Hi, i have done something similar before, i created a splunk table in simple xml. Then i extended the simple xml with some js. Wheever you clicked on a row of the table, a popup opened and showed more details corresponding to this table row. So here is what i used: As mentioned i created a normal simple xml splunk table and gave the table an id. In js you can get the model of the table, using the splunk js mvc object, and you are able to manipulite its drilldown behavior like this: mvc.Components.get('idOfyourTable').getVisualization(function(tableView) { tableView.on('click', function(e) { e.preventDefault(); // Prevents the default splunk drilldown behavior if(e.field=="Fieldname") { // Fieldname = Column of your table you want something to happen when clicked // ... do whatever you want // all informations of the clicked row are stored in e (which is your clickevent) } In the "do what you want" section of the code i used a modal to generate a popup. For more infos to modals, see here: Splunk Modals Hope this helps. You will also need the tutorials from dev.splunk.com to understand how to get results of a search from js and things like this. Greetings Tom ... View more

Hi, you can use a subsearch: [| inputlookup myindexes.csv | table index] | rest of your search In this example, imagine there is a csv file with a column "index" and in this column you list all your indexes. The subsearch is resolved like this index=index1 OR index2 ... Splunk interprets your search like this: index=index1 OR index=index2 ... | rest of your search Greetings Tom ... View more

Hi, you can use the dedup command: ... | dedup src_ip dest_ip action or you can use stats: ... | stats count by src_ip dest_ip action | fields -count If possible, you should use stats, it should be faster than dedup. But without further ado, after a stats you only have the fields left, that you used in your by clause. Greetings Tom ... View more

Hi, you sorted by some fields in the first query and then you used dedup. If dedup finds multiple events with the same value, it simply takes the first event and dismisses the rest of the events. So your sort influences the results. In the second search you do the same, since you do first(inOrOut) in the stats. Because you did not sort like in the first query, the first might now be something else than in the first query. So try to do the | sort 0 detail.input-utr,-_time also in the second query and compare the results again. Greetings Tom ... View more

Hi, i think you want something like this: | stats count by host "Act type" STATUS | eval new_field = 'Act type'." ".'STATUS' | chart max(count) by host new_field | fillnull | addtotals | eval perc_failed = 'Activate Failed' / Total * 100 Here is a run every example, just copy and past it in your search bar: | stats count | eval host="A" | eval "Act type"="Activate" | eval STATUS="Failed" | append[| stats count | eval host="B" | eval "Act type"="Publish" | eval STATUS="Success"] | append[| stats count | eval host="A" | eval "Act type"="Activate" | eval STATUS="Failed"] | append[| stats count | eval host="C" | eval "Act type"="Activate" | eval STATUS="Failed"] | append[| stats count | eval host="B" | eval "Act type"="Activate" | eval STATUS="Success"] | append[| stats count | eval host="A" | eval "Act type"="Activate" | eval STATUS="Success"] | append[| stats count | eval host="C" | eval "Act type"="Launch" | eval STATUS="Success"] | append[| stats count | eval host="B" | eval "Act type"="Activate" | eval STATUS="Success"] | table host "Act type" STATUS | stats count by host "Act type" STATUS | eval new_field = 'Act type'." ".'STATUS' | chart max(count) by host new_field | fillnull | addtotals | eval perc_failed = 'Activate Failed' / Total * 100 ... View more