Worked like a dream. Thanks a million and I gave you Karma 🙂 ... View more

So, panel 1 shows a number of fields, with "Country" field being the most important. The 2nd panel shows other field, with URL field being most important. The SESSION_UUIS from table one should be the common field between both tables. If you click on a row on table 1, table 2 should appear, with only data relative to the SESSION_UUID of the row you clicked on table 1. This is what I need to do ..... ... View more

The following does not produce any results for the 2nd panel: <form theme="dark" script="tokenlist.js"> <label>Fraud Investigations Test - POR</label> <description> This dashboard ....</description> <row> <panel> <table> <search> <query> index=fraud_glassbox sourcetype="gb:sessions" | table SESSION_UUID Global_MCMID_CSH SESSION_TIMESTAMP COUNTRY CITY CLIENT_IP Global_EmailID_CSH </query> </search> <option name="drilldown">cell</option> <drilldown> <set token="tokComponent">$row.component$</set> </drilldown> </table> </panel> </row> <row depends="$tokComponent$"> <panel> <table> <search> <query> index=fraud_glassbox sourcetype="gb:hit" component="$tokComponent$" | table HEADER_REQUEST_REFERER,URL_PATH, SESSION_TIMESTAMP, username,CLIENT_IP, PACKET_IP </query> </search> </table> </panel> </row> </form> ... View more

I closed the quotes but which table do I need to add $row.component$ to? ... View more

Here is my current XML code: Panel 1, I am setting the query's result to token called "total_tok": <panel> <title>Score</title> <single> <search base="base"> <query>where ((EDR=1 OR EDR="Exception Approved" OR EDR="Exception Submitted") AND (NGAV=1 OR NGAV="Exception Approved" OR NGAV="Exception Submitted")) |stats count as Compliant | appendcols [|loadjob savedsearch="andrew_nelson:renbe:Asset Registry - Security Agent SRO" events=false |eval edr_compliant=if(EDR=1, "Yes", "No"), ngav_compliant=if(NGAV=1, "Yes", "No") , mcafee_active45d = if(mcafee_active45d=1,"Active","Not Active") | fields - dell_discovery_mac dell_discovery_ip | search dell_discovery_host="*" EDR="*" NGAV="*" DeviceOwnerL5Name="*" DeviceOwnerL4Name="*" | search |stats count as Total | eval Total = Total] | eval percent=round((Compliant/Total)*100,2)."%" | table percent</query> <done> <set token="total_tok">$result.percent$</set> </done> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> Next, on Panel 2, I am simply calling this same token and multiplying i (the calculation is a lot longer in my actual application btw 🙂 )  <panel> <title>EDR Compliant - Percentage</title> <single> <search> <query>$total_tok$*2</query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> Am I calling the token from Panel 1 incorrectly as Panel 2 just says the following:   Many thanks, Patrick ... View more

Here is my current XML code: Panel 1, I am setting the query's result to token called "total_tok": <panel> <title>Score</title> <single> <search base="base"> <query>where ((EDR=1 OR EDR="Exception Approved" OR EDR="Exception Submitted") AND (NGAV=1 OR NGAV="Exception Approved" OR NGAV="Exception Submitted")) |stats count as Compliant | appendcols [|loadjob savedsearch="andrew_nelson:renbe:Asset Registry - Security Agent SRO" events=false |eval edr_compliant=if(EDR=1, "Yes", "No"), ngav_compliant=if(NGAV=1, "Yes", "No") , mcafee_active45d = if(mcafee_active45d=1,"Active","Not Active") | fields - dell_discovery_mac dell_discovery_ip | search dell_discovery_host="*" EDR="*" NGAV="*" DeviceOwnerL5Name="*" DeviceOwnerL4Name="*" | search |stats count as Total | eval Total = Total] | eval percent=round((Compliant/Total)*100,2)."%" | table percent</query> <done> <set token="total_tok">$result.percent$</set> </done> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> Next, on Panel 2, I am simply calling this same token and multiplying i (the calculation is a lot longer in my actual application btw 🙂 )  <panel> <title>EDR Compliant - Percentage</title> <single> <search> <query>$total_tok$*2</query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> Am I calling the token from Panel 1 incorrectly as Panel 2 just says the following:   Thanks, Patrick ... View more

Perfect, this solved my problem. Thanks and I gave you karma  ... View more

This would be good but I’m not aloud to change the base search in this dashboard. Most of the panels just perform counts under different filtering. What I need to access these individual answers in 2 panels. Could I not assign each individual panel output to a token in a <done> event handler and just access the tokens in the new panel I need? ... View more

Perfect, this helped a lot. I have you karma too 😀 ... View more

This worked perfectly, thanks! 😁 ... View more

I solved the problem, thanks😀: ..... | eval authentication_method =spath(_raw,"action") | eval authentication_service = spath(_raw,"name") | eval reason =spath(_raw,"message") | eval action=spath(_raw,"status") | eval src=spath(_raw,"source") | eval src_user_id = spath(_raw,"source_host") | eval user=spath(_raw,"apiUsername") ... View more

Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them. Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval. Can you please help? ... View more

Does anyone know the answer to this issue please as I need it for CIM compliance? ... View more

Does anyone know the answer to this please? ... View more

Basically, I have an index and some of the fields are in JSON format. I need to extract them and make individual fields for them. Spath was the only way I could access the values in JSON format and turn them into fields. I am unable to add the Spath into the props.conf - only extraction, field alias and eval. Can you please help? ... View more

Can you suggest another alternative to calculate the percentage? ... View more

How can I calculate both the total and IT_Managed values then? It has been 3 days and I have had no luck 🙄 ... View more