Try something like this: (index= primary_claim amt > 1000 ) OR (index= secondary_claim admis_dt>="2015-10*" ) | stats dc(index) as dc values(*) as * by primary_key_claim | search dc>1 ... View more

it depends on what you're trying to obtain sourcetype=infra subtype=system | stats sparkline count, avg(cpu) by devicename this search will give you a sparkline that shows the count over the timeframe you're specifying for each device sourcetype=infra subtype=system | stats sparkline(avg(cpu)) by devicename this search will give you a sparkline that shows the average cpu over the timeframe you're specifying for each device. ... View more

you might be able to add by sourcetype to the stats command to help break that out? ... View more

Do you set the token $YAxisMax$ after REALLY BIG SEARCH? I see in the answer that you linked it was in an input. I was thinking that you could add ... </search> <preview> <set token="YAxisMax"=$result.<fieldname>$></set> </preview> <option name="charting...... where the is the field where the y axis count is coming from. Not sure if it'd work or not, but that's how I generally set tokens that I use in my dashboards. ... View more

Possibly something like this. You may need to do an mvexpand after the stats command if you have multiple field values you need split out, or you could have more of those fields after by , I just assumed both sourcetypes didn't have them in common. (xd_index sourcetype="xendesktop:7:icasession" UserName="" host="" ) OR (xd_index sourcetype="xendesktop:7:session" UserName="" host="" ClientAddress=* ) | eval UserName = lower(UserName) | stats sparkline(avg(LatencySessionAverage), 1m) as "Latency Trend" values(LatencyLastRecorded) as LatencyLastRecorded values(AgentVersion) as AgentVersion values(ClientAddress) as ClientAddress values(IPAddress) as IPAddress values(ClientVersion) as ClientVersion values(ClientPlatform) as ClientPlatform values(BrokeringTime) as BrokeringTime by UserName HostedMachineName | lookup COSTCENT RACF_ID AS UserName OUTPUT RACF_Name | fields UserName RACF_Name LatencyLastRecorded "Latency Trend" ClientPlatform ClientVersion ClientAddress IPAddress HostedMachineName BrokeringTime | sort -LatencyLastRecorded | dedup HostedMachineName ... View more

If you're using this for a bar chart, according to the doc, charting.axisY.maximumNumber is still an option. http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/ChartConfigurationReference Could there be a problem with the token being set? Can you post your syntax? ... View more

if you turn on your LIPSY (an expression Splunk uses to locate events, it can be turned on in limits.conf, I believe. [search_info] infocsv_log_level=DEBUG), you can see how the search is actually working in the backend. Martin Muller did a great talk at .conf this year on how searches look to us vs how they run. You can find his slides about this at http://conf.splunk.com/sessions/2016-sessions.html#search=fields%2C%20indexed%20tokens%20and%20you& It'll probably explain more about why the wildcard searches that way. ... View more

I read over the doc and I've tried to wildcard a table with different things, as above and *, also. Can't seem to get it to work. Sounds like a great enhancement request! http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/TableFormatsFormatting ... View more

Did you use the '<>' in the foreach command? index=abc QP_* | foreach QP_* [eval fieldnames = if(match('<<FIELD>>', ".com"), "<>", "NoMatch")] | table _raw fieldnames ... View more

|transpose will lay them out vertically for you. http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Transpose you'll probably want to use header_field and int=0 options. ... View more

if you changed your eval to this: | eval search=if(sourcetype == (A), "true", "false" ) does it evaluate correctly? ... View more

1m would be 1 minute. 1mon would be 1 month. https://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Addsparklinestosearchresults https://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Specifytimemodifiersinyoursearch ... View more

Can you create a new dashboard from the Dashboards view and click 'edit source' and put something like this in there, or change the options for if your using a chart instead of a table? <dashboard> <label>Title</label> <row> <panel> <table> <search> <query>|inputlookup MSDN_Call_Counts.csv |map search="|inputlookup MSDN_Lookup.csv | search RTR_Call="$RTR_Call$" | eval count=$count$|rename $RTR_HTTP_Resp$ as Response|table RTR_Call,Response,count" maxsearches=1000 |chart sum(count) over RTR_Call by Response|fillnull value=0</query> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </dashboard> ... View more

Sorry, I was thinking through dashboards and not alerts. I think the field has to be available for you to use it in your alert. ... View more

Something along these lines. I took out your sort and head commands, as I wasn't sure how you'd want to cut off the values. : index=f5 instance=test earliest=-4d@d latest=-1d@d | eval urlall=split(uri,"?") | eval url=mvindex(urlall,0)+"*" | eval timeFrame=if(relative_time(now(),"-2d@d")>=_time,"old","new") | chart count avg(reqtime) as avgtime by url timeFrame | rename "count: old" as countold "count: new" as countnew "avgtime: old" as avgtimeold "avgtime: new" as avgtimenew | where count>100 | eval avgtimediff=avgtimenew-avgtimeold | eval avgtimediffpercent=tostring(floor(avgtimediff*100/avgtimeold))+"%" | eval countdiff=countnew-countold | eval countdiffpercent=tostring(floor(countdiff*100/countold))+"%" | table url,countold,countnew,countdiff,countdiffpercent,avgtimeold,avgtimenew,avgtimediff,avgtimediffpercent ... View more

are you on 6.5? ... View more

you might need to do: <done> <set token="total">$result.TOTAL$</set> </done> or <preview> <set token="total">$result.TOTAL$</set> </preview> something to help troubleshoot tokens is to use showtokens.js to see if the token is being created/evaluated correctly. ... View more

Try this (put TOTAL in the table but use under options): <row> <panel> <table> <title>TITLE</title> <search> <query>index=idx_abc sourcetype=src_a TOTAL > 10 | table Col1 Col2 Col3 TOTAL </query> <set token="total">$result.TOTAL$</set> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="drilldown">cell</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> <fields>["Col1","Col2","Col3"]</fields> </table> </panel> </row> ... View more

the foreach command is more for evaluating a field/s based on existing field/s, not for joining together searches. map or join would probably be your best bet, though join is usually avoided due to processing. http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Foreach http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Map http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Join ... View more

I hope that you found the 'Attach CSV' and 'Attach PDF' ... View more

is it possible to grab what is in your index index=dbIndex and do an |addcoltotals or a |stats count or dc for all fields and then do a |dbxquery connection=db query="select * from dbTable" and then do the same |addcoltotals or |stats command to the end and see if they come out the same? Just make sure if they have time frames that they're looking at the same one. ... View more

<row> <panel> <table> <search> <query>| metadata type=hosts | head 1</query> <earliest>-60m</earliest> <latest>now</latest> <preview> <set token="host">$result.host$</set> </preview> </search> </table> </panel> </row> <row> <html> $host|h$ </html> </row> ... View more