The contents of my lookup file, test12345.csv is shown below. ProductNumber,SerialNumber,StatusDateTime,Status "A12345 ","MA00000001 ","2021-08-31 01:30:47 ","SHIPPED "   There is some space found "   " at the end of each record. The inputlookup would capture all the records with a spacing at the end which disrupts my joins to work properly. Is there anyway I can remove the spacing at the end of each record after using inputlookup? ProductNumber =A12345 SerialNumber =MA00000001 StatusDateTime =2021-08-31 01:30:47 Status=SHIPPED ... View more

Currently my Splunk Search is shown as below: Serial Description DateTime StartTime EndTime MY111 Registration 2021-05-01 00:30:00 2021-05-01 00:30:00   MY122 Registration 2021-05-02 09:00:00 2021-05-02 09:00:00   MY134 Registration 2021-05-02 09:30:00 2021-05-02 09:30:00   MY122 Picking 2021-05-02 10:00:00   2021-05-02 10:00:00 MY134 Picking 2021-05-02 12:00:00    2021-05-02 12:00   However, there are some Serial that have not reached EndTime yet (only Registration description). How I can get the duration (in seconds) for those serial that completed (Have both Registration & Picking description) Expected Outcome: Serial Description DateTime StartTime EndTime Duration MY111 Registration 2021-05-01 00:30:00 2021-05-01 00:30:00     MY122 Registration 2021-05-02 09:00:00 2021-05-02 09:00:00     MY134 Registration 2021-05-02 09:30:00 2021-05-02 09:30:00     MY122 Picking 2021-05-02 10:00:00   2021-05-02 10:00:00 3600 MY134 Picking 2021-05-02 09:40:00    2021-05-02 09:40:00 600 ... View more

I created some of the columns using regex. So all of the codes for the regex needs to be included. I would like to find the total duration based on StationName. StationName          Duration ABC123                        100 ABC123                        200 ABC456                         50   When I pasted this query at the end of my codes, it only shows the StationName but the sum of Duration column is empty. How can I get the sum of duration based on StationName? | stats sum(Duration) by StationName ... View more

I would like TestResult to give output "1" if there are "Pass" or "Completed" in Status and "0" if otherwise. How to change this query below to check for both strings? | eval TestResult=if(like(Status, "%Completed%"), 1, 0) ... View more

I would like to extract two groups which are TestName and Model. In the second row, the TestName is connected to Model cannot be extracted as two different groups. Link for regex: regex101: build, test, and debug regex ... View more

I have a field "Date" as below. However, there are some inconsistency in the date format.  How can I get the "30/1/2021" and change it to "1/30/2021" following the rest of the date format?   Date 4/16/2021 3/31/2021 2/28/2021 30/1/2021 2/13/2021 ... View more

After using transactions my "raw" field looks something like this. I want to limit the amount of rows captured  by transaction to be not more than 2?  Is there anyway I can add to my query now  | transaction startswith=TestResult="Start" raw 4015_ABCD, Start, 8/11/2020 5:37:10 PM, 12345 4015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345 4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345 1113_EFGH, Start, 8/12/2020 12:00:00 PM, 67890 1113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890 1119_EFGH, Complete, 8/12/2020 2:00:00 PM, 67890 ... View more

I used transaction to combine 2 rows of raw fields: raw 4015_ABCD, Start, 8/11/2020 5:37:10 PM, 12345 4015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345 4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345 1113_EFGH, Start, 8/12/2020 12:00:00 PM, 67890 1113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890   Is there a simple way to split the raw field into "raw1" and "raw2" as below (preferably without using rex)? raw raw1 raw2 4015_ABCD, Start, 8/11/2020 5:37:10 PM, 12345 4015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345 4015_ABCD, Start, 8/11/2020 5:37:10 PM, 12345 4015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345 4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345 4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345   1113_EFGH, Start, 8/12/2020 12:00:00 PM, 67890 1113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890 1113_EFGH, Start, 8/12/2020 12:00:00 PM, 67890 1113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890 ... View more

The raw data was uploaded from a .txt file. I managed to create the table as below. raw TestFeatureName Status DateTime Station 4015_ABCD, Start, 8/11/2020 5:37:10 PM, 12345 4015_ABCD Start 8/11/2020 5:37:10 PM 12345 4015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345 4015_ABCD Complete 8/11/2020 5:37:30 PM 12345 4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345 4015_ABCD Start 8/12/2020 10:23:34 AM 12345 1113_EFGH, Start, 8/12/2020 12:00:00 PM, 67890 1113_EFGH Start 8/12/2020 12:00:00 PM 67890 1113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890 1113_EFGH Complete 8/12/2020 1:00:00 PM 67890   Are there any ways to combine two "raw" events based on the "status" field. My expected result for "raw" field: raw 4015_ABCD, Start, 8/11/2020 5:37:10 PM, 123454015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345 4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345 1113_EFGH, Start, 8/12/2020 12:00:00 PM, 678901113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890 ... View more

Right now I have a table with fields: DateTime, TestFeatureName and Status. How can I create another field "Occurrence" that can count the number of occurrence for each Start-Complete as below? DateTime TestFeatureName Status Occurrence 10.00 pm ABC Start 1 10.20 pm ABC Complete 1 10.40 pm ABC Start 2 10.45 pm ABC Complete 2 11.10 pm DEF Start 3 11.30 pm DEF Complete 3 ... View more

So what I have now from my search so far Product     Status    Time A                   Start        8.00 AM A                    A1            8.05 AM A                    A2            8.15 AM A                    End          8.20 AM A                   Start         8.40 AM A                    End          9.40 AM Right now I only get the second start-end duration = 60 minutes only. How can I get it to show the first start-end duration = 20 minutes as well? The "Product" name needs to be the same. |makeresults |eval product="A"|eval status="Start A1 A2 End Start End"|makemv status|mvexpand status |appendcols [|makeresults|eval time="08:00 08:05 08:15 08:20 08:40 09:40"|makemv time|mvexpand time ] |rename COMMENT as "Dummy data ends here" |eval time=strptime(time,"%H:%M") |stats max(eval(if(status=="Start",time,null()))) as Start_Time,max(eval(if(status=="End",time,null()))) as End_Time by product |eval duration=round((End_Time-Start_Time)/60) ... View more

Description                      Recorded value for [Turn On Test 123] Recorded value for [Turn On Test 456] Execute all Appliances In process to Execute   I would like to create another field name "Status" whereby it only extract "Turn On" for "Recorded value for [Turn On Test xxx]" and "Execute" for "Execute all Appliances" & "In process to Execute" ... View more

So what I have now from my search so far Product     Status    Time A                   Start        8.00 AM A                    A1            8.05 AM A                    A2            8.15 AM A                    End          8.20 AM Is there anyway I can get the duration (End - Start) = 20 minutes and then display as Duration for Product A as 20 minutes? ... View more