There are a couple of ways (at least) to do this Here is an example dashboard - that shows three techniques. 1. Uses a token in a base search to define the sort order as a token ($sort_order$) - there is an annoying issue with this method, which means that once the trellis is shown with the order, it will NOT reorder the trellis if the underlying table order changes. 2. Uses 6 separate single panels aligned horizontally and six tokens that define the display for the viz. ($f0$ to $f5$). This re-orders on change 3. Uses @chrisyounger number set viz - https://splunkbase.splunk.com/app/4537 which will do all this for you and does not require tokens and will re-order when things change There is possibly a search way directly to do it (appendpipe...?), but with the dashboard, it's pretty simple <dashboard version="1.1" theme="light"> <label>Sort_TC</label> <row> <panel> <table depends="$hidden$"> <search id="base"> <query> | makeresults count=3600 | streamstats c | eval _time=relative_time(now(), "@m") - c | eval type=mvindex(split("Budgeting,General Ledger,Payables,Expenses,eProcurement,Purchasing",","), random() % 6) | timechart fixedrange=f span=1m count by type </query> <earliest>-60m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> <table depends="hidden$"> <title>Sorting order is $sort_order$</title> <search base="base"> <done> <set token="sort_order">$result.sort$</set> <set token="f0">$result.f0$</set> <set token="f1">$result.f1$</set> <set token="f2">$result.f2$</set> <set token="f3">$result.f3$</set> <set token="f4">$result.f4$</set> <set token="f5">$result.f5$</set> </done> <query>| tail 1 | fields - _span _time | transpose 0 | sort - "row 1" | stats list(column) as sort list("row 1") as counts | foreach 0 1 2 3 4 5 [ eval f&lt;&lt;FIELD&gt;&gt;=mvindex(sort, &lt;&lt;FIELD&gt;&gt;) ] | eval sort="\"".mvjoin(sort, "\" \"")."\""</query> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> <single> <search base="base"> <query>| table _time $sort_order$</query> </search> <option name="colorMode">block</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">1</option> <option name="useColors">1</option> </single> </panel> </row> <row> <panel> <single> <title>$f0$</title> <search base="base"> <query> | table _time $f0|s$ </query> </search> <option name="colorMode">block</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="useColors">1</option> </single> <single> <title>$f1$</title> <search base="base"> <query> | table _time $f1|s$ </query> </search> <option name="colorMode">block</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="useColors">1</option> </single> <single> <title>$f2$</title> <search base="base"> <query> | table _time $f2|s$ </query> </search> <option name="colorMode">block</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="useColors">1</option> </single> <single> <title>$f3$</title> <search base="base"> <query> | table _time $f3|s$ </query> </search> <option name="colorMode">block</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="useColors">1</option> </single> <single> <title>$f4$</title> <search base="base"> <query> | table _time $f4|s$ </query> </search> <option name="colorMode">block</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="useColors">1</option> </single> <single> <title>$f5$</title> <search base="base"> <query> | table _time $f5|s$ </query> </search> <option name="colorMode">block</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="useColors">1</option> </single> </panel> </row> <row> <panel> <viz type="number_set_viz.number_set_viz"> <search base="base"> <query> | stats sparkline(max(*)) as sparkline_* latest(*) as * | appendpipe [ | foreach sparkline_* [ eval &lt;&lt;MATCHSTR&gt;&gt;='&lt;&lt;FIELD&gt;&gt;'] ] | fields - sparkline_* | transpose 0 | rename "row 1" as value, column as title "row 2" as sparkline | sort - value </query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </viz> </panel> </row> </dashboard>   ... View more

Before this stats command also add this | filldown Appname so that empty Appname rows will adopt the name from above ... View more

Are you clear on the difference between NULL and EMPTY - your mvmap is checking for non-EMPTY values of one of the values of the MV field, it is not checking for NULL This pair of lines is looping each of the MV values of impConReqID and removing only EMPTY values  | eval ImpConReqID= coalesce(ImpConReqId,impConReqId1) ... | eval ImpCon=mvmap(ImpConReqID,if(match(ImpConReqID,".+"),"ImpConReqID: ".ImpConReqID,null())) so if you have real null values in your MV, then you need to check for null, not empty, i.e. | eval ImpCon=mvmap(ImpConReqID,if(isnotnull(ImpConReqID),"ImpConReqID: ".ImpConReqID,null())) ... View more

OK, so try the search as I expect that will give you what you want ... View more

Do you mean that when you actively zoom a single panel, that same zoom should apply to the other panels. I don't believe there is any way for the dashboard to get feedback when you zoom a single map, so that you could set tokens that could be used by other panels.   ... View more

What do you mean it's showing null values - your mvmap statement looks like it's doing what you want it to do, i.e. making sure that it only takes data with at least 1 character. Can you demonstrate the issue as the mvmap statement works, i.e. this example shows that it will remove the empty middle element | makeresults | fields - _time | eval ImpConReqID=mvappend("a","","b") | eval ImpCon=mvmap(ImpConReqID,if(match(ImpConReqID,".+"),"ImpConReqID: ".ImpConReqID, null())) | eval base_elements=mvcount(ImpConReqID) | eval reduced_elements=mvcount(ImpCon) What is the relevance of the 2nd two lines of your example to your question?   ... View more

What is the relationship between ID and Event, because you don't appear to be doing anything with ID in you  current search. Does Event exist in your second dataset (ERROR API [ID]) Assuming that your purpose of trying to join in the first place on ID is because you don't have Event in the second dataset and ID has a 1:1 relationship with Event, then try this index=abcd ("API : access : * : process : Payload:") OR ("API" AND ("Couldn't save")) ``` You could combine this rex into a single statement to extract ID for both INFO and ERROR cases if you can make the regex ``` | rex "\[INFO \] \[.+\] \[(?<InfoID>.+)\] \:" | rex "\[ERROR\] \[API\] \[(?<ErrorID>.+)\] \:" ``` Assume this will ONLY occur in Info events, so will be null for ERROR ``` | rex " access : (?<Event>.+) : process" ``` Get the common ID ``` | eval ID=coalesce(InfoID, ErrorID) ``` t is a base event, forms Total ``` | eval t=if(isnotnull(InfoID), 1, 0) ``` Summing 't' gives total and count of unique ErrorID gives failed ``` | stats sum(t) as Total dc(ErrorID) as Failed values(Event) as Event by ID | eval Success=Total-Failed This uses the unique count of ErrorID to determine failures, which is effectively the dedup of the error Id, but it is assuming that one ID is one Event so at the end with the values(Event) it will have the Event extracted from the Info events and join on the common ID. Hope this helps and always use the principle that join in Splunk is never a good way to go. ... View more

You can also have multiple visualisations inside a single <panel> element, i.e. <panel> <html> </html> <single> </single> <single> </single> <chart> </chart> <table> </table> </panel> The way Splunk lays out such structure inside the panel is that <single> elements are aligned horizontally, but others will then alighn vertically. I often will avoid using a single panel viz, which offers limited customisation and instead use and HTML section with the contents coming from tokens calculated from searches. The top three 'rows' of your example panel, i.e. total, value, expected, above... could be a single HTML block where you can write the data from tokens and then a timechart can sit underneath. Depending on how good your html/css skills are you can do a huge amount to vary the style. ... View more

Just pointing out here that the statement | inputlookup test.csv OR inputlookup test2.csv is not valid Splunk - you cannot do two inputlookup commands like that. ... View more

The reason for setting up the example data in that way is based on my understanding of your description of the problem. Generally the easiest way to give advice is for you to post an example of the data from both types and demonstrate what you want to achieve with the output. No you don't need to append - the whole makeresults/append section is about setting up an example data set to show how you go about joining the two. If you can post an example of the two data sources, it would be easier to show how it should be done.   ... View more

One additional optimisation that may be possible in your case... You are expecting 13m events from 24m that satisfy the search criteria, so you want to totally ignore 11m events if possible, so they are never even scanned. If you look at the job properties in the job inspector you will see scanCount and eventCount. One key way to improve performance is to reduce the scanCount, where the indexes go look at the raw event data to find if your search matches. This can be done using the TERM(x) directive, where x is a piece of data that is a TERM, i.e. surrounded by major breakers in the data, so that it will be recorded in Splunk's tsidx files. When you use the TERM(x) directive, it will search the tsidx files for the given term and if not found will not even look at the bucket raw data for that term. If your search criteria have constraints that can be converted to TERM directives, try that. There's a really good talk about this topic from conf 20 here https://conf.splunk.com/files/2020/slides/PLA1089C.pdf   ... View more

What @ITWhisperer , but I suspect your problem is that you have  client_ip_address earliest latest in your initial search term, which I am guessing corresponds to ip earliest latest in your lookup. If your data contains a field called ip and that is what you are calling client_ip_address, then remove client_ip_address also from your search. If your data contains a field called client_ip_address and that is supposed to be a match for the ip in the lookup, then in your subsearch rename ip as client_ip_address. ... View more

Also, if you have lots of events that do NOT have fields called PROD anything and your event data must have PROD as a term in the data, then you can help filter only those events that have PROD in the data with TERM(PROD) index=myIndex sourcetype=mySourceType TERM(PROD)   ... View more

It can be done with map, but the phrase best approach uses the map command is not a phrase that would normally be used when considering the map command. As @PickleRick indicates, it has to be used carefully. In your pseudo example it's fine, but with real data remember that each result will initiate a new run of the saved search - if you have lots of results, as this runs collect for EACH and every row, it can place significant additional load on the server - and by default it will only run 10 iterations.   ... View more

What @richgalloway said, but whenever you reference a JSON field containing dots in the right hand side of an eval you MUST wrap the field name in single quotes, i.e. the first suggestion should be eval Error=case(isnotnull('attr.error'), 'attr.error', isnotnull('attr.error.errmsg'), 'attr.error.errmsg') but for your solution the coalesce() option would make sense - note there the use of single quotes - always for the right hand side of the eval.  This applies not just to JSON field names, but any field name that contains non simple characters or field names that start with numbers. ... View more

Take a look at the asset and identity framework documentation https://docs.splunk.com/Documentation/ES/7.3.1/Admin/Addassetandidentitydata Priorities can be assigned through the searches you write to pull in A&I data or can be derived from network subnets. Typically you may write searches to pull in data from sources and assign priorities based on criteria, such as whether the asset is a production asset, or the identity is a senior manager or a system administrator. This can be based on their job title or group membership.   ... View more

I don't believe it is possible to do - you can in theory do this index=_audit | head 1 | eval message="hello" | table user action message | collect testmode=f [ | makeresults | fields - _time | eval index="main" | format "" "" "" "" "" ""] but you would need for the subsearch to know the index to select and that is run before the outer search, so you can't do what you are trying to do ... View more

@Miguel3393 actually if you change that line to  | eval Error_{Codigo_error}=if(in(Codigo_error, "69", "10001", "11"), 1, null()) i.e. replace the final 0 with null() then you will not get all the extra columns for other Codigo_error values. ... View more

OK, if you want to add in more error code use cases, then change this line | eval Error_{Codigo_error}=if(Codigo_error="69" OR Codigo_error="10001", 1, 0) Change it like to | eval Error_{Codigo_error}=if(in(Codigo_error, "69", "10001", "11"), 1, 0) and add as many as needed  ... View more

Yes, you can because the second search using the base is simply to create the single row result, which you can then turn into a token, e.g. <search id="base"> <query> bla </query> </search> <table depends="$hidden$"> <search base="base"> <query> | stats values(device_ip_address) as device_ip_address | eval device_ip_address=mvjoin(device_ip_address, ",") </query> </search> <done> <set token="mytoken">$result.device_ip_address$</set> </done> </table> and then your other search can use $mytoken$ as needed - use the eval in the second search to make the format of the device_ip_address values what you need it to be for the other search. ... View more

The drilldown can't pass multiple rows of a table, but you could do this in a couple of ways 1. Create a stats values() of the column you want and just do not display it - using the <fields> XML element - it will still exist in every row as a field. Pass this field as a multi value field. 2. When you click the table, have a second search that uses the first search as a base search and runs and does the stats values(column) and another <done> clause to set the token. ... View more

Use this type of technique, so you set a token if there are results and the panel showing the table will display (depends=) and the panel showing the message will not display (rejects=) <table depends="$has_results$"> <search> <query> Your search </query> </search> <done> eval token="has_results">if($job.resultCount$&gt;0, 1, null())</eval> </done> </table> <html rejects="$has_results$"> <h1>There are no results</h1> </html>   ... View more