Hello guys. Looking for some help from the experts. I want to create an alert that will send emails to specific mailboxes, these addresses are part of the search result, so for example: DEVICE_TYPE VULNERABLE_COMPONENT COUNT recipient Linux Server OS Vendor Patches 5 team1@mydomain.com Linux Server Oracle WebLogic 6 team2@mydomain.com Linux Server Other 4 team3@mydomain.com Windows Server OS Vendor Patches 3 team1@mydomain.com Windows Server Oracle WebLogic 12 team2@mydomain.com Windows Server Other 3 team3@mydomain.com   So I want the team1@mydomain.com to receive the alert with the corresponding records,  DEVICE_TYPE VULNERABLE_COMPONENT COUNT recipient Linux Server OS Vendor Patches 5 team1@mydomain.com Windows Server OS Vendor Patches 3 team1@mydomain.com   and so on for the other recipients. I tried with "|sendemail to:$results.recipient$" command I've seen in other posts but it didn't work. thanks in advance for any help you can provide.

Hello, As a part of capacity planning we need to calculate Avg & Max calls per min for each BT. When we tried plotting max values for call per min then its not allowing us to plot it from metric browser, but when I exported the CSV I can see the max values but those are not actual max value for a BT. Later I came to know from documentation that for node-level metrics only, min and max values are available and not visible for tier- and application-level metrics. https://docs.appdynamics.com/22.5/en/appdynamics-essentials/metrics-and-graphs/metric-browser#Metric... In this case how can we find max calls per min for individual BT for a month as i have 25 nodes in a tier. Thanks, Rahul

Hello, I am looking for the timechart option where I can get data for last 7 days for a particular time range. Ex :- if I select time range as 01:00:00 to 02:00:00 AM then should show data for last 7 days for the same time range. Date/Time range Count 2022-05-27 01:00:00 02:00:00 A 2022-05-26 01:00:00 02:00:00 B 2022-05-25 01:00:00 02:00:00 C 2022-05-24 01:00:00 02:00:00 D 2022-05-23 01:00:00 02:00:00 E 2022-05-22 01:00:00 02:00:00 F 2022-05-21 01:00:00 02:00:00 G   Thanks  

Hi All, I am using base search , I want to use time picker(earliest and latest) in other panel which is using this base search. How can I achieve that ? Reference query :     <form version="1.1" theme="dark"> <label>Test Dashboard</label> <description>Dashboard created for testing purpose</description> <search id="base_12"> <query> index=test_index </query> <earliest>0</earliest> <latest></latest> </search> <fieldset submitButton="true" autoRun="true"> <input type="time" token="time"> <label>Time Picker</label> <default> <earliest>-7d@w0</earliest> <latest>@w0</latest> </default> </input> <search base="base_12"> <query>| search (($app$) AND ($environment$))| stats count by test | fields test</query> </search>     Regards, NVP

Hi all I am having issues trying to script enabling and disabling maintenance mode with a hashed password. The command is /opt/splunk/bin/splunk enable maintenance -mode - auth admin: somepassword Is there a way I can hash the password. I have tried the hash-passwd and user-seed.conf but it does not seem to hash my clear text password upon restarting splunk  

Hi Team, I want to pull the license usage stats particularly for 4 to 5 hosts for the last 30 days with a time span of 1 day in GB and bring it in a dashboard so kindly help out with the query.   host information host 1 = xyz host 2 = abc host 3 = def host 4 = ghi host= vbg  

I read https://docs.splunk.com/Documentation/MLApp/5.3.1/API/SavingModels and it highlights the way of creating your custom model and saving it with codecs in a way that Splunk can understand.  Is there any way that I can decode my model (not custom, rather one created via the fit command) so I can see the structure of my model and the properties?  I want to be able to export the model to use it in a personal system.  Appreciate the help,

Updated the post since the error changed into "Error in 'where' command. The expression is malformed. Expected)" My aim is to use two separate stings of tokens in my search to pass the following: 1) "Start of the Month" + "Year"   ($month1$ $year$) 2) "End of the Month" + "Year" ($month2$ $year$) I was trying to combine the strings using <eval> within the <change> step but had no luck on finding a guide to implement it properly. Would it be better just to add the <eval> within the search or would it be better to do it during the change to avoid any complications?       <form theme="dark"> <label>CSC/ERSC/PSI PAGING Report</label> <fieldset submitButton="true" autoRun="true"> <input type="dropdown" token="lpar"> <label>Select to View</label> <choice value="----">----</choice> <choice value="D7X0">D7X0</choice> <choice value="H7X0">H7X0</choice> <choice value="D1D0">D1D0</choice> <choice value="DAD0">DAD0</choice> <choice value="E1D0">E1D0</choice> <choice value="H1D0">H1D0</choice> <choice value="WSYS">WSYS</choice> <choice value="YSYS">YSYS</choice> <default>----</default> </input> <input type="dropdown" token="year"> <label>Select Year</label> <choice value="----">----</choice> <choice value="2022">2022</choice> <default>----</default> </input> <input type="dropdown" token="month1"> <label>Select Month</label> <choice value="****">****</choice> <choice value="01/01/">January</choice> <choice value="02/01/">February</choice> <choice value="03/01/">March</choice> <choice value="04/01/">April</choice> <choice value="05/01/">May</choice> <choice value="06/01/">June</choice> <choice value="07/01/">July</choice> <choice value="08/01/">August</choice> <choice value="09/01/">September</choice> <choice value="10/01/">Ocotber</choice> <choice value="11/01/">November</choice> <choice value="12/01/">December</choice> <default>****</default> <change> <condition label="****"> <set token="month2">----</set> </condition> <condition label="January"> <set token="month2">01/31/</set> </condition> <condition label="February"> <set token="month2">02/29/</set> </condition> <condition label="March"> <set token="month2">03/31/</set> </condition> <condition label="April"> <set token="month2">04/30/</set> </condition> <condition label="May"> <set token="month2">05/31/</set> </condition> <condition label="June"> <set token="month2">06/30/</set> </condition> <condition label="July"> <set token="month2">07/31/</set> </condition> <condition label="August"> <set token="month2">08/31/</set> </condition> <condition label="September"> <set token="month2">09/30/</set> </condition> <condition label="October"> <set token="month2">10/31/</set> </condition> <condition label="November"> <set token="month2">11/30/</set> </condition> <condition label="December"> <set token="month2">12/31/</set> </condition> </change> </input> </fieldset> <row> <panel> <chart> <search> <query>index=mainframe-platform sourcetype="mainframe:mpage" MVS_SYSTEM_ID=$lpar$ | eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d") | eval _time=strptime(DATE." ","%Y-%m-%d") | where _time &gt;= strptime("$month1$""$year$", "%m/%d/%Y") AND _time &lt;= strptime("$month2$""$year$", "%m/%d/%Y") | chart sum(VIO_PAGING_SEC) as "$lpar$ Sum of VIO_PAGING_SEC" sum(SYSTEM_PAGEFAULTS_SEC) as "$lpar$ SYSTEM_PAGEFAULTS_SEC" sum(SWAP_PAGIN_SEC) as "$lpar$ SWAP_PAGIN_SEC" sum(LOCAL_PAGEFAULTS_SEC) as "$lpar$ LOCAL_PAGEFAULTS_SEC" over _time</query> <earliest>0</earliest> <latest></latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> </form>     Would appreciate the help.

Hi, I have an filter for selecting the country values, provided this as a drop down. we have options like singapore,malaysia,china,vietnam and also have an option of ALL. Based on the above selection I have an panel that shows the success / failure counts graphs will appear. The issue I am facing is I am getting the values like(Null,Value,Other,18,38) in countryCode column if I run the dashboard. But I don't see any event with the countryCode parameter having this values. So, can you help on fixing this issue?? Thanks, Sahana   

I need to push data from a Splunk report to Graphite. I know there's an archived app in Splunkbase but I'm sure the python is incompatible with Splunk 8.2.4.  Anyone have a method for pushing scheduled report data to Graphite?