Like gokadroid has mentioned transaction will be an expensive command to run for the following use case where the events may be from longer duration (several days). Transaction will run slow and might even drop orphaned records. Refer to following documentation on when to choose which event correlation techniques. Transaction would have been suitable only if you were looking for specific ORDERID across various sourcetype and events. http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation Kindly try the following stats command instead which should hopefully be faster. index=<YOUR INDEX NAME HERE> (sourcetype="pending" OR sourcetype="answered") orderid=* | stats values(sourcetype) as Events count as EventCount min(_time) as DateTimePublished max(_time) as DateTimeAnswered by orderid | eval closureDurationInDays= round((DateTimeAnswered-DateTimePublished)/(60*60*24),2) | eval DateTimePublished=strftime(DateTimePublished,"%Y/%m/%d %H:%M:%S") | eval DateTimeAnswered=strftime(DateTimeAnswered,"%Y/%m/%d %H:%M:%S") | search EventCount>=2 AND Events="pending" AND Events="answered" | table orderid, Events, EventCount, DateTimePublished, DateTimeAnswered, closureDurationInDays Some of the query optimization facts: 1) Define sourcetypes and index in first filter. 2) Add orderid="*" in the first filter to remove any unwanted events upfront. 3) Since you do not have separate status field perform values(sourcetype) stats aggregation to get distinct values of sourcetypes as Events. 4) Use search EventCount>=2 instead of where clause. Also search for both Event="published" and Event="answered". This is just for special scenario like what if there were two queries published for same order id and no answers etc. (Might not be in present in your use case or might be even more complicated). 5) You can play around with Event and EventCount fields to capture other scenarios like Ticket pending but not answered etc. Compare DateTimePublished with now() to get whether they have remained opened for longer than expected SLA. Let me know if you need any other info regarding the same. ... View more

Trendline in Single Value visualization displays last data compared to its previous value and the Trend is the difference of both. In your case -10,300 indicates that latest Data 9288 is 10,300 less than previous data i.e. 19,588. In other words chart Option 1 If you want both trendline and Total Count easiest way would be just to assign Total Count to a token and print that as html panel before or after the Single Value visualization in the same panel. Please let me know if you need further details on html panel. Option 2 If you append the following addcoltotals command to your existing timechart it will give you Total in the Single Value Panel. However, since trend indicator compares final two values, it will always be 0 or positive. Trend Indicator will display the difference between Total and the trend value for the last time bucket. In this example the two values will be 105860 and +96572 index=_internal | timechart span=1m last(total) AS total | addcoltotals trend labelfield=_time ... View more

Seems like anchor tag will not support default attribute. Also name attribute is invalid for anchor tag. With this you can only use < view name="abc" default="true" /> In order to pass values as querystring by default to dashboard, following are your options based on your use cases: Scenario 1 If you do not want users to see or modify values for index and query fields, you need to set them as token within a dummy search. Add the following code in Simple XML using Source editor. <!-- Dummy Search running without a query. Just to set default tokens --> <search> <query></query> <preview> <set token="q">search</set> <set token="index">abc</set> </preview> </search> Then use $q$ and $index$ later on in your query, which I think is already present in your existing Dashboard code. Scenario 2 Only for Splunk 6.5 Splunk 6.5 has introduced <init> section in Simple XML Views which allows users to set default values on page load through token. Refer to Splunk 6.x Dashboard Examples for Set tokens on page load example. <init> <set token="index">abc</token> <set token="q">search</token> </init> Scenario 3 If you want any of the values like index to be changed later on after first time load, you can add two new fields Dropdown (Dynamic with values defined by you) or Textbox (Dynamic with values set by user). Let me take dropdown example. Add new Dropdown and choose Label as "Select Index". Under Token Option add Token as index. Check Search on Change. (This will be required for dashboard refresh with selected value even for first time load). Under Static Options choose Name as abc and Value as abc. Next, select Default as abc Similarly, Add new Dropdown for "Select Query" Add Token as q Check Search on Change. Provide Static Name and Value as search Finally, select Default as search. In your existing dashabord you can continue to use $index$ and $q$ as the tokens which will be loaded with default values once the dashboard is loaded. Disadvantage of 2nd approach is that two token fields will be visible to users. Advantage could be that you can use Dynamic Options to provide list of indexes in case you need them. Please try out and let me know if this helps, or if you need further assistance. NOTE: In either of the above two approaches you will have to use view tag to set default dashboard in your navigation menu XML i.e. < view name="abc" default="true" /> ... View more

Looked at your query and seems like extracted field is dest, which you rename later as Target_Device. So, Try the following (search filter on required fields should be applied as early as possible): index=sep sourcetype="symantec:ep:risk:file" dest="RIY*"| stats values(signature) as multiple by dest | eventstats dc(multiple) as multiple_malware by dest | rename dest as "Target_Device", multiple as "Malware", multiple_malware as "Malware_Count" ... View more

As a optimized search you should include filter upfront rather than later. Following should work with better performance: index = "SAMPLE INDEX" "NEW STATE"="STATE ONE"| stats count If you intend to use your own query replace double quotes with single quotes for the 'New State' field. As within eval expression it does not match the field but value on both left and right hand side. index = "SAMPLE INDEX" | stats count(eval('NEW STATE' = "STATE ONE")) as "COUNT" ... View more