Create a lookup table with fields DayNumber, DayofWeekName Like this: DayNumber DayOfWeek 0 Sunday 1 Monday ... 6 Saturday and | inpulookup daysofweek | join DayOfWeekName [| search <your search>] ... View more

day_of_week is 0-6 (Sunday-Saturday) ... View more

You can modify this code according to your requirements: | eval day_of_week=strftime(_time,"%w") | stats sum(count) as sum by day_of_week _time | sort by day_of_week | streamstats last(sum) as lastSum current=false window=1 | where isnotnull(lastSum) | eval change = (sum-lastSum)/lastSum*100 | where change>15 ... View more

you mean you want to compare this Monday with last Monday and so on? ... View more

| lookup host.csv host OUTPUT host this will not work you cannot output same field that you are looking up. You will have to create a separate field for example like this | inputlookup host.csv | eval found=1 | outputlookup host.csv and then use | lookup host.csv host OUTPUT found | where found=1 ... View more

Yes, static coloring is possible by clicking on the little brush sign on table header against each field. However you'll have to specify what cell value causes what cell color. However, if you want the table to parse the cell value and dynamically, run an expression and decide what color it should be - You need JavaScript for that. ... View more

Is there a _time field in your lookup? What format is it in? ... View more

Yes, it is possible but you'll have to use Javascript for that. In App "Splunk 6.x Dashboard Examples" check http://localhost:8000/en-GB/app/simple_xml_examples/custom_table_cell_highlighting ... View more

If there is any other in the lookup to use as destination field (for example just add a field "found" with value 1) - why not use (index="X" sourcetype=XmlWinEventLog source="XmlWinEventLog:System" EventCode=* (Level=1 OR Level=2 OR Level=3)) OR (index=master-data-lookups sourcetype="itop:view_splunk_assets") | lookup host.csv host output found | where found=1 |... ... View more

You will have to create a lookup table file say carlist.csv. Now when you'll add a car name and leave the text box (lost focus) it'll add the car in the lookup list. You will read that lookup into your multiselect. You can hide the panel in my example that shows list of cars using <panel depends="$hidden$"> property however i've left the panel there to show how it is adding the items. PS: you can add a submit button to avoid erroneous entries on user accidentally leaving the textbox. <form> <label>advancedinputs</label> <fieldset submitButton="false"> <input type="text" token="tkn_car"> <label>Enter a Car Model</label> </input> <input type="multiselect" token="carlist"> <label>Car List</label> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>,</delimiter> <fieldForLabel>car_name</fieldForLabel> <fieldForValue>car_name</fieldForValue> <search> <query>| inputlookup carlist.csv</query> </search> </input> </fieldset> <row> <panel> <table> <search> <query>| inputlookup carlist.csv | append [| makeresults | eval car_name = "$tkn_car$"] | dedup car_name | fields - _time| outputlookup carlist.csv</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> alternatively if you don't want to use a panel with table use this: <form> <label>advancedinputs</label> <fieldset submitButton="false" autoRun="false"> <input type="multiselect" token="carlist"> <label>Car List</label> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>,</delimiter> <fieldForLabel>car_name</fieldForLabel> <fieldForValue>car_name</fieldForValue> <search> <query>| inputlookup carlist.csv | append [| makeresults | eval car_name = "$tkn_car$"] | dedup car_name | search car_name != "" | fields - _time| outputlookup carlist.csv</query> </search> </input> <input type="text" token="tkn_car"> <label>Enter a Car Model</label> </input> </fieldset> </form> ... View more

I know it is an old question but still posting the answer in case someone searching for similar solution: Create a panel at the end of your dashboard. This will hide the button containing "Clone" option: <row> <panel depends="$hidden$"> <html> <style> .edit-other { visibility: hidden !important; } </style> </html> </panel> </row> Add this if you want to get rid of the menu bars as well. .view---pages-enterprise---7-0-5-3---1zrJY { visibility: hidden !important; } ... View more

There was no point discussing this when I deleted my comments. Period ... View more

Thanks @niketnilay for the explanation. ... View more

Awesome! great example explained in a great way. Just a question, does the <done> tag follows a <query> tag? and the "result" in "$result.resultCount$" refers to the result of the recent query? ... View more

Try appending this at the end of your search: ...your search | streamstats count as serial | stats values(*) as * by serial | fields - serial ... View more

Do you need something like this? | top 10 STATUS by projects | sort - projects count | eventstats sum(count) as ProjectTotal by projects | eval ProjectPercent = round(count/ProjectTotal*100,2)."%" | table projects STATUS count ProjectPercent ... View more

Can you please explain by giving the data in table entries instead of the SPL as without data it's hard to visualise what you are asking for. ... View more

It should work as far as you make sure the sourcetypes are the same for the specific files in C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_symantec-ep\default\inputs.conf file On your SysLog server You may need to write logs to separate files based on keywords in order to then ingest them with different sourcetypes. ... View more

@niketnilay You’re right but that’s not what we’re focusing here. It may come under ...your search | That I mentioned before the search. Anyway thanks for pointing out 🙂 ... View more