Hi @akarivaratharaj, Can you please try this: <eval token="growth_title2">strftime(relative_time(now(), earliest), "%d-%m-%Y")." to ".strftime(relative_time(now(), latest), "%d-%m-%Y")</eval> For reference: https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/DateandTimeFunctions https://docs.splunk.com/Documentation/Splunk/7.2.5/Viz/tokens#Define_conditional_matching ... View more

Try this: | rex field=_raw "{\s*\"name\":\"(?<name>\w+)\"" ... View more

I've tried to test this using the following query. Maybe you can check and tell me if I'm understanding it wrong somewhere: | makeresults count=10 | eval application="app".random()%10 | eval computer="computer".random()%6 | stats values(application) as apps by computer | where mvcount(apps)=1 ... View more

Hi @lbkAconectodk, Does the application field have a comma-separated list of applications? And I realized query should return the same with or without dedup because of our stats command. ... View more

Hi @marxsabandana Trendline won't show when the result has only 1 row. So you can maybe check result count on search:done event and set chart options accordingly? ... View more

Hi @BearMormont I tested this behavior on different Splunk version and found out that from Splunk version 6.6.xx and above it preserves those spaces and shows in the table. ... View more

Hi @amirrachman The problem here is you don't have your data as correct JSON format that's why Splunk couldn't extract those fields... If you want auto extraction you should have the following format in your case: [{ "container_id":"0fce97fd907a806802eab9b27965dd35dd82bbe142d128294b34b8a8a2e42f23", "container_name":"nginx" }, { "name":"eventBase1", "hostname":"google.com", "pid":7 }] i.e. JSON array ... View more

so you want to remove file extensions and return only filenames? ... View more

can you please give example list of filenames and tell us what you want to filter out? ... View more

If you have duplicate events you should perform dedup first: | dedup computer, application | stats count as app_count, values(application) by computer | where app_count=1 ... View more

Hope this helps: your search | stats count as app_count, values(APPLICATION_FIELDNAME) by COMPUTER_FIELDNAME | where app_count=1 for reference: https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Stats ... View more

Hi @vnravikumar, There were some problems in the code, I tried to fix it. @pramit46 can you try with following modified code: require([ "splunkjs/mvc", "splunkjs/mvc/searchmanager", "splunkjs/mvc/simplexml/ready!", ], function (mvc, SearchManager) { var query = "|makeresults | eval datetime=_time|table datetime | outputlookup ravi.csv append=t"; var mysearch = new SearchManager({ search: query, autostart: false }); $(window).unload(function () { mysearch.startSearch(); }); }); Also to inform you that this search will also run when the page is reloaded. ... View more

Thanks. Appreciate it 🙂 ... View more

that's what I commented first 😄 ... View more

for your reference: https://answers.splunk.com/answers/628853/how-to-add-scripts-as-data-input.html ... View more

What you can do is have scripted input configured in Splunk and write a python script which can request URL and get data if that's what you are looking for? ... View more

can you please elaborate more to what you are doing and what you want to achieve. ... View more