Hi, I have a splunk search which give back the testcase_id's. I need a button which call a rest API request. Rest API input should the testcase_id from splunk search. and separate the testcase_id with coma.   ... View more

Hi, i am a beginner. I have 2 sourcetype (table). One of conatins requirement_id other ones conatins Testcase_id and requirement_id. Must have: Join Testcase_id sourcetype to Requirement_id   Note: Sorting (ordering of Testcase_id sourcetype is not a solution, because requirment_id souercetype  table contains many other important attribute which is missing Testcase_id sourcetype. Requirement id 1 2 3 4 5 Testcase_id Requirement_id 14 1 14 2 14 3 87 1 87 2 87 3 76 4 67 4 45 5   My Expectation: Requirement_id Testcase_id 1 14 1 87 2 14 2 87 3 14 3 87 4 76 4 67 5 45 ... View more

I would like to listed those events (reuirements) which state are changed to Agreed from last 3 days. Today have a database with 4 requirements which state is Agreed. Example: /   ID_3 is changed to Agreed / _time    ID   Req_status 05/14   1     Agreed 05/14   2    Agreed 05/14   3     Agreed 05/14   4     Agreed /  05/13 only 3 requirements which state Agreed ID_2 is changed to Agreed at 05/12 / _time    ID   Req_status 05/13   1     Agreed 05/13   2    Agreed 05/13   4    Agreed /  05/12 only 2 requirements which state Agreed  ID_1 is changed to Agreed at 05/12/ _time    ID   Req_status 05/12   1     Agreed 05/12   4    Agreed /  05/11 only 1 requirements which state Agreed / _time    ID   Req_status 05/11   4    Agreed Expectations:  The last 3 days has arrived 3 new requirements. I would like to listed those requirements which arrives newly. 05/13   1     Agreed 05/13   2    Agreed 05/13   3    Agreed Thanks for help! ... View more

Hi All, I am a newbie in Splunk world and looking for some help in structuring my query. I have an index with data like this -           index="something" sourcetype="Datas" State="Agreed" _tim ID State 13/05/2021 01 Agreed 13/05/2021 02 Draft 13/05/2021 03 Agreed 13/05/2021 04 Agreed 13/05/2021 05 Agreed 12/05/2021 01 Agreed 12/05/2021 02 Draft 12/05/2021 03 Agreed 12/05/2021 04 Agreed 12/05/2021 05 Agreed 11/05/2021 01 Agreed 11/05/2021 02 Draft 11/05/2021 03 Agreed 11/05/2021 04 Agreed 11/05/2021 05 Draft 10/05/2021 01 Agreed 10/05/2021 02 Agreed 10/05/2021 03 Agreed 10/05/2021 04 Agreed 10/05/2021 05 Darft 09/05/2021 01 Agreed 09/05/2021 02 Agreed 09/05/2021 03 Agreed 09/05/2021 04 Agreed 09/05/2021 05 Draft         I am looking to build a query that will show me all the fields that have changed from last 7 days and today (13/05/2021) based on the ID. The output will be like this           _tim ID 13/05/2021 05 10/05/2021 02           I can able to compare todays to tomorrow, but if i need to monitor what was the changes the last  7 days index="something" sourcetype="Datas" State="Agreed" earliest=-0d@d latest=now | append [search index="something" sourcetype="Datas" State="Agreed" earliest=-1d@d latest=-0d@d ] | eventstats count by DoorsUUID | where count="1" ... View more