If you were to write up a regex to extract the number of present values and do an eval to calculate the percentage, I think that’s what you’re looking for. I’m on mobile, so bear with me right now. Something like: |rex field=values "\(Present\) \*\*\*\",\"count\":(?<present_count>/d+)"|eval perc_present=(present_count/count)*100 Might need some tweaking. ... View more

agree with the ever-brilliant @rich7177 that we should at least test that the PDF is generating properly or not. if you are looking to add a line when no data is present, you can add something like this to the end (tweak as needed) |appendpipe [stats count|where count=0|eval Compliant="No Data"] ... View more

try something like this for the pie chart: index=linux* | rex field=source ".*\/(?<device_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\/.*" | stats latest(_time) as Last_Time by device_ip |join device_ip type=left [| inputlookup SwiftDeviceIPHostname |lookup SwiftCompliance hostname AS NewServerName OUTPUT service | table NewServerName,InsideIP,MgmtIP,service | eval Host=lower(NewServerName) | eval device_ip=coalesce(MgmtIP,InsideIP)|lookup SwiftCompliancePolicy Host OUTPUT Policy| search Policy=linux* service !=Remove* service != "*A1c" service !=*2HOP Host!= ace* ] | eval DateDiff=(now()-Last_Time)/(24*3600) | eval Compliant = if(DateDiff <=1,"Compliant","Non Compliant") | chart count by Compliant | eval Compliant=Compliant." : ".count and see what you get. I think one issue you might be facing is the search time. I know I used to have issues with searches that used too much memory or too much time that the PDFs wouldn't render properly. If this works, use similar logic to re-write the table SPL. Use the job inspector to check the search optimization. Let me know if there are any questions or if it isn't working, it'll be helpful to have some sample data to work with. ... View more

can you share an output? ... View more

from looking at this, I would redo the time format to be %Y/%m/%d, so that it would sort chronologically. ... View more

they don't need a common field. |makeresults|eval field1="foo"|eval field2="bar"|eval report="report name1"|fields - _time |append [|makeresults|eval field3="value"|eval report="report name2"|fields - _time] It will just create a new column for the fields that don't match. you could do an eval, though, to bring in what report it's for so the recipients know which lines are for which report. ... View more

before the dedup, try adding a |where days<=365 or is there not even data coming back when you run index="db_rsa_archer" | fields "Step Due Date" "Nome do Projeto" | rename "Step Due Date" as step_due_date | eval Data_Identificada=strptime(step_due_date, "%d/%m/%Y") | eval days = round((now()-Data_Identificada)/86400) based on what you have shown in your question, you have a field called "Step Due Date" that is a string in the format of d/m/y and you create "Data Identificada" from that. ... View more

If you're just trying to bring in hostname and not combine the tables together, I'd use coalesce. I'd just do something like |join src type=left [|inputlookup cmdb_ci_server_lookup|fields ip_address fqdn|rename ip_address as src] |join src type=left [|inputlookup lansweeper_assets_lookup |fields IPAddress AssetName|rename IPAddress as src] |eval orig_host=coalesce(fqdn,AssetName) ... View more

The best thing i can recommend is using the Developer Tools in your browser to experiment with everything in the dashboard. That allows you to see what the elements are called and you can tweak some of the options and see the impact that they have by changing values around. this website has some great references for CSS to use CSS inline in your dashboard, follow this answers post ... View more

If I understand, you have a field called Step Due Date that has a date formatted %d/%m/%Y and you want to know how many days are between that date and today? Try this: index="db_rsa_archer" | fields "Step Due Date" "Nome do Projeto" | rename "Step Due Date" as step_due_date | eval Data_Identificada=strptime(step_due_date, "%d/%m/%Y") | eval days = round((now()-Data_Identificada)/86400) | table "Nome do Projeto" ,"Data_Identificada" | dedup "Nome do Projeto" some of the issues were using the wrong field names. let me know if this helps ... View more

what exactly is the goal? to join cmdb_ci_server_lookup to lansweeper_assets_lookup by ip_address/IPAddress and fill the null values of AssetName/orig_host from lansweeper_assets_lookup? ... View more

are the two queries using the same data in the base searches? same index? sourcetype? anything similar? Could be that we could avoid joins all together and do something with stats/eventstats type work. would help to know the base search. ... View more

could you please give some sort of example output? you have a table of results with say, 20 rows. is it one column? 12 columns? Is this static or will the number of rows change? You want a new panel for each row of that table? What exactly is the display? Another table (with just one row)? single value? One panel per row or 5 panels per row (or some other random number?)? Long story short, this could be really complicated, at least in my opinion, which is why Trellis came out. I understand that you're saying you can't use that, just preparing you that if there is an option, it is likely going to involve someone having to script something. ... View more

I just want to prefix with the queries and table example, while very much appreciated, are confusing, as the second query states that it is for Y and Z but has index=x and that the table has index=y as false for is in y . So if i misunderstood what you needed, I'm sorry, and if you could clarify what you need, that'd be great. Otherwise, if this works for you, super awesome. what about something like this: (index=x OR index=y OR index=z) sourcetype=hw |table index productId |dedup productId index |eval is_in_y=if(index="x","false","true") |table productId is_in_y index ... View more

try this: <form> <label>test_splunkanswers</label> <fieldset> <input type="text" token="mytoken" searchWhenChanged="true"> <label>mytoken</label> <default>case(dow=="Mon","dow_Mtwtfss",true(),"dow_mTWTFSS")</default> <initialValue>case(dow=="Mon","dow_Mtwtfss",true(),"dow_mTWTFSS")</initialValue> </input> </fieldset> <row> <panel> <table> <search> <query>|makeresults| eval mytokenoutput=$mytoken$</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> i removed all of the escaped double quotes and the double quotes around the string, because you want it to actually eval this in the end, and not treat it as a string. ... View more

can't you just change the earliest to earliest=-5d@d to look at the last 5 days of data? you can use a few evals to see if it was last seen today and other last seen dates | eval last_seen=strftime(last_access, "%T %F, %Z") |eval last_seen_today=if(last_access>=relative_time(now(),"@d"),last_seen,null()) ... View more

at the bottom of the docs page you should just be able to leave feedback. the docs team is extremely responsive and they'll be able to fix/clarify the docs and look into the issue to make sure the docs are accurate. ... View more

you can use the _audit index to look at that. index=_audit action=search search="<search string>"|stats count by user as long as the field extractions work, shouldn't be a problem. if for some reason the field extractions are broken, you might need to write a regex like this: |rex "user=(?<user>[^,]+)" to get user ... View more

Do you have any data you can provide for us to play with? stripped of any PII? ... View more

try something like this: |eval matchstring=if(match(ip_field,replace($token|s$,"(?<=\.)[^.]*$","")),ip_field,null())|where isnotnull(matchfield) ... View more

what if you just did ...| dedup CaseNumber | search ProductName=* IsDeleted=False AccountName="*" CaseRecordTypeName=Standard | eval CreatedDateUNIX=strptime(CreatedDate,"%Y-%m-%d %H:%M:%S")| eval _time=CreatedDateUNIX|timechart span=1mon count|timewrap 1y and maybe any other filtering you might want to get last year to now. i see you have that in the first search to grab 2017 and you have a different filter to grab 2018. ... View more