Hi all, I currently have a pivot table which has column named 'alias'. I was wondering is there a way to sort that column such that the value "error" always shows up on top, then the remaining values will show under it. The default alphabetical orders don't work here as in both alphabetical and reverse alphabetical order, error does not show up ontop and instead shows up somewhere in the middle.  Any help would be greatly appreciated! ... View more

Hi all, I have a dropdown field that is used to filter the results of a pivot table. Is there a way that I can show and hide a column in the pivot table? For instance, say the token of the dropdown field is 'select_field_1' ('version' and 'daysRemaining' are columns) Id imagine there is a conditional command where you can do if ($select_field_1|s$=certificate,show daysRemaining hide version) Any help would be greatly appreciated! ... View more

Hi all, I have a row of a pivot table as shown in the picture. However, is there a way to make it so that if the values are different when comparing the last four rows, it will highlight the row? If possible an even better solution would be to highlight the cell that is different AND has the least frequency number. For instance, say in the last 4 columns when looking at one row, the values are shown as '4', '4', '5', '4' - only highlight the cell that has the 5 in it because yes it is different but it also shows up the least number of times.  Any help would be hugely appreciated. Please let me know if there are any issues with seeing the image. ... View more

Hi All, Currently I have a pivot table within a dashboard. I've added a dropdown that filters the pivot table based on the selected dropdown item. I was wondering is there a way where I can add a column to the pivot table if a particular dropdown value is selected.  E.g. Something along the lines of the following logic: if($dropdownfield$=="cartridge") add column "Catridge" remove column "Artefact" Feel free to ask for further clarification if the question doesn't make sense. Any help would be highly appreciated.  ... View more

Hi all, I had a previous question that got solved here: https://community.splunk.com/t5/Getting-Data-In/Split-a-nested-json-array-with-key-value-pairs/m-p/554294#M91857 However, with a slight variation to the input json data, splunk is no longer separating out each object as an event (changed "Rows" into "Root" and "timestamp" into "Timestamp").  Similar to the question above, I have the following input data (this is nicely structured, whereas in the file it is instead one long line): { "Root": [ { "Timestamp": "03-06-2021 13:52:34", "Region": "rcc", "Hostname": "lx206", "Version": "123", "Environment": "E" }, { "Timestamp": "03-06-2021 13:52:33", "Region": "rcc", "Hostname": "lx206", "Version": "123", "Environment": "E" }, { "Timestamp": "03-06-2021 13:52:32", "Region": "rcc", "Hostname": "lx206", "Version": "123", "Environment": "S" }, { "Timestamp": "03-06-2021 13:52:31", "Region": "rcc", "Hostname": "lx206", "Version": "123", "Catridge": "UPP", "CatridgeType": "Product", "Environment": "S" } ] }  The following props.config was used before, however no longer works with the new data: CHARSET=AUTO DATETIME_CONFIG= LINE_BREAKER=}(,){\"timestamp\" NO_BINARY_CHECK=true SEDCMD-a=s/{"Rows": \[//g SEDCMD-b=s/\]}//g SHOULD_LINEMERGE=false disabled=false pulldown_type=true category=Custom With the new input data, I've tried modifying the config file to produce the following, however one event is produced instead of separating each object into an event: CHARSET=AUTO DATETIME_CONFIG= LINE_BREAKER=}(,){\"Timestamp\" NO_BINARY_CHECK=true SEDCMD-a=s/{"Root": \[//g SEDCMD-b=s/\]}//g TRUNCATE=0 SHOULD_LINEMERGE=false disabled=false pulldown_type=true category=Custom Any help would be greatly appreciated.  ... View more

Hi all, I'm quite new to splunk. I've been testing the manual upload of the following json file to splunk enterprise. However, I'm getting the error "Failed to parse timestamp" so I'm guessing it's unable to read the timestamp that is available in the json file "date_time". Would anyone be able to help me with this issue, also I am unable to alter the config file (etc/...) so hopefully the solution can be done through the web UI.  JSON input file:     { "SVP": { "rcc": { "application": { "ICE13": { "hostname": "218", "domain": "rc", "app_id": "13", "version": "413", "date_time": "29/05/2021" }, "ICE1": { "hostname": "lnxau2004st0218", "domain": "rcc", "app_id": "1", "version": "413", "date_time": "31/05/2021", "UPP": { "hostname": "218", "domain": "rc", "version": "null", "date_time": "29/05/2021" } } }, "utility": { "ICE13": { "Ctl.sh": { "hostname": "218", "domain": "rc", "version": "144", "date_time": "29/05/2021" } }, "ICE1": { "Ctl.sh": { "hostname": "218", "domain": "rc", "version": "144", "date_time": "31/05/2021" } }, "ICE5": { "Ctl.sh": { "hostname": "218", "domain": "rc", "version": "144", "date_time": "30/05/2021" } }, "ICE9": { "Ctl.sh": { "hostname": "218", "domain": "rc", "version": "144", "date_time": "31/05/2021" } }, "ICE11": { "Ctl.sh": { "hostname": "219", "domain": "rc", "version": "140", "date_time": "30/05/2021" } } } } } }     Thanks for any and all help!  ... View more