Hi, I need to get the first Message REQ and first Message RES from the below event and should show my below expected output. Sample data: 20140122T100512 EMP MESSAGE=REQ COUNTRY=USA ACCNO=1234 20140122T100513 EMP MESSAGE=RES COUNTRY=USA ACCNO=1234 TYPE=ABC COUNT=0 STATUS=P 20140122T100514 EMP MESSAGE=REQ COUNTRY=USA ACCNO=1234 20140122T100515 EMP MESSAGE=RES COUNTRY=USA ACCNO=1234 TYPE=ABC COUNT=1 STATUS=A Search: Index=abc sourcetype=PQR EMP |transaction ACCNO|eval Login=_time | eval Logout=_time + duration|eval diff=tostring(Logout-Login, "duration")|search TYPE=ABC |table ACCNO, DIFF, STATUS, COUNTRY, TYPE,COUNT|search STATUS=P I also used |search STATUS!=A , but still 2 values are appearing in count and status columns My current output: ACCNO DIFF STATUS COUNTRY TYPE COUNT 1234 (GARBAGE) P,A(A in differentrow) USA ABC 0,1(1 in differentrow) Expected output: ACCNO DIFF STATUS COUNTRY TYPE COUNT 1234 01 P USA ABC 0 Thanks, PR ... View more

Hi, I have 5 panels in a row as shown in screen shot with yellow color heading. I am trying to change the background color of each panel like red background, pink, blue...etc. I used this CSS file to get heading yellow, but I am not getting background color of each panel. Any ideas/suggestions? CSS: #panel2 h2.panel-title{ background-color: #FFD501; } #panel3 h2.panel-title{ background-color: #FFD501; } #panel4 h2.panel-title{ background-color: #FFD501; } #panel5 h2.panel-title{ background-color: #FFD501; } #panel6 h2.panel-title{ background-color: #FFD501; } Thanks, PR ... View more

How to get 2 values in a single value visualization? I have a single value element visualization: it should have 2 values one is total count and down of the count I need percentage: example: 100 10% I tried doing this by using a single row with 2 searches, but it is displaying side by side. I need one value on top and the percentage value on the bottom. Thanks, -PR ... View more

Hi , I have a requirement to install Dynatrace Application Performance Management app from Splunkbase. I installed this app on one of my search heads and looking for the next steps to get Dynatrace data into Splunk. Can anyone give some steps how to get/configure the Dynatrace data into Splunk indexers? Thanks, -PR ... View more

Hi, I have a query which is in timechart: index=PQR sourcetype=abc NOT "\\x00\\x00\\x00\\x00\\x00"|timechart count by ID Results i am getting: _time p1 p2 p3 p4 2016-05-11 00:00:00 0 1 1 0 2016-05-11 00:10:00 1 1 0 2 2016-05-11 00:20:00 2 1 2 3 2016-05-11 00:30:00 1 0 0 0 I want to trigger an email alert on P1 if the count>1 for every 10 min . I created a alert with cron job for every 10 min and custom condition : Search P1>0 ALert mode: I want when the count of P1 is increasing (once per search i kept) requirement: if the P1 count comes in next 10 min example(2016-05-11 00:40:00) as 1 then i need a email to trigger Thanks in advance. ... View more

Hi, I have a request and response logs for service.here is the question. service A(main service)(id:1111): ---Internal service1(sub service)(id:1111) ---internal service 2(sub service)(id:1111) ----Internal service 3(sub service)(id:1111) Here service A starts and creates a ID and it will execute sub services(1,2,3).Id Remains the same for main and sub services. My requirement is: I need to find out the time taken to complete the request and response for each and every main service. If the subservice failed then i should be able to see logs.In the events there is a success codes and failure codes. please help with query. ... View more