Hi All, I have created one panel where I am showing  ERRORS for the app in bar chart format Below is my query. I have also made drilldown value as clickable  <query>index=eabc ns=blazepsfpublish CASE(ERROR) |rex field=_raw "(?&lt;!LogLevel=)ERROR(?&lt;Error_Message&gt;.*)" | eval Date=strftime(_time, "%Y-%m-%d") |dedup Error_Message |timechart span=1d count(Error_Message) by app_name</query> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option><option name="charting.drilldown">all</option> <drilldown> <set token="show">true</set> <set token="selected_value">$click.value$</set> </drilldown> Currently I am only getting Number of Error in Bar chart format. I want when I click on bar chart it should show raw logs for the Error. I have created dependent panel with below query but its not showing raw logs: <panel depends="$show$"> <table> <title>Errors</title> <search> <query>index=abc ns=blazepsfpublish CASE(ERROR)|rex field=_raw "(?&lt;!LogLevel=)ERROR(?&lt;Error_Message&gt;.*)" | eval Date=strftime(_time, "%Y-%m-%d") |dedup Error_Message |timechart span=1d count(Error_Message) by app_name $selected_value$ </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> </table> </panel> Can someone guide me here.

Solved: How to seperate different Sourcetype logs from sin... - Splunk Community Configure Unified Access Gateway System Settings (vmware.com) Syslog Formats and Events (vmware.com) Trying to override syslog and created props.conf & transform.conf.  It is not working.  What I am doing wrong?  initially getting an error:  Undocumented key used in transforms.conf; stanza='vmware:uag:admin' setting='DEST_KEY' key='MetaData:SourceType'  but, found link here that help solve. but, still not working.  I am not search at HF.  I set the setting the HF. props.conf     [syslog::/var/log/%hostname%/syslog] TRANSFORMS-sourcetype = vmware:uag:admin, vmware:uag:audit, vmware:uag:esmanager     transforms.conf     [vmware:uag:admin] REGEX = :\d\d\s+\w{5}\w{4}\suag-admin\:(.+)\n FORMAT = sourcetype::vmware:uag:admin DEST_KEY = MetaData:Sourcetype [vmware:uag:audit] REGEX = :\d\d\s+\w{5}\w{4}\suag-audit\:(.+)\n FORMAT = sourcetype::vmware:uag:admin DEST_KEY = MetaData:Sourcetype [vmware:uag:esmanager] REGEX = :\d\d\s+\w{5}\w{4}\suag-esmanager\:(.+)\n FORMAT = sourcetype::vmware:uag:esmanager DEST_KEY = MetaData:Sourcetype      

Hi, I need to add a Role Restriction Search filter on a field which is only available in one index. My problem is that I am not sure the proper way to force this restriction on only this index? If I add a restriction like this     "field_name"="field_value"   it works fine for the index containing the value but the others indexes return nothing.   If I add a restriction like this:   ((NOT "field_name"=* ) OR ( "field_name"="field_value"))   the result seems false. Do you have an idea of the correct field to restrict this field? Thanks, Regards, David  

Hello, I am currently testing Splunk for our Cisco backbone network and I would like to filter out two scenarios. 1.) When a power outage occurs, several power supply failures occur at the same time 2.) When there is a fiber cut, multiple pseudowires go down at the same time How can I filter these reasonably so that such a failure is detected immediately? Thanks a lot

Hi, I have about 100 rules and I want to count the number of logs are related to each rule. When I used "stats count" it counted those rules that have 1 or more logs, but didn't show all the rules with zero hits. I tried to import csv file that contains all the rules and to remove the rows that contains rules with 1 or more hits. Moreover, I tried the suggestion here with no luck: Solved: Using Splunk to Find Unused Firewall Policies - Splunk Community Any suggestion? Thanks