which query did you tried? what is your sample output till now and what output you are expecting? ... View more

to show in tabular format use table command and then specify your field names- ...|table fieldname OR ...|table * ... View more

try below- ...|sort 0 - count ... View more

can you try- index=ise ("authentication failed" "Administrator-Login") OR ("authentication failed" "UserName") ... View more

@hjainreddy , Below Answer from @soutamo explains better https://answers.splunk.com/answers/804678/search-performance-benefit-from-field-inclusion-ve.html Let us know if you still have any query. ... View more

@spisiakmi I am converting my comment into answer. Please accept and upvote if it helps. ... View more

to apply your requirement without editing xml- Go to edit>>clicked on three dots for particular panel where you want to apply drilldown then use like below- ... View more

you will require to search host=$click.name2$ I have created sample dashboard and here on click it will open clicked sourcetype Use below for reference- <dashboard> <label>826404_line chart</label> <row> <panel> <chart> <title>$abc$</title> <search> <query>index=_internal | timechart count by sourcetype</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> <drilldown> <link target="_blank">search?q=index=_internal%20%7C%20timechart%20count%20by%20sourcetype%7Csearch%20sourcetype=%22$click.name2$%22&amp;earliest=-15m&amp;latest=now</link> </drilldown> </chart> </panel> </row> </dashboard> ... View more

you can use something like beow to show trend in single value- ...|timechart span=1mon count refer-https://answers.splunk.com/answers/554750/splunk-trend-indicator-single-value-assistance-wou.html ... View more

How did you identify that failure is occurred? ... View more

I updated answer please try again ... View more

@ajiwanand Can you try including both transforms stanza in one- props.conf [default] TRANSFORMS-setrouting = tsthost-routing, abchost-routing ... View more

try @pc1234, Updated: ...|rex "\[(?<field1>\w{3})\/.*\/(?<field2>\d)\]" ... View more

To add additional information from index B there should be one common key field to join both index . Is there any field which is common in both index? ... View more

at the end of query use event handler like $click.value$ which will help to display clicked event. refer splunk docs-https://docs.splunk.com/Documentation/Splunk/8.0.4/Viz/EventHandlerReference#chart_(event_tokens) ... View more

try below- here replace query with your query- <option name="charting.drilldown">all</option> <drilldown> <link target="_blank">search?q=index=_internal%20%7C%20stats%20count%20by%20sourcetype&amp;earliest=-15m&amp;latest=now</link> </drilldown> Below is sample dashboard on sampe data- <dashboard> <label>826404_line chart</label> <row> <panel> <chart> <search> <query>index=_internal | stats count by sourcetype</query> <earliest>-15m</earliest> <latest>now</latest> </search> <!--drilldown> <link target="_blank">/app/search/592973_multiselect_remove_all</link> </drilldown--> <option name="charting.chart">line</option> <option name="charting.drilldown">all</option> <drilldown> <link target="_blank">search?q=index=_internal%20%7C%20stats%20count%20by%20sourcetype&amp;earliest=-15m&amp;latest=now</link> </drilldown> </chart> </panel> </row> </dashboard> ... View more

Please look at below answer from @niketnilay https://answers.splunk.com/answers/664384/show-the-a-particular-percentage-using-single-valu.html ... View more

Use below drilldown- <option name="charting.drilldown">all</option> <drilldown> <link target="_blank">/app/myapp/mwdashboard</link> </drilldown> ... View more

It is working for me - |makeresults|eval Name="A", spent="20", income=30 |append[|makeresults|eval Name="B", spent=20, income=40] |append[|makeresults|eval Name="A", spent=40, income=80] |stats sum(spent) as spent sum(income) as income by Name please share your sample code. ... View more

@shivareddysompalle, try below- ...|stats sum(spent) as spent sum(income) as income by Name ... View more

Use lookup command like- ...|lookup <yourlookup name> <fields using you are joining> <output field names> ref-https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Lookup ... View more

did you tried below query with sample data- |makeresults|eval ComputerName ="abc", Events ="200" |append[|makeresults|eval ComputerName ="bcd", Events ="100"] |append[|makeresults|eval ComputerName ="fcd", Events ="200"] |append[|makeresults|eval ComputerName ="def", Events ="300"]|sort - Events | streamstats current=f window=1 values(Events) as prev | eval Rank=if(prev=Events,0,1) | accum Rank Here Events has 200 value twice and Rank assigned for these two events is 2 for both. If still it is not working then please share your query. ... View more

the query which I shared is applicable when events are same then rank will also be same. Please try above and confirm. ... View more