About ITWhisperer

ITWhisperer · ‎04-01-2026

As I said, I don't think this is possible using tokens in this way because the label is set before the searches run. You might be able to do it with some javascript though.

ITWhisperer · ‎03-31-2026

I am not sure you will find such a thing. There are APIs to retrieve dashboard views and there are APIs to retrieve scheduled searches, etc. But, I am guessing this is not what you are after? What are you trying to do? Perhaps there may be another way to approach it?

ITWhisperer · ‎03-30-2026

You could try using a "base" search i.e. a search not associated with a panel, and use the done handler for that search to set some tokens which you use in a dashboard panel title (unfortunately, it is not possible to change the dashboard title itself this way since it is set before searches are executed). You could also have an HTML panel displaying this information at the top of your dashboard <dashboard version="1.1" theme="light"> <search id="timerange"> <query> | makeresults | eval start=strftime(relative_time(now(),"-7d@h"),"%F %T") | eval end=strftime(now(),"%F %T") </query> <done> <set token="start">$result.start$</set> <set token="end">$result.end$</set> </done> </search> <row> <panel> <html> <h1>Last seven days $start$ to $end$</h1> </html> </panel> </row> <row> <panel> <table> <search> <query>| makeresults | eval start=strftime(relative_time(now(),"-7d@h"),"%F %T") | eval end=strftime(now(),"%F %T") </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </dashboard>

ITWhisperer · ‎03-23-2026

This is a very similar issue - instead of matching with "JOB ", you need to match with "APPL = " #props.conf [yourSourcetype] EVAL-core_key = case(hostname == "aa01" AND match(description, "APPL\\s+=\\s+"), replace(description, "(?s)^.*?APPL\\s+=\\s+(.{3}).*$", "\\1"), hostname == "bb01" AND match(description, "APPL\\s+=\\s+"), replace(description, "(?s)^.*?APPL\\s+=\\s+..(.{3}).*$", "\\1"))

ITWhisperer · ‎03-21-2026

Assuming this has been already parsed as JSON, and that for "aa01" you want the next 3 characters after "JOB ", and for "bb01" you want to skip an extra 2 characters before taking the next 3, you could try this: | rex field=description "aa01.+?JOB (?<core_key>...)" | rex field=description "bb01.+?JOB ..(?<core_key>...)"

ITWhisperer · ‎03-11-2026

Try | where AgentName=agentroot If this doesn't work, please be more expansive about what works and what doesn't work Also, why not use abcd as the value for the dropdown and the full string as the label?

ITWhisperer · ‎03-11-2026

Since this is JSON, and assuming it is treated as such, you could use split and mvindex to get the last part | eval splunk_entity=mvindex(split(resource_id,"/"),-1)

ITWhisperer · ‎03-11-2026

Always best to provide full information! Try this: \"resource_id\":\s+\"[^\"]*\/(?<splunk_entity>[^\"]+)

ITWhisperer · ‎03-06-2026

Given your example, only 5 and 6 stand a chance of working, and 6 only works if the double-quotes are corrected to ASCII double-quotes not the extended character set versions. | makeresults | eval _raw="\"message\":\"Transfer end logged\"" |rex field=_raw "\"message\":\"(?<msg>.*?)\"" | rex "message\":\"(?<message>[^\"]+)" In future, it would be more useful to use code blocks (as I have done here) so that formatting is preserved. As you have said, this is JSON and you might be better off pursuing this angle. If you could explain what it about what you have done with JSON and the results you got, we might be able to help you retrieve the data you want using the built-in JSON functionality.

ITWhisperer · ‎02-24-2026

The second log looks like JSON - why not process it as such? Assuming you still want to use rex (not necessarily the best way to do this), you could try this | makeresults | fields - _time | eval _raw="TransferStatus.Id: \"63636_#^#^#_#737373646_÷\", user=FileactiveHeartBeat, \"transferId\":\"37373773-yeye-eueueh-9172\", \"userName\":\"dudhkd\"," | rex "TransferStatus.Id: \\\"(?<transfer_id>.+?)\\\"" | rex "user=(?<customer>.+?)," | rex "\"transferId\":\"(?<transfer_id_2>.+?)\"" | rex "\"userName\":\"(?<customer_2>.*?)\""

ITWhisperer · ‎02-18-2026

Assuming you want the exact value of cpe, try this | eval _selCPE = trim(replace("cpe:/a:7-zip:7-zip,.net_core,anaconda3", "\"", "")) | eval _selCPE_mv = if(len(_selCPE)=0, null(), split(_selCPE, ",")) | where isnull(_selCPE_mv) OR isnotnull(mvfind(_selCPE_mv, "^".cpe."$"))

ITWhisperer · ‎02-17-2026

Try something like this | stats latest(FirstTime) AS FirstTime latest(dest_hostname) as dest_hostname latest(dest_ip) as dest_ip by dest_mac

ITWhisperer · ‎02-17-2026

Try something like this index=dhcp dhcp_type IN (DHCPACK DHCPOFFER) NOT (dest_hostname IN (PC* LP* GIS* MU* iPhone* iPad*)) | stats earliest(_time) AS FirstTime by dest_mac dest_hostname dest_ip | where FirstTime > relative_time(now(), "-30d@d") | stats earliest(_time) AS FirstTime earliest(dest_hostname) as dest_hostname earliest(dest_ip) as dest_ip by dest_mac | convert ctime(FirstTime) | `LOOKUP_OUI(dest_mac)`

ITWhisperer · ‎02-16-2026

Try creating your own app and save your dashboard there

ITWhisperer · ‎02-16-2026

Who owns the dashboard? Which user are you logged in as?

ITWhisperer · ‎02-16-2026

You should look at the permissions for your specific dashboard

ITWhisperer · ‎02-07-2026

Where are these dependencies defined? Assuming that they are in some sort of lookup, you can use the change handler of the first dropdown to set a token which is used in the search to setup the second dropdown. You can then use the change handler of the second dropdown to select the appropriate index.

ITWhisperer · ‎01-27-2026

To be honest, I found this difficult to understand what it is you are working with (e.g. what do sample events from your data sources look like?), what it is you are trying to achieve (e.g. percentage of events not in "maintenance" periods?), or just advice on whether your environment is big enough to handle the type of search you want to do (e.g. use map). Please provide some clarification, and some anonymised sample events.

ITWhisperer · ‎01-23-2026

ITWhisperer · ‎01-20-2026

It very much depends on how you want your dashboards to look and behave, but essentially using the html/style blocks can give you access to css to modify your dashboards. These can also be added to a css file which is declared at the top of your dashboard, but this file needs to be uploaded and it is often easier to do it inline in your SimpleXML source.

ITWhisperer · ‎01-14-2026

Try something like this <dashboard version="1.1" theme="light"> <label>Font colours</label> <row> <panel depends="$alwayshidden$"> <html> <style> #fontcolours div.multivalue-subcell[data-mv-index="0"] { color: limegreen !important; } #fontcolours div.multivalue-subcell[data-mv-index="1"] { color: orange !important; } #fontcolours div.multivalue-subcell[data-mv-index="2"] { color: red !important; } #fontcolours div.multivalue-subcell[data-mv-index="3"] { color: grey !important; } </style> </html> </panel> <panel> <table id="fontcolours"> <search> <query>| makeresults count=10 | fields - _time | eval A=100-(random()%201/100) | eval B=100-(random()%201/100) | eval C=100-(random()%201/100) | foreach A B C [| eval <<FIELD>>=case(<<FIELD>><=98.2,mvappend("","","","-"),<<FIELD>>>=99.90,mvappend(<<FIELD>>,"","",""),<<FIELD>>>=99,mvappend("",<<FIELD>>,"",""),true(),mvappend("","",<<FIELD>>,""))]</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </dashboard> Basically, you can colour font by selecting different multivalues

ITWhisperer · ‎01-10-2026

Why not use the splunk app for lookup file editing? https://splunkbase.splunk.com/app/1724

ITWhisperer · ‎01-07-2026

It is a bit difficult to advise without knowledge of what your events look like but let us assume that you have a field called test_name, then you can do something like this ``` Ensure event are in chronological order ``` | sort 0 _time ``` Find the previous time that "testA" was received ``` | streamstats last(eval(if(test_name=="testA",_time,null()))) as last_testA | where isnull(last_testA) and test_name IN ("test", "test2", "test3")

ITWhisperer · ‎01-06-2026

What have you tried so far? What results did this produce?

ITWhisperer · ‎01-05-2026

Try something like this index="main" | eval txstatus=case(status=200,"Success",status >200 AND status <500,"Business_Fail",status >=500,"System_Fail") | eval success_pass_count = Success + Business_Fail | eval svc_nm=case(match(api_name,"login"),"Login",match(api_name,"Prepaid"),"Prepaid Registration",match(api_name,"Postpaid"),"Postpaid Registration",true(),"unKnown") | bin span=1d _time | stats count as total sum(success_pass_count) as Success_pass_count by svc_nm,_time | eval Success=round((Success_pass_count/total) * 100,2) | xyseries svc_nm _time Success | transpose 0 header_field=svc_nm column_name=date | eval date=strftime(date,"%d-%b-%Y") | transpose 0 header_field=date column_name="Service Name"

Posts	11602
Solutions	2331
Karma Given	99
Karma Received	3524
Member Since	‎2020-08-18

[Puzzles] Solve, Learn, Repeat: Family Trees

[Puzzles] Solve, Learn, Repeat: Tiling

[Puzzles] Solve, Learn, Repeat: Matching cron expr...

[Puzzles] Solve, Learn, Repeat: Duplicate Bridge S...

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

[Puzzles] Solve, Learn, Repeat: Word Search

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

Re: how to show in dashboard the -7d@h and now() i...

Re: How to get the API url for splunk dashboards

Re: how to show in dashboard the -7d@h and now() i...

Re: Regex if else condition posibilties

Re: Regex if else condition posibilties

Re: Trying to extract a string from a delimited to...

Re: Help with regex needed in Splunk

Re: Help with regex needed in Splunk

Re: rex help - extracting string between quotes

Re: Splunk rex command

Re: how to search a exact match inside a multivalu...

Re: subsearch in a stats command?

Re: subsearch in a stats command?

Re: I need to share a Dashboard

Re: I need to share a Dashboard

Re: I need to share a Dashboard

Re: Create multiple dependent dropdown Dashboard

Re: Any way to do this without map?

Re: input a lookup file only when there is "no res...

Re: How can we use CSS styling in classic Dashboar...

Re: Condition based Font Color in XML Dashboard

Re: Creating an Interactive Button to run SPL in D...

Re: Help building a search

Re: dynamic date for Splunk report

Re: Support on SPL Query

Join the Conversation