That's a nice trick! ... View more

I've found https://splunkbase.splunk.com/app/3120/ to be an effective way of showing calls between different components - with the length of the bars being the time taken for the call to complete.  Get your data into a table of the following format: | table startTime rowName category timeInMs Then select the Timeline visualisation (once installed), and Format it with the option: 'use colour'. ... View more

An alternative to | eval country_scheme = country . ":" . scheme is to use strcat: | strcat country ":" scheme country_scheme | timechart count BY country_scheme ... View more

Here's a more generic approach: The following refinement of @martinh3's approach will remove all namespace prefixes (leaving the namespace declarations, which will simply do nothing) in one hit: rex field=_raw mode=sed "s/(<\/?)([\w\d-]+):(\w+)([ \/>])/\1\3\4/g" This will remove all namespace prefixes made up of word characters, numbers or "-". If you are simply applying this to the whole raw message, then you can actually leave out 'field=_raw' or if you have extracted your XML into a field as part of a search, the replace 'field=_raw' with 'field=yourfieldname'. ... View more

Hi @triest, If I understand correctly, then try appending the following as I think this may do what you want: | eval actual=if(searchmatch("expected=1"), filter, "") Note the quotes inside the searchmatch() - without which you'd get "Error in 'eval' command." I've appended it to your query, which gave the following output when I ran it, with the 'actual' column showing the filters that matched, or empty if they didn't: filter index expected actual index=foo foo 1 index=foo index=foo bar 0 index=bar bar 1 index=bar index=bar foo 0 index=foo OR index=bar foo 1 index=foo OR index=bar index=foo OR index=bar bar 1 index=foo OR index=bar Is this what you were trying to do? ... View more