Perhaps you need to use rising column mode instead of batch mode in the input? ... View more

Here is how I did it. I used loadjob to call a specific report and then piped it to a search command that includes tokens |loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$ Here is what it looks like in XML Look up loadjob for more info. <panel> <input type="text" token="UserName" searchWhenChanged="true"> <label>UserName</label> <suffix>*</suffix> <default>*</default> </input> <table> <title>Table of Clipping and Signal to Noise Ratio activity By Group</title> <search> **<query>|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$</query>** <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> ... View more

Thank you so much for your response and the code. I tried this.. Even then All values are getting populated wen i select 'All' in first drop down.. I just want to display 'All' and user should not have the ability to select other values from second drop down. ... View more

You're welcome. The little results chart I made helped me simplify the question. There was only one condition that ever showed green (green==2), so from there it was easy. ... View more

The issue here is that you have overlapping monitor stanzas. The * in the source implicitly tells Splunk to monitor files in /home/gcaaxfer/data/ for both, resulting in the overlapping stanzas and only one of them being read. The recommended approach to solve this issue is to create one stanza in inputs.conf to read in both sets of files and also deploy a props.conf within the same add-on on the Forwarder to specify the sourcetype based on the source. As follows: inputs.conf: [monitor:///home/gcaaxfer/data] whitelist = (*NR*.csv | *ticket*.csv) host_segment = 3 index = my_index disabled = false props.conf: [source::.../*NR*.csv] sourcetype = request_nr [source::.../*ticket*.csv] sourcetype = request_ticket Now that you've assigned them to separate sourcetypes, you can easily update your props.conf on your Indexers and/or Heavy Forwarders to properly perform the separate time extractions. ... View more

ok thanks a lot.. I will check on the delete functionality.. ... View more

I have converted my comment to an answer, if you could accept it so that it's an answered question, that'd be great 🙂 Glad it's working ... View more

Thanks a lot. I dint know this can be overridden.. This will help me with my other cases as well. ... View more

Thank you so much.. it worked.. foreach * [eval <>=round('<>'*100/Total] .. I was struggling with this for such a long time.. ... View more

I am also facing the similar kind of issue. Below is the part of my code. I am trying to make drill down in the same dashboard. From the panel1, I am taking the token input of click value as "feature" and passing to panel2. In the condition part if my token $feature$ = "FileInspector", then I am setting a Query itself as a token called "querytocall". if the token $feature$ = "UMB", then setting other query to the same token "querytocall". At last I am passing that token "querytocall" itself as a search query for the Panel2. But this is not working. My panel2 is showing as "waiting for the input" <drilldown> <set token="feature">$click.value$</set> </drilldown> </chart> </panel> <panel> <title>$feature$ - Exception From Hosts Details</title> <chart depends="$feature$"> <change> <condition match=" $feature$ == &quot;FileInspector&quot; "> <set token="querytocall">index=a source=b | eval....</set> </condition> <condition match=" $feature$ == &quot;UMB&quot; "> <set token="querytocall">index=c source=d | eval....</set> </condition> </change> <search> <query>$querytocall$</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> Could anyone please help me on this. ... View more

Thank you so much.. It worked.. Problem is I have to calculate the %. Hence If i give in base search I will not be able to get total count to calculate % . In the first query my Total_Events is same as Missed_count.. If there is any other better approach please let me know.. Thanks a lot.. ... View more

trans_type was not the field name from source.. Hence it dint work.. when i just used the same field name from source it worked.. ... View more

It worked the way i wanted.. Thank you so much.. ... View more

Harini, did you find a solution to this issue? ... View more

Thanks for response everyone.. None of these are working.. My field values are like "Change Request - HR & Payroll - Time Management (TM)" and "Change Request - Logistics - Materials Management (MM)".. I have to replace part of the string in each field value.. Im able to get this done with rex and sed.. rex field=categories mode=sed "s/Change Request/CR/" |rex field=categories mode=sed "s/Central Functions/CF/" But i want to add this as calculated field using eval.. Any ideas on this..? Thanks a lot.. ... View more

Thank you! Worked the way i wanted 🙂 ... View more

Hi, Using stats worked. 1st query did not work. There is another option with join. I did with that. Thanks a lot for your response ... View more

@k_harini Just install Python version 2.7.x instead of Python version 3.x. ... View more

This is working now. Thanks much ... View more

Did this work? I'm facing same issue ... View more

ok sure.. will try.. Thanks a lot.. ... View more

yannk mentions the SOS app - this has been deprecated - if you have version 6.3 or above this has been replaced by the DMC. We too are getting this error message - any thoughts on a solution for this issue? Audit event generator: Now skipping indexing of internal audit events, because the downstream queue is not accepting data. Will keep dropping events until data flow resumes. Review system health: ensure downstream indexing and/or forwarding are operating correctly. ... View more