That’s correct. ... View more

Unfortunately adding KV stores does require a level of privileges - I believe you need admin_all_objects. You do have to create the collections and transforms conf files - I suspect you will need to run this past the admin, as they will most likely have to create it for you - the Splunk app for lookup file editing does allow you to create KV store definitions, both collections and transforms, but you will need those privileges. There mey be some environmental issues around using the KV store in that admins would like to know about 😞 ... View more

Hi So far, I didn't see any missing data, so it's not causing a problem, except for the error message. I am not sure why Splunk has to throw the error message.  Thank you for your help. ... View more

Hello, Here's the image. I want to have the time range change based on the selected Grade. For example: If I select Kindergarten, the time will change to "last 24 hours" Thank you ... View more

Again you just told how you are trying to solve something, but you didn't tell what is your real issue? Could you describe what you are looking with this dashboard?  ... View more

hi @LearningGuy  I believe it's due to the collect commands used for scheduled summary indexing. More on this can be found here. https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Knowledge/Configuresummaryindexes#Other_configuration_files_affected_by_summary_indexing  https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Collect If the reply helps, a Karma upvote would be appreciated. ... View more

Hello, Thank you so much for your response. The query that contain the search is actually in the statistic table, but the condition is a condition based on the drop down token. This is the main question: How to dynamically search / where based on variable like below? | search day_no_each_timestamp = day_in_week OR | where day_no_each_timestamp = day_in_week   ... View more

You can "nest" mvappends to add multiple values at once. You can also use split() to make a multivalued field from a string of delimited values. You can use isnull() to check if mvfind returned a value or not. One caveat about mvfind though - it matches based on regex so you might get some unexpected results if you're not careful ... View more

Sure thing. When running that search over "Last 30 days", in the resulting _raw field I get: 02/14/2024 00:00:00 +0100, info_min_time=1707865200.000, info_max_time=1710537355.000, info_search_time=1710537355.622, othertestfield=test2, orig_sourcetype=splunkd   which does indeed look like the _time value has defaulted to info_min_time ... View more

Hello @yuanliu  Sorry if I did not explain it clearly. Yes, I am clear on how the span and snap works in Splunk. I appreciate your help as always.  Thank you!! ... View more

I think I figured it out index=original_index | addinfo | eval search_now=info_max_time | eval _raw=printf("_time=%d", info_min_time) | foreach "*" [| eval _raw = _raw.case(isnull('<<FIELD>>'),"", mvcount('<<FIELD>>')>1,", <<FIELD>>=\"".mvjoin('<<FIELD>>',"###")."\"", true(), ", <<FIELD>>=\"".'<<FIELD>>'."\"") | fields - "<<FIELD>>" ] | collect index=summary testmode=false file=summary_test_1.stash_new name=summary_test_1" marker="report=\"summary_test_1\""   ... View more

Hello @yuanliu, I tried your suggestion and modified column name "Grades" into "Grade", and it worked fine. I accepted your solution So, we had to split the data manually.      Note that there is still an issue with snap-to is shifting the data as discussed in my other post. I appreciate your assistance. Thank you ... View more

Hello @bowesmana  Q: Are you collecting a _raw field or are you collecting fields without _raw? >> I am not sure what you meant, my  understanding _raw is the one that got pushed to index=summary Q: Are you specifying an index to collect to?   What's your collect command? I figured out why collect command didn't push the data. I put the wrong index name.  I stroke the incorrect name below | collect   index= summary     summary_test_1    testmode=false    file=summary_test_1.stash_new   name=summary_test_1"   marker="report=\"summary_test_1\"" Q:Are you running this as an ad-hoc search or as a scheduled saved search? I ran this as an ad-hoc search as a proof of concept using the past time Once it's working I will use a scheduled saved search for future time I added your suggestion to my search below and it worked, although I don't completely understand how.   Note that addtime=true/false didn't make any difference I appreciate your help.  Thank you.   If you have an easier way, please suggest 🙂     index=original_index ``` Query ``` | addinfo | eval _raw=printf("_time=%d", info_max_time) | foreach "*" [| eval _raw=_raw.case(isnull('<<FIELD>>'),"", mvcount('<<FIELD>>')>1,", <<FIELD>>=\"".mvjoin('<<FIELD>>',"###")."\"", true(), ", <<FIELD>>=\"".'<<FIELD>>'."\"") | fields - "<<FIELD>>" ] table ID, name, address | collect index= summary testmode=false addtime=true file=summary_test_1.stash_new name=summary_test_1" marker="report=\"summary_test_1\""   ... View more

CSS would be probably the way I'd try to go for something like this but it might require more fiddling around that just simple align for the cell contents. ... View more

Hello, Your code moved the panel to the left when you set it to 40%, but not the text. I showed grey area on the right side.  Tried to use 100%. It turns out the text-align: left  didn't do anything     Thanks I would like to align the text like the following:       ... View more

Did you ever figure this out? I had the same issue.   Thanks ... View more

This is a different question - try searching answers for a relevant topic ... View more

21 = 1+2+3+4+5+6 i.e. it comes from your addcoltotals - try this | addcoltotals labelfield=Name Score* ... View more

You didn't read the docs I pointed you to. Stitching your searches using random commands won't work. Results from a subsearch are rendered as a set of conditions to the outer search - you don't pass argumenta/tokens/whatever to the subsearch from the outer search. (We'll leave the map command for now). ... View more

This is great info.. thanks for providing the explanation. However I only have two options: Export PDF and Print, I couldn't see "Schedule PDF delivery"   ... View more

Hello @richgalloway , Thanks for your help.   It's odd that I didn't receive notification when you responded. 1) It looks like it also works if I do the index first, then DBX query.  2) How do I put company ID in the brackets on DBX query dynamically?     eval variable = .....   A, B, C, ...   Z  (Company ID)      where companyID in $variable$ index=company | append [ | dbxquery query="select * from employee where companyID in (A,B,C)" | stats values(*) as * by CompanyID ... View more

@bowesmana  Your suggested solution solved memory issue. Thank you!!  ... View more

It sounds like the original data has too many lines/events.  You may want to implement EventBreaker or LineBreak in your props.conf on the ingest before you need to apply any search time eval or mvexpand. ... View more