In your example, base search is a technique that performs 12 searches once. In base search, the search is performed in the most detailed unit. Aggregate each panel as needed. As a restriction, if the number of base searches is large, it may be faster to search for each panel. BASE SEARCH: (your search)|bin span=24h _time|stats count by _time,your_category PANEL01: |bin span=7d _time|stats sum(count) as count by _time,your_category PANEL02: |bin span=30d _time|stats sum(count) as count by _time,your_category <dashboard> <search id="baseSearch"> <query>(your search)|bin span=24h _time|stats count by _time,your_category</query> </search> <label>test</label> <row> <panel> <chart> <search base="baseSearch"> <query>|bin span=7d _time|stats sum(count) as count by _time,your_category</query> </search> <option ･･････ </chart> </panel> </row> <row> <panel> <chart> <search base="baseSearch"> <query>|bin span=30d _time|stats sum(count) as count by _time,your_category</query> </search> <option ･･････ </chart> </panel> </row> </dashboard> ... View more

Try this! (your search) | streamstats count as key | mvexpand devicedowntime | eval devicedowntime2=round(devicedowntime,4) | stats list(devicedowntime) as devicedowntime,list(devicedowntime2) as devicedowntime2,latest(*) as * by key,_time | fields - key ... View more

Try this! (your search) | eval Field4=Field1.",".Field2.",".Field3 | fields - Field1,Field2,Field3 | makemv delim="," Field4 | mvexpand Field4 ... View more

Is n’t it zero? I think the second transaction doesn't return a value because there is no keyword in _raw. Is it all right to be grouped like this in the first place? stageTime1 is multi-field. KEY,stageTime1 A1,10 A2,20 A3,10 B1,10 B2,20 B3,30 KEY,stageTime1,stageTime2 A,10,100 20 10 B,10,500 20 30 If there is no parent-child relationship between two transactions, how about calculating and merging them separately? (your search transaction1)| rename duration as stageTime1 |timechart span=1h avg(stageTime1) as stageTime1 |append [search (your search transaction2)| rename duration as stageTime2 |timechart span=1h avg(stageTime2) as stageTime2] |stats latest(*) as * by _time ... View more

Is there a space in the field name? If there is a space, please enclose it with a single quote. data□1 ↓ 'data□1' ... View more

Do I need to add it? | eval data3 = if(isnull(data1), data2,data1) ... View more

Did you see the answer that shows the tooltip? https://answers.splunk.com/answers/236389/adding-tooltip-to-panel-on-a-hover.html ... View more

The “DensityFunction” algorithm is not used. Is it an algorithm question? Or is it a question of how to use MLTK? Is it a case that does not exist in the MLTK sample use case? ... View more

The indexer cannot transfer logs like UF or HF. There is "Splunk app for CEF" as a method of transferring the indexed log. https://docs.splunk.com/Documentation/CEFapp/2.1.0/DeployCEFapp/AboutSplunkAppforCEF ... View more

”Splunk Machine Learning toolkit” sample data uses data model（CIM) fields. For now, how about imitating a sample with an actual data model? ... View more

Subsearch has the following restrictions. [subsearch]: Search auto-finalized after time limit (60 seconds) reached. It is necessary to change “limits.conf”. https://answers.splunk.com/answers/267303/why-does-my-subsearch-maxtime-setting-in-limitscon.html ... View more

This APP is not CIM compliant. You need to ask the creator, or associate yourself with CIM. Good luck! ... View more

HF is a Splunk server for forwarding to the indexer. I think you should use a Splunk server (ALL IN ONE) or an indexer. It's just a distributed search. ... View more

I think there is no choice but to synchronize with rsync and execute Copy command regularly in the shell. A reload process is also necessary. ... View more

If you use "Config Explorer", you can copy on GUI. A restart is required if the settings are changed. https://splunkbase.splunk.com/app/4353/ ... View more

You can easily replace the following search statement, although it may fall out of the condition. (your search) earliest=now() latest=-24h |bin span=5m |stats count by _time, user, ComputerName |search count >3 ... View more

Is this possible? If there are 5 each index="search_index | timechart avg(time1) as time1_in_mins | sort time1_in_mins | tail 5 |append [search index="search_index | timechart avg(time2) as time2_in_mins | sort time2_in_mins | tail 5] If there are 5 cases in total index="search_index |bin span=1h |stats (time1) as time1_in_mins ,avg(time2) as time2_in_mins by _time |eval time=if(time1_in_mins <time2_in_mins,avtime1_in_mins,time2_in_mins) |sort time|tail 5 ... View more