Seems like you need the following, IDs processed every second (which in-turn will require you to run the search for shorter duration) : your base search ID=* | timechart span=1s count(ID) as "IDs Processed" If this is not what you need please provide field names and examples. ... View more

If you have setup Roles and Users from Settings -> Access Controls in Splunk then, all you need to do is set Permissions against each Dashboard/Reports/Alerts and Based on the need Share it within App, and grant Read Write or no Access for specific users. Refer to the following documentation http://docs.splunk.com/Documentation/Splunk/latest/Viz/DashboardPermissions ... View more

There were asterix * which got included in the link. Please try again. However, $env.app$ can be used in your dashaboard for pulling App Name. You can directly try printing in HTML panel. ... View more

You can try the following which gives duration in minute for last event received for each SQL Job. You can setup alert for duration > SLA or specific JOB not found in the following result i.e. Number of Results < 6. host=host08 SourceName="SQLAgentHost08" EventCode=208 SQL_JOB_NAME=* | stats count as Count max(_time) as LastReceived by SQL_JOB_NAME | eval LastReceivedTime=strftime(LastReceived,"%Y/%m/%d %H:%M:%S") | eval durInMin=round((now()-LastReceived)/60,1) | fields - LastReceived ... View more

Edite my answer, added the option to do the same in Splunk 6.5 with the latest init section available on forms in Simple XML to set tokens on page load ... View more

There are two ways you could do it. Option 1 Using your case statements you need to add double quotes for values 5, 6 and 7 on right side of evaluation expression. index=java host=*myhost* "PLACEORDER_API_UNSUCCESSFUL" orderSourceId=7 OR orderSourceId=6 OR orderSourceId=5 | eval Channel=case(orderSourceId == "7", "Desktop", orderSourceId == "6", "Andriod", orderSourceId == "5", "iOS") | stats count AS Failure BY Channel Option 2 index=java host=*myhost* "PLACEORDER_API_UNSUCCESSFUL" orderSourceId=7 OR orderSourceId=6 OR orderSourceId=5 | eval Channel=orderSourceId | replace "7" with "Desktop" in Channel|replace "6" with "Android" in Channel| replace "5" with "iOS" in Channel| stats count AS Failure BY Channel PS: Instead of eval Channel=orderSourceID you can also use rename orderSourceId as Channel. While Using replace command numbers 5, 6 and 7 need not be in double quotes, but safety does not harm 🙂 ... View more

I have edited my answer and added the join query which I feel is what you need. Gather all the details only for top 10 Users. ... View more

Two ways you could do that: 1) Use lookup table to define the list of users (if it is static list/ or changes less often) and add |lookup <YourLookupTable> User | Provided the user field in Lookup table is also called User same as indexed data. If the list of users are coming from another index you can user a subsearch to get User list(which changes more often [ < base search for Sub-Search > | dedup User | table User] Please let me know if this is what you are looking for or not. ... View more

Glad that Calculated fields worked for you. Requesting you to add your approach as an Answer and accept the same. This way others facing similar issue/scenario will be benefited. ... View more

What action do you want to perform when Status= All ()?\ You can set some default value for that like: *"$Status$" == "",other_duration* ... View more

Are you sure issue is due to asterix and not due to if condition? Try replacing with case statement and add "$Status$" == "*",<somevaluetotest> just to test whether * is being handled. Ideally, there should be no issues with *, Since * = All is a very common value for form Inputs. | eval duration_days = case("$Status$" == "Imported Prod" OR "$Status$" == "Withdrawn",completed_duration,1==1,other_duration) | ... View more

If you want to do it by the UI, first choose the Visualization as Line Chart and then select Null Values as Connect. Then change to any other chart that you want to use and use Chart Overlay. Alternatively you can add the following to Dashboard in Simple XML: <option name="charting.chart.nullValueMode">connect</option> Updated answers I have attached screenshot of a Chart with Overlaid fields AvgOverall... <option name="charting.chart.overlayFields">AvgOverall</option> As you can see Based on Null Value Mode - Gaps, Connect and Zero, I can get different interpretation of series where ever data is not present or null. ... View more

In order to use earliest and latest time in the search for Dynamic Option you would have to explicitly define the token within the Search String. Assuming your time control has token globalTime then, in the Search String for the drop down your can write your search as follows: index=<yourIndex> sourcetype=<yourSourceType> earliest=$globalTime.earliest$ latest=$globalTime.latest$ | <Your reaming Search Goes here> Please let me know if you need example. ... View more

Even in Splunk Simple XML $result.[fieldname]$ is available provided applicable only for the first row. Please check the Search Event Handlers: 1) http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference 2) http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens You can also check out the Splunk 6.x Dashboard Examples App for Search Result Setter example which calls out various search tokens. Please let me know if you need example for $result.[fieldname]$ token. ... View more

You can set the Count to 0 if no result found i.e. Count is null: your base search yourField=* | stats count(yourField) as Count | eval Count=if(isnull(Count),0,Count) | table Count Then set the Trigger Condition as Number of Results -> is equal to -> 0 For the same search as above you can also set Count to -1 in case you do not get any results, just to identify whether the count is actually 0 or null. Then set the Trigger Condition as Number of Results -> is less than ** -> **1 ... View more

Ideally in your case top command should work, however you can also try the stats command in conjunction with sort and head command to validate the results: Option 1 search index="ces-monitor" Interface="HTML (UI)" User=* | top limit=10 User Option 2 search index="ces-monitor" Interface="HTML (UI)" User=* | stats count(User) as Count by User | sort - Count | head 10 If the above two are not working then you might have to provide your query and data. Edited and added the following query, since you need top 10 Users to be used as search criteria in your subsequent search, join on User is an ideal match. Please try the following. There are other better perfroming ways as well. However, they would be specific to use case. search index="ces-monitor" Interface="HTML (UI)" User=* | table _time Action User request_remote_address Duration | join User [search search index="ces-monitor" Interface="HTML (UI)" User=* | top limit=10 User showperc=f showcount=f ] ... View more

Make sure the casing of field User is the same in raw data and the lookup table. If the fields are not exact match they will not join. ... View more

Can you share sample from lookup file including the header and also from the log data couple or _raw events? ... View more

Assuming your lookup table has lookup defined as userdetails Your base search | stats count by User | lookup userdetails User | table User, "Account Type", "Employee RC", "Employee Department", "Student RC" It would be better if your lookup table had fields without spaces like Employee_RC etc ... View more

Table Cell Highlighting is built in to Splunk 6.5. Please explore that option as well. ... View more

Add the following in your search before displaying the table. | search eventcount>=1 AND InvocationType!="ACK" | Transaction command adds eventcount and duration fields to a search. Eventcount gives a list of events that are grouped together based on the transaction id i.e. CorrelationID in your case. Similarly duration is the difference of first and last event matched by transaction in seconds. If you are getting it as 0, it implies you have only single event in the transaction. In order to test transaction you can add CorrelationID=<Your Sample Correlation ID with multiple events> to your base search. Transaction is an expensive command if run for long duration of time and might drop data. You should consider using startswith, endswith, keepevicted, keeporphaned, maxpause and maxspan parameters based on your use case. Infact, you should also explore stats instead of transaction which will return results faster. Refer to the following documentation on Splunk event correlation commands to be used based on various use cases: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation ... View more

Take out <selectFirstChoice>true</selectFirstChoice> ... View more

I know of sparklines and icons within table but not pie chart. With Splunk 6.5 you can conditionally format including color column based on range value. (For example 10.2% above can be green and 97% will be red if it represents available space). With previous versions of Splunk you could use Inline icon like you have shown and inline icon with value 10% next to it (Refer to Splunk 6.x Dashboard examples). Also explore custom visualization Horizon Chart which can show overlaid stats from various server over time. If none of the above suits your needs, can you provide a mock up of what you want? Or if possible some screenshot from another app/visualization on net which does this? ... View more

Can you validate the fields in search are correct? I tested with following data (14041 has only request and no ack and response). The query worked for me. Please play around with final search conditions requestCount and requestTypes (If you are getting count, then requestCount=1 alone without requestType condition, on high level should give you only requests). 2016-10-29 13:24:43.310 student_id=13030 request_type=ack 2016-10-29 13:25:43.310 student_id=13030 request_type=response 2016-10-29 13:26:43.310 student_id=13030 request_type=request 2016-10-29 13:27:43.310 student_id=14040 request_type=request 2016-10-29 13:28:43.310 student_id=14040 request_type=response 2016-10-29 13:29:43.310 student_id=14040 request_type=ack 2016-10-29 13:27:43.310 student_id=14041 request_type=request index=main sourcetype="splunk_answers_475441" | stats count as RequestCount values(request_type) as RequestTypes by student_id | search RequestCount>=1 AND NOT (RequestTypes="response" OR RequestTypes="ack") ... View more