Wa'salam brother. Glad it helped! ... View more

Under <form> <init> <set token="my_var_threshold">1000</set> </init> .... Your other xml code </form> Define the token and then use it anywhere in your searches just like a variable. ... View more

Put your conditions under <done> </done> instead of <progress></progress> and it will work. However @Vijeta is right. your token will cause both panels to disappear as you're using same token name. <dashboard> <label>Hide dashboard test</label> <row> <panel depends="$panel_show$"> <title>This panel has results</title> <table> <search> <query>| makeresults | eval a=1 | table a </query> <earliest>0</earliest> <latest></latest> <done> <condition match="'job.resultCount' > 0"> <set token="panel_show">true</set> <unset token="panel_hide"></unset> </condition> <condition> <set token="panel_hide">true</set> <unset token="panel_show"></unset> </condition> </done> </search> <option name="drilldown">none</option> </table> </panel> <panel depends="$panel_show$"> <title>This panel has "No results found"</title> <table> <search> <query>| makeresults | eval a=a+1 | table a</query> <earliest>0</earliest> <latest></latest> <done> <condition match="'job.resultCount' > 0"> <set token="panel_show">true</set> <unset token="panel_hide"></unset> </condition> <condition> <set token="panel_hide">true</set> <unset token="panel_show"></unset> </condition> </done> </search> <option name="drilldown">none</option> </table> </panel> </row> </dashboard> ... View more

Not being able to send splunkd logs is strange. Have you tried the command ./splunk list forward-server (on linux) splunk list forward-server (on Windows) under $SPLUNK_HOME/bin directory ... View more

I don't know much about your requirements but this might be helpful with some modifications | makeresults | eval data = "hello my name is mark and I am happy---hello my name is mark and I am sad" | makemv delim="---" data | eval field1= mvindex(data,0), field2=mvindex(data,1) | makemv delim=" " field1 | makemv delim=" " field2 | eval field = mvzip(field1,field2) | table field | mvexpand field | makemv delim="," field | eval field1= mvindex(field,0), field2=mvindex(field,1) | eval diff = if(field1==field2,"",field1."/".field2) ... View more

can you check the level of permission on "script.sh". does it have execute permissions? ... View more

are the fields like ID and SourceCode or Version of same length in each event? ... View more

try wrapping your token in tonumber function like | eval health = tonumber($tok_health|s$) ... View more

You can do this by powershell scripts and schedule them on one of your universal forwarders. For that purpose you will require to install SPClient_x64.msi on a windows system. Can share details if you need. ... View more

Check your inputs. You may be running some inputs (especially Windows Events) that may be consuming high CPU. Disable that and see if it gets any better ... View more

<your search> | top 10 application by sourceIP ... View more

The best option will be running scripts and just looking for the changed bits and sending to Splunk though HEC (or writing to file and monitoring). then dedup on the "unique key" in your data will give you all unchanged old records + changed new records. However, there is no out of the box solution for this other than dbconnect ... View more

@DavidHourani Well not getting any message but Submit button simply doesn't work. When I change options in the input controls sometimes it is just submitted to the panel without pressing the submit button and sometime doesn't event after pressing the submit button. ... View more

You need to skip time stamp and then few other fields: Use this | makeresults | fields - _time | eval rawdata="I 2019-05-23 22:27:15.886Z 5960 1712 XOceMpk7Ph@Lna20eJwxXwAAAAU 1@43465473@A WPB-Log: file=/users/source/testr.cls method=testmethod ID= ok=1 ProcessedBankTxnCount=2 TxnRecord=289 NumOfProcessedTxns=1" | rex field=rawdata ".*?\s.*?\s.*?\s.*?\s.*?\s(?<myField>[^\s]*)" | table myField ... View more

@niketnilay Your submit button is not working. Any reasons why? ... View more

if it is in a different search you can use earliest=@d latest=@d+10h And for 10am till now earliest=@d+10h latest=now ... View more

use earliest = @d+10h For events after 10am today ... View more

Try this | makeresults | fields - _time | eval rawdata="439 XObk5g6CUI62-gr3UIKfXAAAAAs 1@43465473@A" | rex field=rawdata "^\d+\s(?<myField>[^\s]*)\s" More general regex would be: | makeresults | fields - _time | eval rawdata="439 XObk5g6CUI62-gr3UIKfXAAAAAs 1@43465473@A" | rex field=rawdata "^.*?\s(?<myField>[^\s]*)" ... View more

Please mark the answer as accepted if it works. Thanks ... View more

Just create a .csv file and upload as a lookup through Settings >> Lookups >> Lookup table Files and then reference it with a .csv suffix |inputloookup daysofweek.csv | join DayOfWeekName [| search ] ... View more

Try this: | makeresults | eval data=" yes,a,host1,category1|yes,b,host1,category1|yes,c,host2,category1|yes,a,host2,category3|yes,b,host2,category2" | makemv data delim="|" | mvexpand data | rex field=data "(?<event>[^\,]*)\,(?<myField>[^\,]*)\,(?<myHost>[^\,]*)\,(?<myCategory>[^\,]*)$" | table event myField, myHost, myCategory | stats count(eval(myField=="a")) as A, count(eval(myField=="b")) as B, count(eval(myField=="c")) as C by myHost, myCategory ... View more