@repo12.... please take out Status filter from Base Search add Status as the by clause in your query <your base search> Status=* phonestatus="Invalid" | stats dc(cid) as TotalDliveryFailedcount by Status ... View more

@splunkn were you able to try the blacklist solution? ... View more

@enexwhy is your issue solved. Were you able to run the test code I have attached? ... View more

You would need to provide more details on the fields and if possible sample data... For example if the two fields in first lookup are user and count, second lookup is user and task_performed and third one is user and task_not_performed <Your Base Search> | stats values(count) as Count values(task_performed) values(task_not_performed) by user ... View more

Please add more details whether field D is to correlate the events or compare the events. Do you have some sample of data from three indexes? ... View more

Not sure if the following solves, however, seems like you need something like streamstats to capture events prior to Reset <Your Base Search>| streamstats count as EventCount min(_time) as Earliest max(_time) as Latest values(Fault) as Faults values(Status) as Status by Reset_field reset_before="("match(Reset_field,\"Reset\")")" ... View more

Have you validated BBB and AAAA values are different or not? Can you add few data samples? ... View more

@puneetkharbanda, was your problem solved. Please accept if this answer helped you resolve the issue if not please let us know if further help is needed. ... View more

@dexxter275... kindly accept if this solved your problem. Let me know otherwise. ... View more

Try the following. Use eventstats to compute Total stats and add the the events. <Your Base Search> | eventstats count(Message) as FullCount | stats dc(Host ) as UniqueCount last(FullCount) as FullCount | eval ratio=round(FullCount/UniqueCount,2) ... View more

@LNebout, Kindly accept the answer if this solved the issue you were facing. If not please let me know. ... View more

I tried the following and it worked fine for me. Similar to the example you have provided. <panel> <table> <search> <query>| makeresults | eval can_click="dev.splunk.com" | eval cannot_click = "dev.splunk.com/view/webframework-codeexamples/SP-CAAAEVU" | eval can_click_but_forward_slashes_replaced = "view/webframework-codeexamples/SP-CAAAEVU" | eval with_cdata__cannot_click = "dev.splunk.com/view/webframework-codeexamples/SP-CAAAEVU" | eval with_cdata__can_click_but_forward_slashes_replaced = "view/webframework-codeexamples/SP-CAAAEVU" | table can_click, cannot_click, can_click_but_forward_slashes_replaced, with_cdata__cannot_click, with_cdata__can_click_but_forward_slashes_replaced</query> <earliest>-60m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <drilldown> <condition field="can_click"> <link>http://$row.can_click$</link> </condition> <condition field="cannot_click"> <link>http://$row.cannot_click|n$</link> </condition> <condition field="can_click_but_forward_slashes_replaced"> <link>http://dev.splunk.com/$row.can_click_but_forward_slashes_replaced|n$</link> </condition> <condition field="with_cdata__cannot_click"> <link><![CDATA[http://$row.cannot_click|n$]]></link> </condition> <condition field="with_cdata__can_click_but_forward_slashes_replaced"> <link><![CDATA[http://dev.splunk.com/$row.can_click_but_forward_slashes_replaced|n$]]></link> </condition> </drilldown> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> ... View more

As one of the options you can define Blacklist in your inputs.conf for the monitor data input you currently have. [monitor://<YourFolderStructure>\enva*\logs\*] blacklist = <YourFolderStructure>\enva1\logs\* For information on Blacklisting refer to following documentation: https://docs.splunk.com/Documentation/Splunk/latest/Data/Whitelistorblacklistspecificincomingdata#Blacklist_.28ignore.29_files ... View more

No, I answered expecting issue is with dropdown. I also noticed the same behavior as what you have mentioned with the time control. Have you opened a ticket with Splunk Support. This seems to be a bug unless someone else in the community confirms otherwise. I just converted my answer to a comment so that it gets highlighted as unanswered question for someone else to assist. Just curious do you want to display dates or custom time selections like Today, Yesterday, Previous Week etc? Would it be possible for you to provide a dropdown or combinations of text boxes until the issue is resolved for users to provide time? ... View more

I did not notice that it was for time input. I am changing my answers as comment. ... View more

I have attached a screenshot with Total clicked and some other value clicked and printed using the following code. Can you try the following code? Can you ensure that you have your field value being tested for row.vendor is placed under dollar sign? Also the double quote in condition block should be escaped as written in the query. Value of Total being matched is case sensitive so if you are printing Total in loswer case you should mention the same as $row.vendor$. (Field Names are always case sensitive, so make sure vendor is lower case not upper. Try out the following code as it should run anywhere(query is on Splunk's _internal index so as far as you have access to query the same it should work.) <panel> <table> <search> <query>index=_internal sourcetype=splunkd | eval vendor=log_level | stats count by vendor | addcoltotals labelfield=vendor</query> <earliest>-60m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <drilldown> <condition match="$row.vendor$==&quot;Total&quot;"> <set token="myTest">form.Vendor=*</set> </condition> <condition> <set token="myTest">form.Vendor=$row.vendor$</set> </condition> </drilldown> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> <html> <p>My Test Token=$myTest$</p> </html> </panel> ... View more

You need to blacklist your [WinEventLog://Security] input in inputs.conf blacklist= EventCode="4658" Refer to the documentation for using Whitelist and Blacklist in input.conf http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Create_advanced_filters_with_.27whitelist.27_and_.27blacklist.27 Also for specs and conf of inputs.conf please refer http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf ... View more

In 6.5 Splunk has introduced an init section where token values can be defaulted. On form load you can code init section to unset the token so that your input is not rendered on Dashboard load. Later you can set it through Dashboard events like Search or Input or Visualization Events <init> <unset token="myToken"></unset> </init> <fieldset submitButton="false"> <input type="dropdown" token="selLogLevel" depends="$myToken$"> <label>Select Log Level</label> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> <fieldForLabel>log_level</fieldForLabel> <fieldForValue>log_level</fieldForValue> <search> <query>index=_internal sourcetype=splunkd log_level=* | dedup log_level | sort log_level | table log_level</query> </search> </input> </fieldset> The above code will not render the dropdown. You can change from unset to set and it will render. ... View more

Following is a run anywhere example just change the App Name and Dashboard Name. In fact even if you do not have right app and dashboard you should be able to see the values being sent as Selected vendor column value or asterisk in case the same is Total. <panel> <table> <search> <query>index=_internal sourcetype=splunkd | eval vendor=log_level | stats count by vendor | addcoltotals labelfield=vendor</query> <earliest>-60m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <drilldown> <condition match="$row.vendor$==&quot;Total&quot;"> <link>app/<myappname>/<MyTestDashboard>/form.Vendor=*</link> </condition> <condition> <link>app/<myappname>/<MyTestDashboard>/form.Vendor=$row.vendor$</link> </condition> </drilldown> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> If you want to test out whether the tokens are being set properly instead of link you can use set or eval for the same and print out the token using html <eval token="SelectedField">if($row.vendor=="Total","*",$row.vendor)</eval> Following is example of html section. Selected Field Name: $SelectedField$ ... View more

You column name is vendor right? ... View more

You can try streamstats <Your Base Search> | streamstats count by IP reset_on_change=true Please refer to the documentation on the same: http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Streamstats ... View more

Can you give timechart command you are using are you computing AverageValue ActualValue and Deviation value using the final timechart command or using stats/eval prior to that? In case you already have computed average Actual and Deviation prior to the timechart then based on the number of buckets per day for a month you might have to use values() or min() or max() or any other suitable command. For the deviation percent field, make sure it is numeric field to be plotted. Are you using Calendar Heat Map custom visualization or using JS/CSS extension? ... View more