Just reverse depends and rejects between your table and panel. Also for debugging the Set/Unset Token Value please change the table title to <title>Geographically Improbable Accesses ($show_html$)</title> Also, in HTML section, <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart! ($show_html$)</p> If it still does not work, please paste the final code. ... View more

@bshega... Will it be possible for you to copy paste a JSON mocked data sample as a code block? Use the 1010 button while pasting the code so the Splunk Answer does not interpret as special characters. ... View more

@puneethgowda Can you post this as separate question as this is completely unrelated. Also, may i know whether you want to implement password expiry in Splunk or you want to track password expiry of an Application being monitored via Splunk? ... View more

@bharpur183 Yes it should be the first line... Usually label and description follow after these and then the code starts like fieldsets with inputs and then row panel vizualizations etc. Refer to following two documentation if you want to understand forms and Simple XML reference https://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML ... View more

As I had mentioned this is based on the type of view you are using... it will be either dashboard or form...in your case seems like you are using a form with inputs. <form refresh="120"> ... View more

@SNaikwade, which version of Splunk are you running? can you change from searchPostProcess to search? ... View more

If you search with spath output=outlet_states path=object.outlet_states you should get a multivalue result. If you want to get individual you will have to use spath output=outlet1 path=object.outlet_states{0} and similar commands. Which one do you want to use? Refer to Splunk Documentation on spath, which should have examples for both.http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath You can also enable automatic Key Value field extraction by setting KV_MODE=json in props.conf Refer to the documentation: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Automatickey-valuefieldextractionsatsearch-time In either case if you want to convert "false" to "off" you can use replace command. For example your first query can be changed to <yourBaseSearch> | spath output=outlet_states path=object.outlet_states | | replace "false" with "off" in outlet_states Similarly your second option to <yourBaseSearch> | spath output=outlet_states1 path=object.outlet_states{0} | | replace "false" with "off" in outlet_states1 ... View more

@mblauw... Will you be able to add any details from your search or screenshot of your visualization? Also which version of Splunk are you on? Is it 6.5? ... View more

@DPZ_Luke, first of all sorry search Value should have been greater than 70. I have corrected the same in my answer. I have also added query with stats command. Hoping you run the query for last 1 minute with span=1m. Based on your scenario you should go for streamstats (@DalJeanis has suggested one). How soon do you want your search queries to run (or what is the schedule for your alert)? What is the period you want to look back to identify threshold breach for both Memory and CPU? For example you run the search: 1) every 2 minute for past 2 minute or 2) every 2 minutes for past 3 minutes or 3) every minute for past 1 minute or 4) every minute for past 2 minutes ... View more

@krdo I have updated my answers with the earliest and latest time to be included in the base search. Sorry row.drilldown was a typo... I corrected that also. Please try out the query and it should work fine... Let me know otherwise... I will mark this as a comment for the community to pick up and answer! ... View more

@qygoh... table with single row... yes you can but with result.<fieldname> you can not only have single value even if the search returns multiple results. In other words you can replace the chart with either Single Value, Status Indicator(Custom Visualization), Other Gauges or HTML panel. ... View more

@qygoh Anytime... glad it worked!!! ... View more

@sravankaripe... based on your code sample it is a bit confusing as to what you are trying to do... First you have multiselect input with the query to populate UserName (it implies your search returns multiple results). Then you have a table with same search where you are setting token through result.UserName. (this will always pick single value either from single result or first row of multiple results. Can you please confirm whether your search will return single result or multiple? Can you provide a context of what you want from the two searches? and why exactly you need output like UserName : Kathy8? Meanwhile your search should ideally run better if rearrange final two pieces like the following: <your base search> search UserName!="" | table UserName ... View more

@rwiley, I have seen Yellow in Map visualization, so this was rather interesting issue. If possible can you share mock? Have you opened up a support ticket with Splunk otherwise? Which map visualization are you using and what version of Splunk? ... View more

[Updated - Included Stats command, changed span=1m] You can try something like the following. I have used timechart but you can use stats. Also depending upon whether you want to use the query for Dashboard or Alert, you can set the time range for the search and might not need explicit span=1m or bucket _time span=1m host="HOST1" (sourcetype="Perfmon:CPU Load" object="Processor" counter="% Processor Time") OR (sourcetype="Perfmon:Memory" collection=Memory object=Memory counter="% Committed Bytes In Use") | search Value>70 | eval metrics=object." - ".Value | timechart span=1m count as eventcount values(metrics) as metrics | search eventcount >1 Stats Command source="Perfmon:*" (object="Processor*" counter="% Processor Time") OR (object=Memory counter="% Committed Bytes In Use") | search Value>70 | eval metrics=object." - ".Value | bin span=1m _time | stats count as eventcount values(metrics) as metrics by _time | search eventcount>1 ... View more

Here is an example based off Splunk's internal index. It created Dropdown for Sourcetypes to be used across dashboard. It also has a Time control to allow specifying earliest and latest time for dropdown and the panels. I have added Time Control the example just to show that timerange for a Dynamic Query in dropdown can be specified only in the inline search using command like this earliest=$tok_time.earliest$ latest=$tok_time.latest$ <form> <label>Splunk Answers 505259</label> <fieldset submitButton="false"> <input type="time" token="tok_time" searchWhenChanged="true"> <label>Global Time Selector</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="tok_sourcertype" searchWhenChanged="true"> <label>Select Sourcetype</label> <choice value="*">All</choice> <default>*</default> <prefix>sourcetype="</prefix> <suffix>"</suffix> <initialValue>*</initialValue> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <search> <query>index=_internal sourcetype=* earliest=$tok_time.earliest$ latest=$tok_time.latest$ | dedup sourcetype | sort sourcetype | table sourcetype</query> <earliest>0</earliest> <latest></latest> </search> </input> </fieldset> <row> <panel> <title>Panel 1</title> <chart> <search> <query>index=_internal $tok_sourcertype$ | stats count by log_level</query> <earliest>$tok_time.earliest$</earliest> <latest>$tok_time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.chart">pie</option> </chart> </panel> <panel> <title>Panel 2</title> <table> <search> <query>index=_internal $tok_sourcertype$ | stats count by log_level</query> <earliest>$tok_time.earliest$</earliest> <latest>$tok_time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> Besides basic form input elements you should also consider reading Input Event Handlers: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference and also Token Usage in Dashboards which also covers Search Event Handlers: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens Ideally, the scenario for example used here is suitable for post processing as same stats query is used in two places. So the underlying query to pull stats will run only once. However, post processing should be applied as per use case as it has its limitations and guidelines as well. (http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Post-process_searches) ... View more

Since you do not have a unique transaction ID, you can make use of streamstats. First you would need to perform field extractions. Since status is key value pain in your data, it should be automatically extracted as search time. You can use Pipe delimited Interactive Field Extraction in Splunk transforms.conf [sesionlog] DELIMS = "|" FIELDS = "field1","thread_id","log_level","trans_id","status_details" Finally, for Session ID you can use regular expression based field extraction. props.conf [sesionlog] EXTRACT-session_id = ^[^\(\n]*\((?P<session_id>\d+) Finally try streamstats like following which resets counter every time after finding an Active status(there can be multiple options) index=<YourIndexName> sourcetype=sesionlog status="pending_app_gw." OR status="ACTIVE." | table _time session_id trans_id thread_id log_level status | reverse | streamstats count current=f reset_after="("status==\"ACTIVE.\"")" | stats count as eventcount min(_time) as MinTime max(_time) as MaxTime values(status) as status values(count) as CountFlag by session_id trans_id | search (eventcount=3 AND CountFlag=2 AND status="pending_app_gw." AND status="ACTIVE.") OR (eventcount=1 AND CountFlag=0 AND status="pending_app_gw." AND status!="ACTIVE.") | eval OrphanedPendingStatusDuration=now()-MinTime | rename MinTime as OrphanedPendingStatusTime | fieldformat OrphanedPendingStatusTime=strftime(OrphanedPendingStatusTime,"%c") | fieldformat MaxTime=strftime(MaxTime,"%c") PS: Based on your data there might be other combinations as well. Like (eventcount=2 AND CountFlag=1 AND status="pending_app_gw." AND status="ACTIVE.") represents all expected Pending Status followed by Active Status. ... View more

@robertlynch2020 ... You can convert your previous comment as an answer and vote the same. However, this goes back to my point that same label name across the dashboard will pick same color because default series colors are predefined. ... View more