I have a following field in my data cells : "< aN20%title=1| basic%ipin=7| basic%opin=1> " This means that I have 3 types of cells in this particular event (cell names are dynamic). How can I split this up so that it is like : cells : "aN20%title", cells : "basic%ipin", cells : "basic%opin" so that a command such as stats count by cells will produce the following list (can be used to populate dropdowns): aN20%title basic%ipin basic%opin I also would like to filter my cells, for example: cells="aN20%title" OR cells="basic%ipin" This would return all events that have either aN20%title or basic%ipin showing up in the cells field The "=X" ("=1" in "aN20%title=1") is the number of instances that this type of cell appears. I would need to be able to add this column with stats sum by cells command. For example: if I had 2 events cells : "< aN20%title=1| basic%ipin=7| basic%opin=1> " cells : "< aN20%title=2| basic%ipin=2> " and I wanted to see the sum of the cells, I would receive aN20%title : 3 basic%ipin : 9 basic%opin : 1 Thus, what is the best way to split this "cells" field up so that I can perform such commands. ... View more

I was wondering if there is a way to make charting.layout.splitSeries parameter be dynamic. I tried methods such as http://splunk-base.splunk.com/answers/55625/telling-splunk-to-decide-which-type-of-chart-to-use-depending-on-incoming-data which did not work for me. I would like to have something like <module name="HiddenChartFormatter"> <param name="charting.layout.splitSeries">$foo$</param> <module name="FlashChart"/> </module> where $foo$ is either a true or false value. Hidden Chart formatter does not seem to recognize these tokens. I also tried: <module name="PostProcess"> <param name="search">| eval chartType=$Split_Series$| rename chartType as "charting.layout.splitSeries"</param> <module name="ResultsValueSetter"> <param name="fields">charting.layout.splitSeriese</param> <module name="PostProcess"> <param name="search"> </param> <module name="HiddenChartFormatter"> <param name="charting.chart.showMarkers">true</param> <module name="FlashChart"> <param name="height">600px</param> </module> </module> </module> </module> ... View more

With the following code: <module name="Redirector"> <param name="url">VG_Single_DUT_Test_Data_v1</param> <param name="popup">True</param> <param name="arg.Weight_Select">$Weight_Select$</param> <param name="windowFeatures">scrollbars=yes,width=1000px,height=1000px;</param> </module> Weight_Select is a variable from a multi select dropdown. Therefore, the value is 'weight="3" OR weight="2"' for example. When I pass this through to the Redirector, the other page cannot use this to prepopulate a dropdown for weights. It seems like to URL loader takes in the parameters such as "Weight_Select=2&Weight_Select=3" in order to prepopulate dropdowns. Is there an easy way to prepopulate my weight dropdown in my second page with the redirector? If this cannot be done, I suppose I could construct my own link. ... View more

I show a Table module, and allow users to export the search contents in 1 search. For example, my search includes table field1, fields2, fields3, fields4 I want my table to show only field 1 and fields 2. I want the exported data to show only field 3 and field4. I can get the table to do what I want (hide field 3 and 4) by simply using the hiddenFields param. <param name="hiddenFields">field3 field4</param> However, I was wondering if I could limit the fields for export ... View more

I am using a Multiplexer Module in order to show a few JS Charts. When I change the Charts that I would like to show, the page crashes (becomes frozen), and I have to close the tab. <module name="Search" layoutPanel="panel_row7_col1"> <param name="search">index=vg_13_0_5 $HLA_Select$ $DUT_Select$|stats count by DUT | head 5</param> <module name="Multiplexer"> <param name="field">DUT</param> <module name="Search"> <param name="search">sourcetype=vg_sourcetype index=vg_13_0_5 $HLA_Select$ DUT="$DUT$" | convert timeformat="%Y" ctime(_time) AS Year|eval desired_time=Year . "-WW".Workweek|where desired_time >= "$EarliestTime$" AND desired_time &lt;= "$LatestTime$"|chart max("Aggregated Coverage") over desired_time by DUT useother=f</param> <module name="JSChart"> </module> </module> </module> </module> When $DUT_Select$ changes through an above pulldown, this changes the 5 JS charts. The initial page load is always OK, but the page crashes whenever $DUT_Select$ is changed ... View more

I am using a checkbox module that passes down either "True" or "False". In my SavedSearches module, I have the usehistory param being $foo$, from the above checkbox. I would like the user to be able to check the box so that the search is run, instead of taking the results from history. However, the $foo$ token in useHistory param value is not being registered (it seems to be always set as True) is there a way to do this? ... View more

I have a few different values for a Status field that match a certain regular expression that I would like to dedup on. The following values are possible values for Status: Active Resolved * Closed * the * indicates wildcard, such as Resolved (Fixed), Closed (Completed) I would like a way to dedup on Status so that it can yield a max of 2 events. Active and either Resolved * or Closed *. Therefore, if I had 5 events with the following status Active Resolved (Fixed) Resolved (Completed) Closed (Fixed) Closed (Completed) I would like to call dedup on Status field and have only : Active Closed (Fixed) I arbitrarily chose Closed (fixed) as an example to keep. I do not really care, I just would like to keep one of them (i suppose either the earliest or latest one in time would be a good standard). ... View more