Hello Splunkers,    I'm having a inputput dropdown field, when i'm selecting "*" in that input dropdown field, I need to pass base search 1 to all searches in dashboard, when I'm selecting any other values apart from "*". I need to pass base search 2 to all searches in dashboard. <form version="1.1"> <label>Clone sample</label> <search> <query> | makeresults | eval curTime=strftime(now(), "GMT%z") | eval curTime=substr(curTime,1,6) |rename curTime as current_time </query> <progress> <set token="time_token_now">$result.current_time$</set> </progress> </search> <search id="base_1"> <query> index=2343306 sourcetype=logs* | head 10000 | fields _time index Eventts IT _raw | fillnull value="N/A" </query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> </search> <search id="base_2"> <query> index=2343306 sourcetype=logs* | where isnotnull(CODE) | head 10000 | fields _time index Eventts IT CODE _raw | fillnull value="N/A" </query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> </search> <fieldset submitButton="false" autoRun="true"> <input type="radio" token="field1"> <label>field1</label> <choice value="All">All</choice> <choice value="M1">M1</choice> <choice value="A2">A2</choice> <change> <eval token="base_token">case("All"="field1", "base_1", "All"!="field1", "base_2")</eval> </change> </input> <input type="time" token="time_token" searchWhenChanged="true"> <label>Time Range</label> <default> <earliest>-60m@m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <title>table</title> <search base="$base_token$"> <query>| table *</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> I have tries passing token in input dropdown it dosent work, can you please help me in fixing this issue. Thanks! ... View more

Hello Splunkers,    I would like to pass the two base search when input dropdown is set as all, i need to pass a base search, when other values apart from all is selected, it need to pass a diffrent base search. Thanks! ... View more

Hello,    I would like to create chart with multiple fields in Y axis and time in x axis,  Y axis - FIELD_01 FIELD_02 FIELD_03 FIELD_04 FIELD_05 FIELD_06 (All field values are in strings and numbers as well) x axis - _time Lets say, If the FIELD_01 consists of values Stopped, Started, Stopped, Stopped In y axis it should change its values with some colours. FIELD_06     Field values FIELD_05     Field values FIELD_04     Field value FIELD_03     Field value FIELD_02     Field value FIELD_01     Field value Y axis/ x axis                                         _time Thanks in Advance! ... View more

Hi Splunkers,    I would like to pass the label value to the macro based on some condition, when a single value is selected, the value is correctly passed to macro and search is loading the results but when the multiple values were selected the search is throwing error in macro. </input> <input type="multiselect" token="machine" searchWhenChanged="true"> <label>Machine type</label> <choice value="*">All</choice> <choice value="VDI">VDI</choice> <choice value="Industrial">Industrial</choice> <choice value="Standard">Standard</choice> <choice value="MacOS">MacOS</choice> <choice value="**">DMZ</choice> <default>*</default> <initialValue>*</initialValue> <delimiter>, </delimiter> <change> <condition match="$label$ == &quot;*DMZ*&quot;"> <set token="machine_type_dmz">"mcafee_DMZ=DMZ"</set> </condition> <condition match="$label$ != &quot;*DMZ*&quot;"> <unset token="machine_type_dmz"></unset> </condition> </change> </input> Thanks in Advance! ... View more

Hi Splunkers,   I dont need the value in first line and need that value later in search to filter, so I tried tis way to skip the value dmz type IN (if($machine$=="DMZ",true,$machine$) Is that will work? Thanks in Advance! ... View more

Hi Splunkers,    I'm having a lookup country_categorization, which have the keyword and its equivalent country, we need to use this info for the main search asset when the country field from index is "not available" or "Unknown", we need to use this keyword from lookup, need to compare with asset name with index, usually keyqords are set of prefix of asset name with multiple entries and it should match with equivalent country. Index- Asset, country braiskdidi001, Britain breliudusfidf002, Unknown bruliwhdcjn001, not available lookup keyword, country bru - Britain bre - Britain   the output should be   braiskdidi001, Britain breliudusfidf002, Britain bruliwhdcjn001, Britain. Thanks in Advance! Manoj Kumar S ... View more