You can edit panel and choose how to handle null values. If you are plotting area chart as per your screenshot. You currently have the Null Values in your timechart treated as Gaps, you can change the same to Zero (equivalent of writing fillnull command) or else mark as Connect (which is equivalent of writing filldown command). ... View more

Final eval should look like the following: (You can use cascaded replace command to find string patterns and replace with what you want in a column. <Your Base Search> | eval column=replace(replace(replace(column,"Math_total_score","Math"),"English_countable_score","English"),"Phy_countable_score","Phy") ... View more

If field D is always present but may differ in your three indexes you can use D=* in your base search. ... View more

If D is the transaction ID to correlate the same event in three indexes then you can try index=A OR index=B OR index=C <Add your Base Search Filter cirteria/s> | stats count as EventCount values(index) as MatchedIndexes min(_time) as MinTime max(_time) as MaxTime by D | search MatchedIndexes=A AND MatchedIndexes=B AND MatchedIndexes!=C | eval durationInSeconds=MaxTime-MinTime | eval _time=MinTime | table _time D EventCount MatchedIndexes durationInSeconds ... View more

If you upgrade to 6.5 or higher you will have cell coloring option built in to the table. Without JS/CSS extension. ... View more

@pratyush46 is your issue resolved? ... View more

@splunkrocks2014 Were you able to try the example provided? ... View more

@repo12.... please take out Status filter from Base Search add Status as the by clause in your query <your base search> Status=* phonestatus="Invalid" | stats dc(cid) as TotalDliveryFailedcount by Status ... View more

@splunkn were you able to try the blacklist solution? ... View more

@enexwhy is your issue solved. Were you able to run the test code I have attached? ... View more

You would need to provide more details on the fields and if possible sample data... For example if the two fields in first lookup are user and count, second lookup is user and task_performed and third one is user and task_not_performed <Your Base Search> | stats values(count) as Count values(task_performed) values(task_not_performed) by user ... View more

Please add more details whether field D is to correlate the events or compare the events. Do you have some sample of data from three indexes? ... View more

Not sure if the following solves, however, seems like you need something like streamstats to capture events prior to Reset <Your Base Search>| streamstats count as EventCount min(_time) as Earliest max(_time) as Latest values(Fault) as Faults values(Status) as Status by Reset_field reset_before="("match(Reset_field,\"Reset\")")" ... View more

Have you validated BBB and AAAA values are different or not? Can you add few data samples? ... View more

@puneetkharbanda, was your problem solved. Please accept if this answer helped you resolve the issue if not please let us know if further help is needed. ... View more

@dexxter275... kindly accept if this solved your problem. Let me know otherwise. ... View more

Try the following. Use eventstats to compute Total stats and add the the events. <Your Base Search> | eventstats count(Message) as FullCount | stats dc(Host ) as UniqueCount last(FullCount) as FullCount | eval ratio=round(FullCount/UniqueCount,2) ... View more

@LNebout, Kindly accept the answer if this solved the issue you were facing. If not please let me know. ... View more

I tried the following and it worked fine for me. Similar to the example you have provided. <panel> <table> <search> <query>| makeresults | eval can_click="dev.splunk.com" | eval cannot_click = "dev.splunk.com/view/webframework-codeexamples/SP-CAAAEVU" | eval can_click_but_forward_slashes_replaced = "view/webframework-codeexamples/SP-CAAAEVU" | eval with_cdata__cannot_click = "dev.splunk.com/view/webframework-codeexamples/SP-CAAAEVU" | eval with_cdata__can_click_but_forward_slashes_replaced = "view/webframework-codeexamples/SP-CAAAEVU" | table can_click, cannot_click, can_click_but_forward_slashes_replaced, with_cdata__cannot_click, with_cdata__can_click_but_forward_slashes_replaced</query> <earliest>-60m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <drilldown> <condition field="can_click"> <link>http://$row.can_click$</link> </condition> <condition field="cannot_click"> <link>http://$row.cannot_click|n$</link> </condition> <condition field="can_click_but_forward_slashes_replaced"> <link>http://dev.splunk.com/$row.can_click_but_forward_slashes_replaced|n$</link> </condition> <condition field="with_cdata__cannot_click"> <link><![CDATA[http://$row.cannot_click|n$]]></link> </condition> <condition field="with_cdata__can_click_but_forward_slashes_replaced"> <link><![CDATA[http://dev.splunk.com/$row.can_click_but_forward_slashes_replaced|n$]]></link> </condition> </drilldown> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> ... View more

As one of the options you can define Blacklist in your inputs.conf for the monitor data input you currently have. [monitor://<YourFolderStructure>\enva*\logs\*] blacklist = <YourFolderStructure>\enva1\logs\* For information on Blacklisting refer to following documentation: https://docs.splunk.com/Documentation/Splunk/latest/Data/Whitelistorblacklistspecificincomingdata#Blacklist_.28ignore.29_files ... View more

No, I answered expecting issue is with dropdown. I also noticed the same behavior as what you have mentioned with the time control. Have you opened a ticket with Splunk Support. This seems to be a bug unless someone else in the community confirms otherwise. I just converted my answer to a comment so that it gets highlighted as unanswered question for someone else to assist. Just curious do you want to display dates or custom time selections like Today, Yesterday, Previous Week etc? Would it be possible for you to provide a dropdown or combinations of text boxes until the issue is resolved for users to provide time? ... View more

I did not notice that it was for time input. I am changing my answers as comment. ... View more