I have edited my answer and added the join query which I feel is what you need. Gather all the details only for top 10 Users. ... View more

Two ways you could do that: 1) Use lookup table to define the list of users (if it is static list/ or changes less often) and add |lookup <YourLookupTable> User | Provided the user field in Lookup table is also called User same as indexed data. If the list of users are coming from another index you can user a subsearch to get User list(which changes more often [ < base search for Sub-Search > | dedup User | table User] Please let me know if this is what you are looking for or not. ... View more

Glad that Calculated fields worked for you. Requesting you to add your approach as an Answer and accept the same. This way others facing similar issue/scenario will be benefited. ... View more

What action do you want to perform when Status= All ()?\ You can set some default value for that like: *"$Status$" == "",other_duration* ... View more

Are you sure issue is due to asterix and not due to if condition? Try replacing with case statement and add "$Status$" == "*",<somevaluetotest> just to test whether * is being handled. Ideally, there should be no issues with *, Since * = All is a very common value for form Inputs. | eval duration_days = case("$Status$" == "Imported Prod" OR "$Status$" == "Withdrawn",completed_duration,1==1,other_duration) | ... View more

If you want to do it by the UI, first choose the Visualization as Line Chart and then select Null Values as Connect. Then change to any other chart that you want to use and use Chart Overlay. Alternatively you can add the following to Dashboard in Simple XML: <option name="charting.chart.nullValueMode">connect</option> Updated answers I have attached screenshot of a Chart with Overlaid fields AvgOverall... <option name="charting.chart.overlayFields">AvgOverall</option> As you can see Based on Null Value Mode - Gaps, Connect and Zero, I can get different interpretation of series where ever data is not present or null. ... View more

In order to use earliest and latest time in the search for Dynamic Option you would have to explicitly define the token within the Search String. Assuming your time control has token globalTime then, in the Search String for the drop down your can write your search as follows: index=<yourIndex> sourcetype=<yourSourceType> earliest=$globalTime.earliest$ latest=$globalTime.latest$ | <Your reaming Search Goes here> Please let me know if you need example. ... View more

Even in Splunk Simple XML $result.[fieldname]$ is available provided applicable only for the first row. Please check the Search Event Handlers: 1) http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference 2) http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens You can also check out the Splunk 6.x Dashboard Examples App for Search Result Setter example which calls out various search tokens. Please let me know if you need example for $result.[fieldname]$ token. ... View more

You can set the Count to 0 if no result found i.e. Count is null: your base search yourField=* | stats count(yourField) as Count | eval Count=if(isnull(Count),0,Count) | table Count Then set the Trigger Condition as Number of Results -> is equal to -> 0 For the same search as above you can also set Count to -1 in case you do not get any results, just to identify whether the count is actually 0 or null. Then set the Trigger Condition as Number of Results -> is less than ** -> **1 ... View more

Ideally in your case top command should work, however you can also try the stats command in conjunction with sort and head command to validate the results: Option 1 search index="ces-monitor" Interface="HTML (UI)" User=* | top limit=10 User Option 2 search index="ces-monitor" Interface="HTML (UI)" User=* | stats count(User) as Count by User | sort - Count | head 10 If the above two are not working then you might have to provide your query and data. Edited and added the following query, since you need top 10 Users to be used as search criteria in your subsequent search, join on User is an ideal match. Please try the following. There are other better perfroming ways as well. However, they would be specific to use case. search index="ces-monitor" Interface="HTML (UI)" User=* | table _time Action User request_remote_address Duration | join User [search search index="ces-monitor" Interface="HTML (UI)" User=* | top limit=10 User showperc=f showcount=f ] ... View more

Make sure the casing of field User is the same in raw data and the lookup table. If the fields are not exact match they will not join. ... View more

Can you share sample from lookup file including the header and also from the log data couple or _raw events? ... View more

Assuming your lookup table has lookup defined as userdetails Your base search | stats count by User | lookup userdetails User | table User, "Account Type", "Employee RC", "Employee Department", "Student RC" It would be better if your lookup table had fields without spaces like Employee_RC etc ... View more

Table Cell Highlighting is built in to Splunk 6.5. Please explore that option as well. ... View more

Add the following in your search before displaying the table. | search eventcount>=1 AND InvocationType!="ACK" | Transaction command adds eventcount and duration fields to a search. Eventcount gives a list of events that are grouped together based on the transaction id i.e. CorrelationID in your case. Similarly duration is the difference of first and last event matched by transaction in seconds. If you are getting it as 0, it implies you have only single event in the transaction. In order to test transaction you can add CorrelationID=<Your Sample Correlation ID with multiple events> to your base search. Transaction is an expensive command if run for long duration of time and might drop data. You should consider using startswith, endswith, keepevicted, keeporphaned, maxpause and maxspan parameters based on your use case. Infact, you should also explore stats instead of transaction which will return results faster. Refer to the following documentation on Splunk event correlation commands to be used based on various use cases: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation ... View more

Take out <selectFirstChoice>true</selectFirstChoice> ... View more

I know of sparklines and icons within table but not pie chart. With Splunk 6.5 you can conditionally format including color column based on range value. (For example 10.2% above can be green and 97% will be red if it represents available space). With previous versions of Splunk you could use Inline icon like you have shown and inline icon with value 10% next to it (Refer to Splunk 6.x Dashboard examples). Also explore custom visualization Horizon Chart which can show overlaid stats from various server over time. If none of the above suits your needs, can you provide a mock up of what you want? Or if possible some screenshot from another app/visualization on net which does this? ... View more

Can you validate the fields in search are correct? I tested with following data (14041 has only request and no ack and response). The query worked for me. Please play around with final search conditions requestCount and requestTypes (If you are getting count, then requestCount=1 alone without requestType condition, on high level should give you only requests). 2016-10-29 13:24:43.310 student_id=13030 request_type=ack 2016-10-29 13:25:43.310 student_id=13030 request_type=response 2016-10-29 13:26:43.310 student_id=13030 request_type=request 2016-10-29 13:27:43.310 student_id=14040 request_type=request 2016-10-29 13:28:43.310 student_id=14040 request_type=response 2016-10-29 13:29:43.310 student_id=14040 request_type=ack 2016-10-29 13:27:43.310 student_id=14041 request_type=request index=main sourcetype="splunk_answers_475441" | stats count as RequestCount values(request_type) as RequestTypes by student_id | search RequestCount>=1 AND NOT (RequestTypes="response" OR RequestTypes="ack") ... View more

Refer to another one of my answers on how Stats can be used to correlate events. https://answers.splunk.com/answers/474449/how-to-write-a-search-to-display-the-end-date-of-f.html#answer-475430 Send some sample data/field names and I would be able to assist. ... View more

Stats can perform event correlation which you need kindly give some data sample and I can help. Were you able to go though documentation on how stats can perform correlation? ... View more

As far as you are providing string as quotes it is string not epoc time. You can always try two consecutive evals to validate whether it is string time (i.e. using strftime) or epoch time (i.e. using strptime) | eval createDtTest1 = strptime ( YourTimeField, "%Y%m%d%H%M%SZ") | eval createDtTest2 = strftime ( YourTimeField, "%Y%m%d%H%M%SZ") | table YourTimeField, createDtTest1, createDtTest2 ... View more

Although your props.conf has SHOULD_LINEMERGE as false, I am not sure why the screenshot you provided has mutiple events merged together. If every event in your log does not have end line character then you should also consider using BREAK_ONLY_BEFORE or BREAK_ONLY_AFTER parameters for props.conf. Nevertheless, Splunk has several inbuilt algorithms with precedence in order to identify timestamp of each event. If every algorithm fails, it resorts to File Modified time. In your screenshot I can see that even filename is having same date as that logged inside the file. So if you edit Timestamp identification of props.conf, you might be able to tell Splunk to always get date from the file modified date and time from the event timestamp. In your case you may achieve this by setting MAX_TIMESTAMP_LOOKAHEAD=8 which overlooks the event Date: 16-06-2016 00:00:33 to extract datetime of the event. [custom_type] SHOULD_LINEMERGE=false NO_BINARY_CHECK=true CHARSET=AUTO MAX_TIMESTAMP_LOOKAHEAD=8 disabled=false invalid_cause=binary is_valid=false PS: If possible you should consider as to how to get the logs written with Date-Time stamp for each event rather than just time, as Time of event is the most crucial information for proper indexing of data. Above method might fail when date rolls over from one to other around midnight. ... View more

Please refer to various event correlation techniques that Splunk offers: http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Abouteventcorrelation I feel stats command with by parameter as your unique identifier should suffice the need. You might have to provide search and data example for further assistance. ... View more

Since there is an underscore present between milliseconds and microseconds, and strptime can parse using single time format variable %N, it will not be able to parse beyond underscore even with %6N, hence will skip microseconds. Would there be any possibility of change of logging event timestamp from 2016-10-29 13:24:43.310_394 to 2016-10-29 13:24:43.310394? If that is done then your existing pros.conf should work. TIME_FORMAT=%Y-%m-%d %H:%M:%S.%6N ... View more

Assuming your data has student_id and request_type fields. your search query | stats count as RequestCount values(request_type) as RequestTypes by student_id | search RequestCount>=1 AND NOT (RequestTypes="response" OR RequestTypes="ack") Setup Alert with 1) Alert Type > Scheduled "Run on Cron Schedule" and for running every 15 minutes (For example following is only for weekdays): */15 * * * 1-5 2) Trigger Condition > Trigger Alert when "Number of Results" "is greater than" 0 ... View more