Afternoon All i'd like some help please with some SPL logic that i just cant crack 😞  I have data on some user in our Active Directory system and i am trying to: create a new column with actions identify those who have no logged in for more than 61 days and is so the action should return "reset password" here's the part that i am having an issue with below. the first two lines are working as expected returning last_logon_total  day, month, year i have a new field i created called 'action' that i want to return a value in of those users who have not logged in for more than 61 days.. but i cant get the spl right. | eval epoch_lastLogonTimestamp_date = strptime(lastLogonTimestamp, "%Y-%m-%dT%H:%M:%S") | eval last_logon_total = strftime(epoch_lastLogonTimestamp_date, "%d/%m/%Y") | eval action = if(last_logon_total = relative_time(), "-61d@d", "reset password")   any ideas ?   Thanks Paula     ... View more

Hi All  In my current dashboard i have several text input that colleagues can use to find varies information. Sometimes it takes a while for their information to appear.  Is there a way to add a loading notification / alert to advise colleagues that Splunk is retrieving the information but may take some time?  The delay unusually is only for their 1st search and thereafter the searches are pretty much instant.  Many thanks   Paula   ... View more

Hi All  I'd like some help please with a query thats been asked of me and its a little out of my depth  the current below query shows year total of helpdesk calls by year    index=mmuh_helpdesk sourcetype=mmuh_helpdesk_json | dedup id | fillnull value=NULL | search "problemtype.detailDisplayName"!=*AGRESSO* | eval problem_detail='problemtype.detailDisplayName' | eval problem_detail=replace(problem_detail, "&#8226","") | eval problem_detail=replace(problem_detail, ";","|") | eval techGroupLevel = 'techGroupLevel.levelName' | eval techGroupLevel = replace(techGroupLevel, " "," ") | eval techGroupLevel = replace(techGroupLevel, " ","") | eval techGroupLevel = replace(techGroupLevel, "Level"," Level") | eval location_Name = 'location.locationName' | eval status = 'statustype.statusTypeName' | eval priority = 'prioritytype.priorityTypeName' | eval techGroupId = 'techGroupLevel.id' | eval tech_Name = 'clientTech.displayName' | top limit=20 date_year | search date_year IN(2020,2021,2022,2023) | eval sort=case(date_year=="2020", "02", date_year=="2021","03", date_year=="2022","04", date_year=="2023","05") | sort sort | fields - sort | fields - percent | eval Year=case(date_year=="2020", "Y 2020", date_year=="2021", "Y 2021", date_year=="2022", "Y 2022", date_year=="2023", "Y 2023") | table Year count i would now like to show years only 2021 and 2022 in line chart  but ... i would like each year to have a separate line  if possible i'd like the time span for each year to be broken into a month  i can get this with the time picker (previous year chosen) and following query below for 2022 index=mmuh_helpdesk sourcetype=mmuh_helpdesk_json | dedup id | fillnull value=NULL | search "problemtype.detailDisplayName"!=*AGRESSO* | eval problem_detail='problemtype.detailDisplayName' | eval problem_detail=replace(problem_detail, "&#8226","") | eval problem_detail=replace(problem_detail, ";","|") | eval techGroupLevel = 'techGroupLevel.levelName' | eval techGroupLevel = replace(techGroupLevel, " "," ") | eval techGroupLevel = replace(techGroupLevel, " ","") | eval techGroupLevel = replace(techGroupLevel, "Level"," Level") | eval location_Name = 'location.locationName' | eval status = 'statustype.statusTypeName' | eval priority = 'prioritytype.priorityTypeName' | eval techGroupId = 'techGroupLevel.id' | eval tech_Name = 'clientTech.displayName' | timechart span=1mon count(id)    how can i get both years show ? thank you  🙂      ... View more

Hi all  i have a search running with the following results date_year                   count  2022                             44,814   how do i get the average count over the year?  I've tried to eval date_year by 12 but this doesnt look right.  Also have | timechart avg(date_year) and this is not working out  any ideas?       ... View more

Hi all  I have a dashboard that i need to build to show number of Helpdesk calls for : 1) year to date 2) Average monthly 3) Average daily  i have the query set up and  I've selected 'year to date'  I've done a | stats count and saved to Dashboard  When i save this onto the dashboard the time has defaulted to last 24 hours. I've gone into the source editor and removed queryparameters but this hasn't helped i think i need to set the time on my query (at the top) - year to date Can some help me with this code ?    Many thanks   P   ... View more