Thank you But i alrady have a dashboard with time range picker, and i can't use | eval earliest_DB1 = strftime(@d, "%Y-%m-%d %H:%M:%S") ... View more

Hello, In Splunk The Y-axis is always a number value, so you must convert end-time to number Regardes ... View more

Hello can you try this please: in the props.conf [xml2] DATETIME_CONFIG = NO_BINARY_CHECK = 1 category = Structured pulldown_type = 1 SHOULD_LINEMERGE = true REPORT-xmlkv = xml_trans2 disabled = false in your transforms.conf add : [xml_trans2] REGEX=<([^>]+)>([^<]+)<\/\1> FORMAT=$1::$2 MV_ADD = true ... View more

Hello, You can use the tag or alias in Splunk, that acn help you to manage and organise your data Regards ... View more

Hello, Can you try this please: |makeresults | eval field="900 ms" | rex field=field "(?<field>\d+)" Regards ... View more

Hello, You can also use the regex OR match function: match: , | inputlookup mylookup | where !match(host,"(\d{1,3}\.){3}\d+") | table host Regex: | inputlookup mylookup | regex host!="^(\d{1,3}\.){3}\d{1,3}$" | table host ... View more

Hello, If you add lookup in your app, and chose the area visualisation, you must have what you need: | inputlookup Ptest.csv Dashboard Example: <dashboard> <label>Ptest</label> <row> <panel> <chart> <search> <query>| inputlookup Ptest.csv</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">area</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> </dashboard> ... View more

Hello, If you have a search query in your dashboard you can use else you can use the html balise For example (You can pas all this code in your dashboard): <form> <label>TEST</label> <fieldset submitButton="false"> <input type="multiselect" token="field1"> <label>field1</label> <choice value="Host">Host</choice> <choice value="Environment">Environment</choice> <choice value="Node Group">Node Group</choice> <delimiter>:</delimiter> <valuePrefix>'</valuePrefix> <valueSuffix>'</valueSuffix> </input> </fieldset> <row> <panel> <table> <search> <query>index=_internal | stats count by log_level | eventstats sum(count) as somme | eval perc=100*count/somme</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <drilldown> <link> <![CDATA[ http://localhost:8000/fr-FR/app/search/search?q=search%20index%3D_internal%20log_level%3D*&]]> </link> </drilldown> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> <row> <panel> <html> <a href="http://localhost:8000/fr-FR/app/search/search?q=search%20index%3D_internal%20log_level%3D*">drilldown</a> </html> </panel> </row> </form> ... View more

Hey, If that work, xan you please up vote my respense or accept my answer to help another person. Thank's ... View more

Hello, can you past this example in your barre search: | makeresults | eval _raw="time=2018-04-30 10:39:16.652 CEST processID=12116 appname= username= dbname= remoteHost= sessionid=5ae6d634.2f54 message=LOG: A long long log message" | rex "message=(?<_raw>.*)" ... View more

Can you try this please: <your_base_search> | eval _time=strftime(_time,"%Y-%m-%dT%H:%M:%S.%3Q") ... View more

@mallempatisreedhar , can you try this please: | rex "^.*(?=(\d{4}-\d+-\d+\s\d+:\d+:\d+[,.]\d+))(?<time>\d{4}-\d+-\d+\s\d+:\d+:\d+[,.]\d+)" if you want extract the time at parsing using sourcetype stanza props.conf: TIME_FORMAT=%Y-%m-%d %H:%M:%S TIME_PREFIX=^.*(?=(\d{4}-\d+-\d+\s\d+:\d+:\d+[,.]\d+)) ... View more

@mschellhouse , can you try this please: <fieldset submitButton="false"> <input type="multiselect" token="field1"> <label>field1</label> <choice value="Host">Host</choice> <choice value="Environment">Environment</choice> <choice value="Node Group">Node Group</choice> <delimiter>:</delimiter> <valuePrefix>'</valuePrefix> <valueSuffix>'</valueSuffix> </input> </fieldset> ... View more

@bhumikajpatel, are you test my proposition? ... View more

Can you try this please: <yourbasesearch> | stats count(ID) dc(ID) dc(eval(!isnull(ID) AND index="CA")) as val3 by Index(2) ... View more

In left you have zero betwen two arrow clic to up vote, Thank's ... View more

Can you up vote please to help another person ... View more

Hello, You are right, i test in Splunk Entreprise 7.1 i have the same probleme, You can use if function | makeresults | table _time my_null_field | eval my_null_field =if(isnull(my_null_field),"?","") ... View more

Can you try this please: | eval Error = if(test1 > 2,1,0) | eval Erreur = if(test2 > 2,1,0) | stats count as TOTAL, sum(Erreur) as Erreur_test1, sum(Error) as Error_test2 | eval perc_err_test1 = round((Erreur_test1 / TOTAL) * 100,2)."%" , perc_err_test2 =round( (Error_test2 / TOTAL) * 100,2)."%" OR if you want use subtr command: | eval Error = if(test1 > 2,1,0) | eval Erreur = if(test2 > 2,1,0) | stats count as TOTAL, sum(Erreur) as Erreur_test1, sum(Error) as Error_test2 | eval perc_err_test1 =(Erreur_test1 / TOTAL) * 100,2) , perc_err_test2 =(Error_test2 / TOTAL) * 100,2) | eval perc_err_test1=substr(perc_err_test1,1,5)."%", perc_err_test2=substr(perc_err_test2,1,5)."%" ... View more

@imran1386, I add the answer, can you test it please ... View more

@imran1386, can you try this please: if URLType1 take always the first position: <YourBaseSearch> | streamstats count by Functionality | eval URL=if(count=1,URL,null) | filldown URL | stats sum(Time) as somme max(Time) as max by Functionality URL | eval Time=2*max-somme | table Functionality URL Time if URLType1 have always the max value of Time Try this: <YourBaseSearch>| eventstats max(Time) as max by Functionality | eval URL=if(max=Time,URL,null) | filldown URL| stats sum(Time) as somme max(Time) as max by Functionality URL | eval Time=2*max-somme | table Functionality URL Time Happy Splunking ... View more