Can you give a bit more about your query because having to use appendpipe to get dates filled in seems a little unusual. This example | makeresults | eval count=split("2,0,2,0,0,0,0",",") | mvexpand count | streamstats c | eval _time=now() - ((7 - c) * 86400) | fields - c will produce this single viz whether or not you add | timechart span=1d max(count) as count   ... View more

This will partly depend on what proportion of the total data you are looking to exclude. If the excluded proctitles are a significant proportion of the data, then using a post process where or regex clause may not perform so well, but you will have to play with that. Setting tags will still involve a search time extraction to evaluate the tag, so under the hood the search is being done. You might want to look at the TERM directive - see this link  https://conf.splunk.com/files/2020/slides/PLA1089C.pdf You will need to understand what constitutes a TERM in your data and whether that will work for your use case, but that can significantly improve performance. When you are looking at this type of performance issue, go look at the job properties in the job inspector - look at scan count values - the more you scan, the more data you are having to check. You could go down the indexed extraction route where you set a field at index time, but that is somewhat static and if you need to exclude a new proctitle, then that won't help, but it will improve search performance at the cost of index performance and disk space. ... View more

Or based on your other question, you can directly set that criteria in the initial search, i.e. index=test event.Properties.errMessage!=OK ... View more

You will either have to show the pie chart as a trellis chart so it shows one chart for each country or create a composite field containing both country and error message, as the pie chart can only show one dimension, i.e. index=test | iplocation Properties.ip | dedup Properties.ip | eval composite=country.":".'event.Properties.errMessage' | stats count by composite  Then the composite will be Australia:OK and so on.   ... View more

It appears to be related to the size of the visualisation. I changed f to be 100003138 and still I see all 6 slices but if I simply change the size of the visualisation area of the pie chart I will see this   ... View more

If you do not have a 'group' value per event, then you can simply create one by putting | streamstats c as group before the first stats mentioned by @yuanliu  ... View more

This statement | eval IP_ADDRESS=if(index=index1, interfaces.address, PRIMARY_IP_ADDRESS) will need to have single quotes round the interfaces.address, as eval statements need fields with non-simple characters to be single quoted, in this case the full-stop (.) | eval IP_ADDRESS=if(index=index1, 'interfaces.address', PRIMARY_IP_ADDRESS) Note also that index=index1 would need to be index="index1" as you are looking for the value of index to be the string index1 rather than comparing field index to field index1. As for debugging queries, if you just remove the 'where' clause, you can see what you are getting and what the value of indexes is.  Hope this helps ... View more

Unfortunately, I don't know if you can make <select> input take custom values, that's more of an html question if you are doing it inside the html panels - I am guessing you can probably make some JS to make this this work, but it's a guess. ... View more

Yes @naveenalagu you are right re count=1, in this type of solution, you normally set an indicator in each part of the search (outer+append) as @ITWhisperer has shown and then the final stats will do the evaluation to work out where the data came from.   ... View more

When you say "in another application" what do you mean The predict command can be used to predict future trends https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Predict     ... View more

Try this - use your index and I assume that the event _time stamp is the login time. index=bla userID=text123 earliest=-5m@m latest=@m | stats dc(ip) as ips by userID | where ips>1 If your events contain other info than just login details, then you may need to add login_time=* to the search ... View more

Do you have the date_* fields in your data? If so, you can do this search... earliest=-1mon (date_hour>=$start_hour_token$ date_minute>=$start_minute_token$) (date_hour<$end_hour_token$ OR (date_hour=$end_hour_token$ date_minute<$end_minute_token$))) If you don't have those fields extracted, then you will have to do an eval statement to create the date_hour and date_minute fields and then do a where clause to do the same comparison as above. ... View more

As @ITWhisperer has said, subsearches run first, so you can't pass time from the outer to the subsearch, but the addinfo command is generally a way to know what time range you have for your search, so in the subsearch you can do something like this to remove the entries from the lookup that do NOT fit in the time range of the search [ | inputlookup lookup.csv | addinfo | eval first_time=strftime(info_min_time, "%H") | eval last_time=strftime(info_max_time, "%H") | rex field=Time "[^ ]* (?<hour>\d+)" | where hour>=first_time AND hour<=last_time ] This is taking the HOUR part of your lookup Time value and comparing that to the search time range and only retaining the lookup entries that match the time range of your search, so when you combine the entries after this subsearch, only those from the lookup that are relevant to the range are collected with the real time data. ... View more

If you can change the URL parameters then you can create a subsearch that takes the ms parameters as parameters e and l. In the subsearch you can do the division and rename the fields earliest and latest. When passed out of the subsearch they will be treated as earliest and latest ... View more

Can you change the URL in any way or is that all you have to make a search and there's no other component or processed in the middle ... View more

Yes, that technique works - are you saying it doesn't?   ... View more

Ah, so I missed your point somewhat in that the list contains all the values you want and you should alert if one is missing from the data. You can do this | stats count by Time Value | append [ | inputlookup lookup.csv ``` Filter the entries you expect here, e.g. using addinfo ``` ``` | where Time is in the range you want ``` ] | stats count by Time Value | where count=1 which is adding the rows from the lookup to the end of your found data and then doing the stats count again. If count=1 then it has only come from the lookup. The filtering (where...) will need to work out what time range your search covers. Use the addinfo command to get info_min_time and info_max_time fields which you can then use to filter those values from the lookup you want. ... View more

Consequences... Poor performance of your dashboard Poor performance for other users Excessive usage of an SVC licence if using SVC in Splunk Cloud - potentially causing additional licence costs to the organisation Skipped searches Your application will not be liked by others in your organisation Alerts may not fire and as such you may miss critical security detections the could indicate hackers are attacking your system, or that critical infrastructure is having performance issues, resulting in an outage of your primary web site. These are some, but not all of the consequences. All will depend on what you are using Splunk for, but I hope you get the picture. I've seen one such dashboard such as yours with 60 panels all on auto refresh, all searching the same data independently and that one dashboard, out of 1000 others, was using a significant proportion of the compute cost across the search head cluster.   ... View more

Something like | rex "<<<\s*(?<LogType>[^\s]*)\s*:[^:]*:[^:]*:[^:]*:(?<Class>[^:]*).*REQS REQUID\s*::\s*(?<ReqsRequid>[^:]*).*SUB REQUID::\s*(?<SubRequid>[^:]*).*Application\s*:(?<Application>[^:]*::\s*Org\s*:\s*(?<Org>[^:]*)" ... View more

Your examples are round seconds, but if you have epoch times to search between use the epoch with decimal places where required, so your example (which actually has no millisecond time) could be index=my_app earliest=1710525600.000 latest=1710532800.000 env=production service=my-service   ... View more

eventstats is a way to get stats without losing fields you want to retain, but it is not an efficient command. If you do use eventstats, make sure you use the fields statement before eventstats, as all the data is transferred to the search head before the stats are calculated - you will reduce the data transfer from the indexers. Another efficient way to get stats without losing fields is to do | fields a b c etc... client_ip | stats count values(*) as * by client_ip | where count<10 This will do the aggregations but will retain all the values of the other fields in the returned row for the client ip. This may not be how you want to see the data, but from a performance point of view, if you have large datasets, then eventstats can be very slow, whereas stats will be fast. You can refine this further by doing something like | fields a b c d e f client_ip | stats count values(*) as * by client_ip a b c | eventstats sum(count) as total by client_ip | where total<10 where your split will collect some other fields as well as ip and then you can use eventstats on the much smaller dataset to calculate total count for the IP - this will generally be faster than eventstats at the start. Hope this helps   ... View more

What is your data and what is the visualisation you want to show. If it's a Splunk table, then look at this documentation for how to colour table cells https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/TableFormatsXML Perhaps you can say more about what your data looks like, how many entries you are talking about and how to plan to visualise it.   ... View more