                         y2, q2 - calculated value where d1 falls within q2 of y2                                                         y2, q3 - calculated value where d1 falls within q3 of y2                                                         y3, q1 - calculated value where d1 falls within q1 of y3                                                         y3, q2 - calculated value where d1 falls within q2 of y3                                                         y3, q3 - calculated value where d1 falls within q3 of y3                                                         y5, q1 - calculated value where d1 falls within q1 of y5 (as y5 is the current year,                                                                           we have data only for q1) a2                                                  y2, q1                                                         y2, q2                                                         y2, q3                                                         y3, q1                                                         y3, q2                                                         y3, q3                                                         y5, q1 a3.... Input Selection Scenario 3: If the user selects q1, q3 and q5 , Then the report should ideally have 3 three columns for each value of x-axis with one column for one selected quarter with the values of d1 falling within the respective quarter for the current year. x-axis          y-axis - Expected Output Columns a1                                                 q1 - calculated value where d1 falls within q1 of y5 (as y5 is the current year,                                                                           we have data only for q1 a2                                                 q1 a3.... Can you please help me on how to receive the inputs, calculate the earliest and latest for input combinations dynamically and display the columns based on the input selection? Thank you in advance. ... View more

Hello Everyone! I have an output in the below format and would like to filter the duplicate ids with 'fieldA' value as zero then calculate 'fieldA' in the place of zeros Current Output:                                                             filtered Outpt:                                                  Required Output id                     fieldA                                                        id                     fieldA                                           id                     fieldA             101            54236.0100                                             101            54236.0100                                101            54236.0100 101            4526441.012                                          101            4526441.012                              101            4526441.012 102                     0                                                           102                     0                                               102             fieldB-fieldC 103           4479652.2456                                         103           4479652.2456                            103           4479652.2456 103                     0                                                            103                     0                                              103            fieldB-fieldC 104                476526                                                   104                476526                                      104                476526 105                     0                                                            105                     0                                               105            fieldB-fieldC 105                     0 I have tried various stats commands but was not able to achieve this. Can you please help me on how to get the required output? Thank you in advance ... View more

Hello Everyone! I have to generate a time chart for a calculated average with below sample query.    Sample Query:  |streamstats ..... by id |where.... |eval ... |eval.... |stats  min(diff) as value1 by id |stats  avg(value1 ) as valueA  count  as Total   I would like to have a time chart for the  'valueA'  with time. I tried various ways to infuse a chart but was not able. Please let me know how to create a chart for the average over time.   ... View more