I've tried spath but not seeing fields getting extracted properly. ... View more

Thanks. This is what I ended up doing awhile ago: |gentimes start=-365 end=0 increment=1d |eval endtime=case(strftime(now(),"%A")="Saturday",endtime - (1*86400),strftime(now(),"%A")="Sunday",endtime - (2*86400),strftime(now(),"%A")="Monday",endtime - (3*86400),strftime(now(),"%A")="Tuesday",endtime - (4*86400),strftime(now(),"%A")="Wednesday",endtime - (5*86400),strftime(now(),"%A")="Thursday",endtime - (6*86400),strftime(now(),"%A")="Friday",endtime - (7*86400)) |eval Date=strftime(endtime,"%m-%d-%Y") |eval day_of_week = strftime(endtime,"%A") |where NOT (day_of_week="Saturday" OR day_of_week="Sunday") ... View more

Sorry, perhaps I didn't explain well enough . I need splunk to generate the number of hours per calendar month excluding weekends so I can then use the values in an EVAL and CASE statement. So imagine a lookup file as follows: MM-YYYY | Hours Jan-2018 535 Feb-2018 425 Mar-2018 545 (Except I don't want to use a lookupfile given the manual work to create and maintain it) ... View more

Sorry, let me provide more detail. I need splunk to generate the number of hours by calendar month excluding weekends and then use that value in a calculation. Once I have the ability to create the values I then need to use the value in a calcuation using EVAL and CASE. So imagine a lookup file that would have the following info : Month-YYYY | Hours Jan-2018 | 525 Feb-2018 | 463 Mar-2018 | 535 ... Except I don't want to use a lookup file as solution given the manual work involved. ... View more

Thanks i'm getting closer. Now what's happenig is the first time I select a token value the below condition returns the proper results in my chart. However, when I then select a different token value, the chart using $CarTypeColor3$ (only 1 chart out of 4 on the dashboard use this new variable) continues to hold onto the original value and doesn't refresh but all the other charts tied to $CarType_Color$ do refresh properly. It's like the $CarTypeColor3$ variable is getting fixed and the only way to clear it is click edit and save the dashboard again. A full close out and reload doesn't work. <label>CarType_Color</label> <fieldForLabel>CarType</fieldForLabel> <fieldForValue>CarType</fieldForValue> <search> <query>| inputlookup CarCompare.csv | fields CarType | dedup CarType | sort CarType</query> </search> <change> <set token="CarTypeColor2">$CarType_Color$</set> <eval token="CarTypeColor3">case(like($CarTypeColor2$,"%BLUE"),substr($CarTypeColor2$,1,len($CarTypeColor2$)-4) +"RED", like($CarTypeColor2$,"%RED"),substr($CarTypeColor2$,1,len($CarTypeColor2$)-3) +"BLUE", true(),"N/A")</eval> </change> </input> ... View more

Sorry, the scrubed data example I provided wasn't clear enough. Imagine that there are dozens of car types that are blue and red (among other colors) in my inputlookup file. What I'm interested in finding is when one specific car type and color is selected, like "HONDA_BLUE", instead of returning all the inputllookup csv fields with information on "HONDA_BLUE", I want to convert that input to be "HONDA_RED" and retrieve all the fields in the lookup file where cartype = HONDA_RED. So the case statement to convert the to RED or BLUE looks good, but what I can't seem to do is feed the converted cartype value into a new search to retreive the right fields. As you pointed out there is no need for the null. It can just be "N/A". ... View more