IIRC you only have access to the first row of the results so in order to send all the data you would have to contrive to have all the data in a single event. ... View more

It is not usually good to start a search with a wildcard, so assuming aggr_id always starts with Idt:, you could do something like this  | makeresults | eval aggr_id="ldt:1234567890:09821" | search [| makeresults | eval session_ID= 1234567890 | eval aggr_id="ldt:".session_ID."*" | table aggr_id | dedup aggr_id] The makeresults just set up dummy data and should be replaced by your index search <index search> [search index | eval aggr_id="ldt:".session_ID."*" | table aggr_id | dedup aggr_id]   ... View more

Corrected ... View more

In your sample logs, it looks like you have a space after the first pipe which does not appear to be accounted for in your LINE_BREAKER pattern. Try something like this LINE_BREAKER=([\r\n]+)\d{4}\-\d{2}\-\d{2}\s\|\s\d{2}:\d{2}:\d{2}.\d{3}\s\| ... View more

The metadata command doesn't take filters other than index so filter after the data is returned   | metadata type=sources where index=gwcc | search source !="*log.2024-*" | eval source2=lower(mvindex(split(source,".2024"),-1)) | eval file=lower(mvindex(split(source,"/"),-1)) | table source, source2, file   ... View more

You could set up some scheduled reports to run on partial sets of addresses, then load the results from the searches in your dashboard. This assumes you can work with out of date data e.g. your report is based on yesterday's data and you don't need the very latest data. Alternatively, as you said, you could "chain" your searches based on when a search completes, set a token which the next search is waiting for, and so on. (This is easier to do in SimpleXML, but still possible in Studio.) ... View more

Please provide a more complete representation of your data and your expected output - we can only work with what you show us. ... View more

| stats values(Sockets) as Sockets by IP Hostname ID | eval Sockets=mvjoin(Sockets, ",") ... View more

Please provide some anonymised sample events for both searches and what your expected output would look like ... View more

Please give an example of your expected output for when the fields are the same and for when they are not the same. ... View more

Try something along these lines | makeresults | eval origData="<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>58f7c3e96a0c279b-7e3f5f28b0000040</block><alarm>5cf7c3e97b0c6fdb-7e3f5f28b0000040</alarm><learn>5cf2c1e9730c2f5b-3d3c000830000000</learn><staging>0-0</staging></violation_masks><response_violations><violation><viol_index>56</viol_index><viol_name>VIOL_HTTP_RESPONSE_STATUS</viol_name><response_code>500</response_code></violation></response_violations></BAD_MSG>" | rex mode=sed field=origData "s/<(?<!)/ </g s/>(?=<)/> /g" | rex max_match=0 field=origData "(?m)(?<line>^.+$)" | fields - origData | streamstats count as row | mvexpand line | eval open=if(match(line,"^\<(?!.*\/)"),1,null()) | eval undent=if(match(line,"^<\/"),-1,null()) | streamstats window=1 current=f values(open) as indent by row global=f | streamstats sum(indent) as space by row global=f | streamstats sum(undent) as unspace by row global=f | fillnull value=0 unspace space | eval spaces=space+unspace+len(line) | eval line=printf("%".spaces."s",line) | stats list(line) as line by row | eval line=mvjoin(line," ") | fields - row You could add some additional tweaking to deal with the initial xml line if you are certain it is always there ... View more

| spath "properties.appliedConditionalAccessPolicies{}" output=appliedConditionalAccessPolicies | mvexpand appliedConditionalAccessPolicies | where json_extract_exact(appliedConditionalAccessPolicies,"result") != "notApplied" ... View more

In your interactions, you can use predefined tokens to set your own token, which can then be used in another panel - name will give you the name of the field (column) which was clicked   ... View more

This can be done with CSS which you can define in your SimpleXML in a html panel. Essentially, what you need to do is to turn columns into a multi-value fields with an indicator for the format option to pick up and change the background colour. For the indicator in your case, you could check whether the previous date is different i.e. it is the first in a series of copied dates. You can use streamstats to do this, something like this | streamstats values(catchup_updated_time) as previous_catchup_updated_time window=1 current=f | eval catchup_updated_time=if(isnull(previous_catchup_updated_time) OR catchup_updated_time != previous_catchup_updated_time, mvappend(catchup_updated_time,"RED"), catchup_updated_time) You then use CSS to hide (display: none) the second value in the multi-value field. See this answer (and similar) for clues  https://community.splunk.com/t5/Splunk-Search/How-to-color-the-columns-based-on-previous-column-valu...   ... View more

That a whole different ball game! Are you using Studio or Classic Simple XML dashboards? ... View more

It looks like you may be using a default extract which takes name=value and the value is being terminated at the next space. You will probably have to do some field specific extractions to override these defaults. ... View more

Line 3 creates a string in t2 so line 4 should be parsing the string strptime not strftime ... View more

Do you mean something like this? index=poc container_name=app ExecutionTimeAspect Elastic Vertical Search Query Service [ search index=poc container_name=app horizontalId=orange | stats count by trace_id | table trace_id] | rex field=_raw "execution time is[ ]+(?<latency>\d+)[ ]+ms" | stats p90(latency) as Latency ... View more

As @bowesmana said (and does the articles he referenced, and many others on this subject), your calculation to determine the colour should be done in SPL, so try modifying your search accordingly. ... View more

What does "link" mean in this context? The second query doesn't return any trace ids. Please clarify what you are trying to do (in non=SPL terms, provide some sample events, and a representation of your expected output. ... View more

Try both | eventstats values(catchup_updated_time) as catchup_updated_time, values(sky_ui_timestamp) as sky_ui_timestamp by sky_id | sort -sky_id catchup_updated_time | filldown catchup_updated_time, sky_ui_timestamp ... View more

Please share your raw events and the configurations you have tried ... View more

Where would 10:02:43 come from as all these sky_id's are different? ... View more

So what happens if you use eventstats instead of filldown? ... View more