@vishwa I suspect your fields are not actually coming out as Model1 etc, i.e. the may have some strange characters in there. You can either try to figure out what the Types field values are before you do the timechart by doing something like |tstats count where index=xxx host=host1 sourcetype=newsourcetype by PREFIX(type:) _time |rename type: as Types | head 10 | eval types=":".Types.":", len=len(Types) | table Types types len to see if there are any odd characters or the len does not come out as 8. The simples thing to do though is to not care about the names and just add 'addtotals', i.e. |tstats count where index=xxx host=host1 sourcetype=newsourcetype by PREFIX(type:) _time | rename type: as Types | timechart span=1d values(count) by Types | addtotals which will add up all the numeric fields and create a new field called Total ... View more

@ea-2023 If your JSON field 3 has one or more of those field attributes, then after the spath you can do | foreach "Attribute Name", "Resource Name", and "ID" [ | eval type=mvappend(if(isnotnull('<<FIELD>>'), '<<FIELD>>', type) ] which will cycle through the 3 desired fields and for any of the 3 that exist, will make a multi-value field called type with any that do exist.   ... View more

Can you share your SPL and data. This example works | makeresults | eval line="SOMEALPHA9876NUMERIC_ETC_RFG: play this message: announcement/12345678" | rex field=line "(?<ID>\w+)_ETC_RFG:.*/(?<NUM>\d+)"   ... View more

@EPitch I don't believe there is a break on condition function to abort the search, but what you could do, is to turn on sampling at an appropriately large ratio so you run the search on a subset of the data. This will be quicker - if you get >10 then you don't need to re-run - but if you get <10, you will need to re-run at a lower sampling ratio. I'm not sure this solves the problem in that if you don't expect or want >10 then you will always end up running the search with 1:1 ratio. The other alternative is to craft your search criteria to use the TERM() directive if possible and if these data fields can be reduced to TERM elements then you can even use tstats. See this .conf presentation  https://conf.splunk.com/files/2020/slides/PLA1089C.pdf So maybe you can do  index=blah sourcetype=blah (TERM(name=Name1) TERM(ip=IP1) TERM(id=id1)) OR... but you will have to know your data well to know if the terms exist as real terms in the data and you need to understand major and minor breakers in the data. If all the search criteria can be converted to TERM then you could do | tstats count where index=blah sourcetype=blah (TERM(name=Name1) TERM(ip=IP1) TERM(id=id1)) OR... by PREFIX(name=) PREFIX(ip=) PREFIX(id=) | rename *= as * ... View more

@EPitch  Do you mean if the sum of count is > 10 or if the number of distinct name/ip/id combinations is more than 10? If the former, then if you put a  | head 11 after your search, I believe it will speed up the search - although it will probably process the query data fully, it will only retain max 11 results, so then if you have stats count and the count is 11 then you have more than 10.   ... View more

@interrobang ok, got it The easiest thing to do is to add the following to your dropdown search after the dedup Servername | appendpipe [ stats values(Servername) as Servername | format | rename search as Servername | eval name="All" | eval order=0 ] | sort order Servername | fields - order what this simply does is to add a new row at the end with all the server names and creates a new name field. This will either have the Servername or "All". The purpose of the order is to sort the All to the top and then the servers in sorted order. Set the fieldForValue to be Servername and the fieldForLabel to be name. Then if you select All, it will have the Servername=A OR ..  See this example to see how it's working | makeresults | fields - _time | eval Servername=split("ABCD","") | mvexpand Servername | eval name=Servername | eval Servername="Servername".Servername | appendpipe [ stats values(Servername) as Servername | format | rename search as Servername | eval name="All" | eval order=0 ] | sort order Servername | fields - order   ... View more

You do not replace data in Splunk - if you ingest it to an index it remains there until it expires. It's a time based storage so every piece of data gets a timestamp that reflects the event creation in some way. So, every day when you ingest those 200 rows, they will, if setup to do so, have a date stamp of the day they are ingested.  If you only ever search a single day's data you will get the latest data. If you make a very short retention period on the index, the data will age out and disappear after that time. The alternative is to make those rows a lookup, in which case the data IS replaced, as you can overwrite the lookup, however, creating a lookup and ingesting to an index is not the same process. What is your use case for this data?   ... View more

Firstly I would suggest your search for the second dropdown change slightly to index="syslogs" sourcetype="logs:servers:inventory" AppID=$AppID|s$ | eval Servername = host."\\".InstanceName | fields Servername | dedup Servername | sort Servername that will be slightly more efficient. You should add the wildcard option in the second dropdown, but in your panel searches you also need to include the  AppID=$AppID|s$ as part of that search, so the * for ServerName will also be restricted to those in your chosen AppID ... View more

After a timechart split by a field you cannot use the field name after the timechart as it no longer exists. The field names are the values of your 'series' field. You need to use the foreach method in your initial post The reason why index=aws returns nothing is that the data you are searching for does not exist in that index. What makes you think it did? It is in the _internal index, so you should definitely include that Change your earliest/latest settings to define the time period you want to search for, or use the time picker instead and remove the earliest and latest totally.   ... View more

You can use the licence ingest log data for that also index=_internal source=/opt/splunk/var/log/splunk/license_usage.log idx=* type=Usage | timechart span=1d sum(b) as bytes by idx | foreach * [ eval <<FIELD>>=round(<<FIELD>> / 1024 / 1024, 3) ] Round/Divide as needed to get the appropriate size unit ... View more

Take a look at Ingest Actions   ... View more

That's exactly what the subsearch will do. The output of a subsearch is to make <field>=<value> OR <field>=<value>... where the results of the subsearch are in a table with field name 'field'. You can see the output of the subsearch just by running the search manually as a normal search and adding  | format to the end of the search, which is implicit in the subsearch ... View more

I would suggest not using mvexpand, as in your example search - in your example you will triple the raw events. Can you provide a sample of the inputs you want to be able to select DS makes a multiselect token= a,b,c so you can use this logic in your search that wants to use the token index=your_index [ | makeresults | fields - _time | eval <your_field_name>=split("$token$", ",") | mvexpand <your_field_name> ] How were you using prefix/suffix/delim in your old dashboard?   ... View more

https://advisory.splunk.com/advisories/SVD-2023-1104 ... View more

https://docs.splunk.com/Documentation/Splunk/9.1.1/Viz/tokens#Token_filters ... View more

It's not clear if your two datasets are in the same event or in different events. Generally you can use mvmap to compare multivalue fields in the same event for unique/missing, see this example. | makeresults | eval data1="{ \"iphone\": { \"price\" : \"50\", \"review\" : \"Good\" }, \"desktop\": { \"price\" : \"80\", \"review\" : \"OK\" }, \"laptop\": { \"price\" : \"90\", \"review\" : \"OK\" } }", data2="{ \"tv\": { \"price\" : \"50\", \"review\" : \"Good\" }, \"desktop\": { \"price\" : \"60\", \"review\" : \"OK\" } }" | eval p_name_1=json_array_to_mv(json_keys(data1)) | eval p_name_2=json_array_to_mv(json_keys(data2)) | eval p_unique = mvmap(p_name_1, if(isnull(mvfind(p_name_2, "^".p_name_1."$")), p_name_1, null())) | eval p_missing = mvmap(p_name_2, if(isnull(mvfind(p_name_1, "^".p_name_2."$")), p_name_2, null())) | table data1 data2 p_unique p_missing   ... View more

Because each of those 2 fields has 3 values, you are effectively doing a 3x3 matrics stats, hence the results. You will need to do something like this to join each of the policy bits of info together | eval Policy=mvzip('Policies{}.displayName','Policies{}.result', "##") | stats count by Policy  and then finish it with | eval Policy=split(Policy, "##") | eval displayName=mvindex(Policy, 0), result=mvindex(Policy, 1) | table displayName result count ... View more

Ah, ok - hence my confusion - I had to test whether that uses the definition or the csv and it appears to use the definition. I've always used the abstraction to hide the underlying name of the CSV, as that can sometimes change or be substituted. ... View more

@gcusello  I think you missed my point - in your example you are using the CSV to test, not the lookup definition, so the test is not the same as the DM. Your test should use the lookup definition to make sure it also works. ... View more

I see you are already using the Plotly boxplot charts. I can't confirm, but it seems it may be something inside the Plotly code itself - that viz is made by Splunk Works, but I'm not sure who looks after that. Can you check in your browser develop tools to see if there is anything reported in the Console log?   ... View more

@PickleRick  One thing, no 2 really, or actually 3, or maybe 4 1. Item 1 2. I thought of this half way though my reply 3. I am using an editor 4. I can correct mistakes 5. Or can I 😁   ... View more

If you have little knowledge, then an easy way to learn it to deconstruct the search by first running the first line, understanding what you see then adding line 2, run again, then line 3, again and so on. When you have only raw data results returned, you can get a better visual output of what you have by just adding the following at the end of each search as you run it | table _time * which will give you rows of data being returned, so run  source=WinEventLog:Security EventCode=4624 OR (EventCode=4776 Keywords="Audit Success") | table _time * and you will see a ton of columns source=WinEventLog:Security EventCode=4624 OR (EventCode=4776 Keywords="Audit Success") | eval Account = mvindex(Account_Name, 1) | table _time * You will see a new column called Account which was derived from the second value of Account_Name. Keep going and figure out what each line does to your data. Use the search reference for each command to work out the command https://docs.splunk.com/Documentation/Splunk/9.1.2/SearchReference/Eval     ... View more

You cannot pass things into the subsearch in Splunk. Subsearches run before the outer search, so the appendcols subsearch has no knowledge of Critical. Maybe you can share your saved search and more detail of the primary search, as there is probably a way to craft it that can work - it looks like you're using the saved search as some kind of lookup. ... View more

spath works nicely, but the one liner only works if ALL the data is made up of codepoints only ... View more