Hello @michaldygaz, can you please share the sourcetype? ... View more

Hello @helius, Just guessing here, but it probably comes from the fact that the timestamp recognition of the event changes if you remove the line containing created, according to your screenshots. In case your set of json events share the 'created' key, please try to set the TIME_PREFIX of the sourcetype. I hope this helps ... View more

Hello @karthi2809, I did a bit of the rex to get you started. | makeresults | eval fields="2018-07-19 02:05:13,901|3801531980313892|MA_SE|aabbcc|12121212|10|FGH|lOP|||EMAIL|KARTHI@GMAIL.COM|LEVEL2|12/22/2017|12/31/9999|FATAL|E0021|Member not found" | rex field=fields "^(?<datetime>[0-9- :,]+)\|(?<numFiled1>[0-9]+)\|(?<someTextField1>[A-Z_]+)\|(?<someTextField2>[a-z])" Please start from the field extraction above to accomodate it with your events. ... View more

@dannili Well, I do not know panda well enough to answer your comment. But basically, the results you get from splunk.Intersplunk.getOrganizedResults() is a list of OrderedDict. The peace of code provided in the answer give a way to walk through all the items being the result of the splunk query. For each item (result) in the code of the answer, I expect you need to do something in order to extract your data. ... View more

Hello @spilepich, Well, I think you get both. In _time, you get the value extracted from message.date, which enable to display it according to the user timezone, as configured in Splunk. In message.date, you get the value contained in the original json event. This is the standard behaviour in Splunk ... View more

Hello @spohara, your question looks close to this one: https://answers.splunk.com/answers/671770/getting-results-from-multiple-searches-without-app.html If you adapt the answer to your case, this will solve it. ... View more

Hello @abhayneilam, @pallavibalasa, @nick405060 you may want to download the splidget app (https://splunkbase.splunk.com/app/3649/) The splunkpad in there is a very good example of writting in a dashboard the content of the user input and store it in a lookup file. You will also need the lookup editor app if you do not already have it. (https://splunkbase.splunk.com/app/1724/) ... View more

Hello @spilepich, why bother with configuring the extraction? I did import the sample of data successfuly using the Auto Extraction. But maybe you are trying to do something I did not get. Did, you try with Auto? ... View more

Hello @ljalvrdz, did you on purpose rename to different fields into USUARIO ? I see form the last rename : vpn_user AS USUARIO ... vpn_username AS USUARIO This seems a bit strange to me. Can you please confirm? ... View more

Hello @kkrashwan, I was suceesfull in using openweathermap for this kind of purpose, through a modular input. The documentation is clear enough. Hope this helps ... View more

Hello @kairat, I am confused. In the head of the post, you stated that with that code, you could not get the event added to Splunk, and now you say it works. Anyway, the colons you removed changed the format of the date of the event, and the result format seems quite strange. Can you please share the way you extract the date/time info for the sourcetype? ... View more

Hello @TylerJVitale, it would be very helpful to provide us with the xml content of your dashboard. Can you please do this, once removed/renamed sensitive info? ... View more

Hello @tac24, the documentation states : Syntax: source= (from http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Collect). It seems that you have the same problem as this one : https://answers.splunk.com/answers/240798/how-to-return-a-single-value-from-a-subsearch-into.html So, this should do : main search... | collect index="ABC" source=[search index="XYZ" |head 1 | rex field=source "^FILENAME_(?<YYYYMMDD>\d{8})_.*" | eval val="src_".YYYYMMDD | eval fieldval="\"".val."\"" | table source YYYYMMDD fieldval | return $fieldval] ... View more

Hello @satkumvnr, according to JSONLint, the json is not valid. I understand you had to modify it in order to remove sensitive information, but the result is not valid and I can not work with it. Can you please check with jsonLint the result of the pruned json and post it back as an answer to this comment? ... View more

Hello @Mayurmpatil, index=<some_index>| stats latest(_raw) should do it ... View more

Hello @kairat , did you try to escape the colons? I mean did you try to replace " with \" ? ... View more

OK @harishalipaka,, I think I got it. So, you could do the following: <your base search of lookup>| eval _time=strptime(Date,"%d/%m/%Y")| search earliest=-7d@d latest=now() | timechart avg(sum_PBD) span=1d | append [<your base search of lookup>| eval _time=strptime(Date,"%d/%m/%Y")| search earliest=-30d@d latest=-8d@d | timechart avg(sum_PBD) span=1w] .... ... View more

Hello @jyoung1001, this should do it: In this example, the backgrond color changes depending on the content of the <option name="rangeValues"> tag These corresponding colors are configured in the <option name="rangeColors"> tag. For more info, please check : https://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/SingleValueFormatting <panel> <title></title> <single> <title></title> <search> <query>start of your search| timechart avg(somevalue) span=1m</query> <earliest>-24h@h</earliest> <latest>@m</latest> <refresh>1m</refresh> <refreshType>delay</refreshType> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="height">143</option> <option name="numberPrecision">0.0</option> <option name="rangeColors">["0x0E31EB","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[-10,60,70,80]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">inverse</option> <option name="trendDisplayMode">absolute</option> <option name="trendInterval">-1h</option> <option name="underLabel">$generalSingleValueUsage$</option> <option name="unit">%</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">0</option> ... </single> ... View more

Hi @harishalipaka, Sorry, I am not sure I understand. Why can't you replace index=_internal with |inputlookup? ... View more

Hello @harishalipaka, I think the following goes in your way. It takes advantage of the earliest , latest and span arguments. In the following, I am just counting the *ERROR*s in the _internal index. index=_internal ERROR earliest=-7d@d latest=now() | timechart count span=1d | append [search index=_internal ERROR earliest=-30d@d latest=-8d@d | timechart count span=7d] | append [search index=_internal ERROR earliest=-60d@d latest=-31d@d | timechart count span=15d] ... View more