topic Re: How to create a dashboard search to output these specific fields in results? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-to-output-these-specific-fields/m-p/262983#M78928 <P>From the logs, how can we differentiate if its and upload or download? </P> Fri, 27 Jan 2017 21:15:06 GMT somesoni2 2017-01-27T21:15:06Z How to create a dashboard search to output these specific fields in results? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-to-output-these-specific-fields/m-p/262982#M78927 <P>What I'm trying to do is when I give input as index=sftp USER=gradydftsftp and it gives output as:</P> <PRE><CODE>Jan 27 10:15:01 wmcloudsftp internal-sftp[9055]: session closed for local user gradydftsftpdata. Jan 27 09:15:03 wmcloudsftp internal-sftp[4534]: session closed for local user gradydftsftpdata </CODE></PRE> <P>So my question is, how can I create a dashboard with a search which displays<BR /> file name, uploadby, uploadtime, download, downloadby, and download time.</P> <P>Filename is something like (9055) <BR /> uploadby is gradydftsftp<BR /> uploadtime is 09:15:03</P> Fri, 27 Jan 2017 17:00:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-to-output-these-specific-fields/m-p/262982#M78927 sujith0311 2017-01-27T17:00:17Z Re: How to create a dashboard search to output these specific fields in results? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-to-output-these-specific-fields/m-p/262983#M78928 <P>From the logs, how can we differentiate if its and upload or download? </P> Fri, 27 Jan 2017 21:15:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-to-output-these-specific-fields/m-p/262983#M78928 somesoni2 2017-01-27T21:15:06Z Re: How to create a dashboard search to output these specific fields in results? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-to-output-these-specific-fields/m-p/262984#M78929 <P>Are you asking how to create a search that extracts fields from your events, or how to display the output of the search in a dashboard? Or both?</P> <P>Obviously the logging you've shown is not sufficient to distinguish between uploads and downloads.</P> Fri, 27 Jan 2017 22:55:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-to-output-these-specific-fields/m-p/262984#M78929 GregZillgitt 2017-01-27T22:55:18Z