hi @Chiranjeev  The default configuration in web datamodel for dest field is evaluated. if(isnull(dest) OR dest="" OR dest="-","unknown",dest) So you'll need to either update this eval statement in the data model to fit your case or map correct field for dest field. If the reply helps, a Karma vote would be appreciated. 

Alright maybe not enough coffee....I am going in circles trying to get this to display the values in the csv.  Cant figure out what needs to go with the fillnull value. index=my_data data.environment.application="MY APP" data.environment.environment="test" | eval estack="my_stack" | fillnull value="prod" estack data.environment.stack | where 'data.environment.stack'=estack | streamstats window=1 current=False global=False values(data.result) AS nextResult BY data.componentId | eval failureStart=if((nextResult="FAILURE" AND 'data.result'="SUCCESS"), "True", "False"), failureEnd=if((nextResult="SUCCESS" AND 'data.result'="FAILURE"), "True", "False") | transaction data.componentId, data.environment.application, data.environment.stack startswith="failureStart=True" endswith="failureEnd=True" maxpause=15m | stats sum(duration) as downtime by data.componentId | inputlookup append=true Component_avail.csv | fillnull | addinfo | eval uptime=(info_max_time - info_min_time)-downtime, avail=(uptime/(info_max_time - info_min_time))*100, downMins=round(downtime/60, 0) | rename data.componentId AS Component, avail AS Availability | table Component, Availability  

Hi @sairajkiran  Try checking the values from the job inspector for your event/search. Not sure if it will fulfil your needs. The field you can use is search_id -- in _introspection and _audit indexes For _internal, you'll need to extract this value from job which looks something like this search/search/jobs/1710936732.74/control so the search_id field value is 1710936732.74  If the reply helps, a Karma vote would be appreciated.

Hello, Thank you so much for your response. The query that contain the search is actually in the statistic table, but the condition is a condition based on the drop down token. This is the main question: How to dynamically search / where based on variable like below? | search day_no_each_timestamp = day_in_week OR | where day_no_each_timestamp = day_in_week  

Hi @LearningGuy  Not sure if I understand your requirement correctly. But below maybe something you can use. <form version="1.1"> <label>Dropdown-token-condition</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="token_week_or_day" searchWhenChanged="true"> <label>Week Or Day</label> <choice value="w">Week</choice> <choice value="d">Day</choice> </input> <input type="dropdown" token="token_day" searchWhenChanged="true"> <label>Day Number</label> <choice value="0">Sunday</choice> <choice value="1">Monday</choice> <choice value="2">Tuesday</choice> <choice value="3">Wednesday</choice> <choice value="4">Thursday</choice> <choice value="5">Friday</choice> <choice value="6">Saturday</choice> </input> </fieldset> <row> <panel> <table> <search> <query>| makeresults | eval selected_week_or_day_option="$token_week_or_day$" | eval selected_day=$token_day$ | table _time selected_week_or_day_option selected_day date_day | eval day_no_each_timestamp=strftime(_time,"%w") | eval day_in_week = if(selected_week_or_day_option="w", $token_day$, "*")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   If the reply helps, a Karma vote would be appreciated.

format can take up to 6 parameters - these default so that the values are put in quotes, there are ANDs between field/value pairs from the same row, rows are enclosed in brackets, there are ORs between rows, and the whole thing is enclosed in brackets. For example: ( ( a="11" AND b="21" AND c="31" ) OR ( a="12" AND b="22" AND c="32" ) OR ( a="13" AND b="23" AND c="33" ) ) These are how the parameter (positions) map to the formatted result 1 2 a="11" 3 b="21" 3 c="31" 4 5 2 a="12" 3 b="22" 3 c="32" 4 5 2 a="13" 3 b="23" 3 c="33" 4 6 You can test this with this runanywhere example | makeresults count=3 | streamstats count as a | eval a=a+10, b=a+10, c=a+20 | format 1 2 3 4 5 6

As my colleague used to say - "Try and see". Set up a HEC input and try to push a few requests using different compression methods. As far as I remember, there are no settings for selectively enabling/disabling compression (methods) on HTTP level so you'll either hit something that Splunk can process or you'll get an error.

As the guys already pointed out, there is more to bucket lifecycle than meets the eye. And that's why you might want to involve PS or your local friendly Splunk Partner for assistance. First and most obvious thing is that data is not rolled to "next" lifecycle stage per event but as full buckets. It has its consequences. While the hot->warm and warm->cold roll is based on either _bucket_ size or number of buckets, rolling to frozen is based on the _latest_ event in the bucket (unless of course you hit the size limit). So the bucket will not be rolled until all events in the buckets are past the retention period set for the index. That's the first thing which makes managing retention unintuitive (especially if you have strict compliance requirements not only regarding for how long you should retain your events but also when you should delete them). Another more subtle thing is that Splunk creates so called "quarantine buckets" into which it inserts events which are relatively "out of order" - way too old or coming supposedly from the future. The idea is that all those events are put into a separate bucket so they don't impact performance of "normal" searches. So it's not unusual, especially if you had some issues with data quality, to have buckets covering quite big time spans. You can list buckets with their metadata using the dbinspect command. (Most of this should be covered by the presentation @isoutamo pointed you to). And unless you have very strict and unusual compliance requirements you should not fiddle with the index bucket settings.

@ITWhisperer  With 'format' at the end worked - thank you very much Just checked documentation which indicates [to me] that returned string have input search results separated by 'OR' command - do I understand correctly? format - Splunk Documentation This command is used implicitly by subsearches. This command takes the results of a subsearch, formats the results into a single result and places that result into a new field called search. The format command performs similar functions as the return command. . . . mvsepSyntax: mvsep="<string>"Description: The separator to use for multivalue fields.Default: ORmvsepSyntax: mvsep="<string>"Description: The separator to use for multivalue fields.Default: OR