I could get the desired output, i have set the drilldown panle token to both the value of radio button, which magicaly worked. ... View more

Thanks for the response.. Here the the ID is dynamic , i may have 100 of ID"s and each id is associated with some values and each value has a status called value status. If my value status is failed i need to make my overall status f field for all the values present is that I'd... I was thnking of some thing below |eval Ov_status= if(value_status=="failed" OR value_status=="Inprogress" or value_status=="completed", "failed",Ov_status).. But above condition  is making all my Ov_status to failed irrespective of checking ID I want to filter by ID ... View more

This is exactly what i was looking for..... Thank you very much .. @niketn  ... View more

Splunk v7.2 Strange thing is till yest it was wroking fine , and i did not do any change, by dont know why this stopped working.   Bascially  I have passed my dropdown token here i.e tok_time and from the table when i am sedning the date to the dropdown its vaue gets updated with the clicked field cell.. but i am not able to get the value in dropdown when using round <eval token="form.tok_time">round($click.value$,0)</eval>   ... View more

Here it is <label>West</label> <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice> <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice> <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice> <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice> This is just the multi select tab i am showing here, rest token is passed in my query.. query is working fine, only enhancement i want is for when ALL is selected , instead of showing the values in chart it should show "WEST", Only for ALL it should show value as "WEST" | timechart span=15m avg(a1) as "session_current" by host ... View more

this is my multiselect <label>East Node</label> <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice> <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice> <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice> <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice> </input> when ALL is selected , instead of showing the values in chart it should show "WEST", Only for ALL it should show value as "WEST" | timechart span=15m avg(a1) as "session_current" by host ... View more

Hi @niketnilay , to this is it possible in chart, when "ALL" is selected and ALL has static values (A,B,C,D), and time chart is filtered by values, it should not show A,B,C,D in legends, rather should show only "Alphabet" in chart. | timechart span=15m avg(x) as "session_current" by values ... View more

Here s some confusion, let me explain more on my issue Multiselect <label>West Node</label> <choice value="ABBRLW-SPGW-05">ALL</choice> </input> Query: index=cisco_asr5k_bulkstats sourcetype="cisco:asr5k:spgw:apn:apnSch2" apn ="ctracker.telus.iot" schema_type=apn host IN ($tok_west_sess$) sess_curr=* | timechart span=$timeresolution$ avg(a1) as "session_current" by host So when All is selected from multiselect , chart i dont want to show the host name "ABBRLW-SPGW-05" but a dummay value "West" to be displayed ... View more

@manjunathmeti ... thanks, this is what i wanted..... ... View more

hey @niketnilay ... its you again, i could just got the solution from one of your post earlier and was about to add that in the comment but thanks i wanted all the three attributes to show..... This worked for me <set token="tokEventCount">$job.eventCount$</set> <set token="tokscanCount">$job.scanCount$</set> <set token="tokrunDuration">$job.runDuration$</set> ... View more

how to do the same in the fieldset ? ... View more

i also have the same issue, with mulitselect how to show all the fields label seelcted ... View more

Sorry but the one you suggested changes our requirement. We are trying to use automatic lookups , so that we can enhance data faster ... View more

Just to update more specific issue, my report is actually having issue .. To summaries: my saved search is returning result in VERBOSE mode and my same is expected when i schedule it to report . BUt issue is my report is returning the result in FAST mode and as a result of which there is data discrepancies. After having little google and going through docs, it says my query is having "STATS Command " and this is setting my report to run by default in FAST mode.... Can any one suggest any solution (index=ndspr sourcetype=ISUP_EVENT_ACCESS_VW earliest=-4h@h latest=@h) OR (index=csvlookups source="24*SWITCH"earliest=-30d@d latest=@d) | eval N=coalesce(N,DPC) , O=coalesce(O,OPC) , K=coalesce(K,CIC) | search N=* AND O=* AND K=* | eventstats values(OPC) as OPC values(DPC) as DPC values(CLLI) as CLLI values(ADMININF) as ADMININF values(ADNUM) as ADNUM values(TRKGRSIZ) as TRKGRSIZ values(NETNAME) as NETNAME values(SWITCH) as SWITCH values(MEMNAME) as MEMNAME values(ROUTESET) as ROUTESET values(CIC) as CIC by N O K | eval Call="Inbound" | fields A B C D E F G H I J L M P Q R S T U V W X Y Z A1 A2 A3 A4 A5 N OPC O DPC K CIC CLLI ADMININF ADNUM TRKGRSIZ NETNAME SWITCH MEMNAME ROUTESET Call | table _time A B C D E F G H I J L M P Q R S T U V W X Y Z A1 A2 A3 A4 A5 N OPC O DPC K CIC CLLI ADMININF ADNUM TRKGRSIZ NETNAME SWITCH MEMNAME ROUTESET Call | search OPC=* AND DPC=* AND A=* ... View more

no this is same ... adding table wont have any impact.. My saved search is running in verbose mode and i have scheduled it .. After the scheduled time the report is triggered but its in Fast mode by default as a result it shows less results. So the issue is with the instance of report triggerd. ... View more