I have an index that has those values already, so it would be index=my_index | table Field_1 Field_2 Contact There are filters in place that will make sure that Contact will be the same for every event. There will be between 2 and 25/30 results. I want to be able to send an e-mail to Contact , but configure the body so that the Contact field doesn't appear. ... View more

Thanks for the reply. This suggestion does the opposite of what I'm looking for: it sends an e-mail to the address and the e-mail content is just the contact column. I'd like to send an e-mail to the address, but have the inline table contain everything but the contact field. ... View more

I need to be able to parse the timezone specified in the field so that I can convert the timestamp to UTC. Using %Z doesn't seem to work. Would it be able to parse Europe/San_Marino ? The documentation here states that %Z is "The timezone abbreviation. For example EST for US Eastern Standard Time". Maybe it's expecting CET or CEST rather than Europe/San_Marino . If I parse CET , do you think it would recognize in July that it should be CEST ? Regards, Andrew ... View more

I've tried running this search, but it doesn't work: in particular it doesn't parse the %Z . If I remove it then timestamp and mytime2 are returned, but those will be with my system timezone rather than Europe/San_Marino . Regards, Andrew ... View more

This has just worked for me, thanks! ... View more

Thanks for the input. The REGEX works but doesn't solve the problem. I've found what I was looking for here: https://answers.splunk.com/answers/209824/how-to-get-splunk-to-ignore-the-second-line-of-a-l.html Suggestion was to use a null-queue transform by modifying props.conf and transforms.conf ... View more

Thanks for the reply. I've updated the tables as you've mentioned and have the following: table_row_highlighting.js mvc.Components.get('highlight01').getVisualization(function(tableView) { tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row tableView.$el.find('td.range-cell').each(function() { $(this).parents('tr').addClass(this.className); }); }); // Add custom cell renderer, the table will re-render automatically. tableView.addCellRenderer(new CustomRangeRenderer()); }); mvc.Components.get('highlight02').getVisualization(function(tableView) { tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row tableView.$el.find('td.range-cell').each(function() { $(this).parents('tr').addClass(this.className); }); }); // Add custom cell renderer, the table will re-render automatically. tableView.addCellRenderer(new CustomRangeRenderer()); }); table_decorations.css [id^="highlight"] tr td { background-color: #c1ffc3 !important; } [id^="highlight"] tr.match td { background-color: #93ca3b !important; } [id^="highlight"] tr.no-match td { background-color: #ff0030 !important; } [id^="highlight"] .table td { border-top: 1px solid #fff; } [id^="highlight"] td.range-severe, td.range-elevated { font-weight: bold; } This doesn't seem to work. I understand what you're getting at, though. The generic case will catch anything that starts with the word highlight . Shouldn't I have an * character somewhere? ... View more

Thanks for your input. Just like to add: if I run the command as index="my_index" | transaction FIELD then it creates the transactions and puts them in chronological order. I figured that using startswith and endswith would do the same thing, but exclude all evens in between. Is this the wrong understanding of the command? ... View more

Thanks for the response. This does work, and is a good solution. Maybe I'm not understanding the transaction function properly, but I thought that it would filter out the events automatically using the startswith and endswith definition options. EDIT: Now that I've run the solution I get the following: FIELD,eventcount FIELD1,2 FIELD1,2 FIELD2,2 FIELD2,2 So it still produces a double transaction for each FIELD value... ... View more

I tried to control click on the column values but it doesn't work! I really though this was the solution! To convey what I'm trying to do, I've created a dashboard that you can replicate: <form> <label>Drilldown Example</label> <fieldset submitButton="false"> <input type="multiselect" token="category_tok"> <label>Category</label> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> <delimiter> OR </delimiter> <fieldForLabel>Category</fieldForLabel> <fieldForValue>Category</fieldForValue> <search> <query>| makeresults count=100000 | eval CategoryNumbers = round(((random() % 50)/(random() % 25)*100),0) | sort CategoryNumbers | eval Category = "Category " . CategoryNumbers | dedup Category | table Category</query> </search> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>Category="</valuePrefix> <valueSuffix>"</valueSuffix> </input> </fieldset> <row> <panel> <title>Random Pareto</title> <chart> <search> <query>| makeresults count=1000 | eval Category = "Category " . round(((random() % 50)/(random() % 25)*100),0) | stats count by Category | sort -count | streamstats sum(count) as RunningTotal | eventstats sum(count) as Total | eval CumulativePercent = round((RunningTotal/Total)*100,2) | fields - Total, RunningTotal</query> <sampleRatio>1</sampleRatio> </search> <drilldown> <set token="form.category_tok">$click.value$</set> </drilldown> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">1</option> <option name="charting.axisY2.maximumNumber">100</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.overlayFields">CumulativePercent</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">minimal</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> <panel> <title>Random Metric Chart</title> <table> <search> <query>| makeresults count=10000 | eval Category = "Category " . round(((random() % 50)/(random() % 25)*100),0) | search $category_tok$ | eval SubCategory = "SubCategory " . round(((random() % 10)/(random() % 25)*100),0) | eval Metric = round((random() % 100)/(random() % 50)) | chart sum(Metric) as MetricSum over SubCategory by Category</query> <earliest>0</earliest> <sampleRatio>1</sampleRatio> </search> <option name="count">5</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> The Category input at the top is a multiselect and can be interacted with. The Random Pareto chart displays Category on it's X axis. The Random Metric Chart chart is dependent on the Category input. To update the Random Metric Chart I can either set the values in the input, or I can click on a column in the Random Pareto chart. My goal is to be able to click on multiple columns in the Random Pareto chart so that they are added as separate values in the Category input. Right now clicking a column will overwrite the entire input. Any ideas? Thanks! Andrew ... View more

Thanks for the links! I did some reading, but I'm still not sure how to construct a drill down so that it passes multiple values to an input. By clicking one column I only get one value assigned to $click.value$ meaning that I have to click on another column which will overwrite the first $click.value$. I'm trying to get it so that I can maintain the initial value, so something like: <drilldown> <set token="token_tok">$token_tok$,$click.value$</set> </drilldown> I was hoping that I could pass those values to a multiselect input, but It just seems to just construct a string. Do you know whether this sort of approach is feasible? Thanks! Andrew ... View more

Hello, and thank you for taking the time. i see what you've done, but what I'm trying to do is slightly different. Adding on to your example, what I'd like to do is have a multiselect input that when passed values (in this case "Test,Test3"), automatically parses them into the their individual values. The result would be: The values Test and Test3 would be columns selected from a column chart. Is this possible? Regards, Andrew ... View more

Perfect, thank you! ... View more

Just to make sure that I'm following the right procedure I'm going to list out the steps I've followed: Edit props.conf located in SPLUNKHOME\etc\apps\MY_APP\local to contain [MY_SOURCETYPE] FIELD_DELIMITER = , HEADER_FIELD_LINE_NUMBER = 1 INDEXED_EXTRACTIONS = csv PREAMBLE_REGEX = (^|[\r\n])(Job.Description[^\r\n]+|String[^\r\n]+) TIMESTAMP_FIELDS = RunStart category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" Restart splunkd via cmd: net stop splunkd/net start splunkd Once up, log into Splunk (6.5.2 btw) and enter my app From the Settings menu, select Add Data Select upload Select the csv that contains the data above Select Next From the Source type list, select MY_SOURCETYPE At this point, the first two lines of the event list are as follows If the regex works as planned, would I see those two lines at that point? Best regards, Andrew ... View more

Thanks for the suggestion, but unfortunately it doesn't work. I think I see what you're getting at, though: you're trying to create one expression that covers both lines, right? I'm not too proficient with regexs. I'll keep playing with it, thanks! Andrew ... View more