I'm trying to pass the timestamp from a field called alert_time in my main panel to the earliest and latest drilldown tokens for secondary panels in my dashboard. The primary panel uses a summary index for fired alerts and ini the secondary panels I'd like to pass the $click.value$ for the host and the alert_time - 1800 for $drilldown.earliest$ and alert_time + 1800 for $drilldown.latest$ Here is my current dashboard Any suggestions are much appreciated to try to accomplish what I'm trying to show <row> <panel> <table> <search> <query>index=alerts source="High CPU Usage > 95% - Infrastructure" | eval alert_time_epoch = strptime('alert_time', "%m/%d/%Y %H:%M:%S") | rename orig_host as Host, avg_cpu_used_percent as "Avg % CPU Used" | table Host, "Avg % CPU Used", alert_time, alert_time_epoch | sort - alert_time</query> <earliest>0</earliest> <latest></latest> <refresh>10m</refresh> <refreshType>delay</refreshType> </search> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <drilldown> <set token="selectHost">$click.value$</set> <eval token="drilldown.earliest">($selectedalert_time$-1800)</eval> <eval token="drilldown.latest">$selectedalert_time$+1800</eval> <set token="showAlertDD">1</set> </drilldown> </table> </panel> </row> <row> <panel> <table depends="$showAlertDD$"> <title>Drilldown CPU - $selectHost$ ($drilldown.earliest$) ($drilldown.latest$)</title> <search> <query>| multisearch [search index=os host=$Host$ sourcetype=cpu cpu="all" |eval cpu_used_percent=100-PercentIdleTime] [search index=perfmon host=$Host$ source="Perfmon:CPU" counter="% * Time" |eval user_cpu=if(counter=="% User Time",round(Value,2),""), proc_cpu=if(counter=="% Processor Time",round(Value),""), cpu_used_percent=user_cpu+proc_cpu |eval earliest=$selected_time$-1800, latest=$selected_time$+1800] |lookup infrastructure_servers host |where state=1 | search host!="irvetl01" |stats avg(cpu_used_percent) as avg_cpu_used_percent by host |eval avg_cpu_used_percent=round(avg_cpu_used_percent,2) |where avg_cpu_used_percent>95</query> <earliest>$drilldown.earliest$</earliest> <latest>$drilldown.latest$</latest> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <drilldown> <unset token="showAlertDD"></unset> </drilldown> </table> </panel> ... View more

I'm having a trouble splitting syslog data coming in over UDP:514 to their own index and transforming the respective sourcetype and source for the data. I'm working with Barracuda and Cisco_ASA & Cisco_ESA data that is being sent over UDP 514. I've tested the following examples but for some reason only the Cisco ASA is showing up in my search head and saving to Barracuda... I'm all mixed up Transforms.conf [override_index_cisco] FORMAT = cisco DEST_KEY = _MetaData:Index [override_index_barracuda] FORMAT = barracuda DEST_KEY = _MetaData:Index [override_sourcetype_cisco_asa_st] SOURCE_KEY = MetaData:Host FORMAT = sourcetype::cisco_asa DEST_KEY = MetaData:Sourcetype [override_sourcetype_cisco_esa_st] SOURCE_KEY = MetaData:Host FORMAT = sourcetype::cisco_esa DEST_KEY = MetaData:Sourcetype [override_sourcetype_barracuda] SOURCE_KEY = MetaData:Host FORMAT = sourcetype::barracuda DEST_KEY = MetaData:Sourcetype [override_source_cisco_asa_st] FORMAT = source::cisco_asa DEST_KEY = MetaData:Source [override_source_cisco_esa_st] FORMAT = source::cisco_esa DEST_KEY = MetaData:Source [override_source_barracuda] FORMAT = source::barracuda DEST_KEY = MetaData:Source Props.conf [source::udp:514] TRANSFORMS-changesourcetype = cisco_esa_st, cisco_asa_st, barracuda TRANSFORMS-index = cisco, barracuda ... View more

I'm sending Barracuda logs over UDP 514 and configuring my inputs to listen for, using the Barracuda WAF/ADC Add-on for Splunk : [udp://514] index = barracuda source = barracuda:log sourcetype = barracuda:log disabled = 0 I'm only seeing the data coming into with a single eventtype = err0r and none of the fields are processed by the add-on props & transforms. I'm also looking to find a Barracuda app to display dashboard visualization with the data but none of the apps found in Splunkbase seem to work and/or outdated. Help appreciated, thanks, everyone. ... View more

I'm trying to create a bar graph that displays the count(tickets) by group and then the TOTAL count of all tickets for the groups. I'm currently using |addtotals to calculate the Total but I would like to create a new field to store that number. Right now I'm getting the Total showing under my Groups field. Ideally, I'd like to be able to use the new field for Total to show as a different color or overlay. I can't quite find what I'm looking for and it seems like others have asked about this. index=test Groups=* | dedup Tickets | chart count(Tickets) by Groups | rename count(Tickets) as Tickets | sort - Tickets | addcoltotals Tickets | fillnull value="TOTAL" ... View more