@niketnilay, thanks but is a bit over my head. Where do I put this in the xml? Does this replace my own? I am not familiar with the HTML side of Splunk. What does the 'search when changed' actually do, I have tried true and false but don't notice the difference ... View more

@niketnilay WlzServicesLog <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="text" token="field2" searchWhenChanged="true"> <label>Zoeken</label> <prefix>field3</prefix> </input> <panel> <title>test</title> <event> <search> <query>index= xp* </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="list.drilldown">none</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">0</option> <option name="table.drilldown">all</option> <option name="table.sortDirection">asc</option> <option name="table.wrap">1</option> <option name="type">list</option> </event> </panel> <panel depends="$field2$">&gt;<title>test variabel</title> <table> <search> <query>index=XPO $field2$ |sort -Timestamp|table tijd severity message priority machine</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <drilldown> <link target="_blank">search?q=index=XPO $field2$* |sort -Timestamp|table tijd severity message priority machine&amp;earliest=-24h@h&amp;latest=now</link> </drilldown> </table> </panel> ... View more

but a panel and a pre-built panel are also based on a search?? How would it otherwise get the results? Strange thing is that besides a report and a pre-built panel you also reuse a (normal) panel, by 'clone from dashboard' . It seems to me that the use of report has really no benefits. ... View more

maybe I am just confused, but it looks like reports-panel-prebuilt panels are more or less the same ... View more

Hi niketnilay , I cant see the benefits of using a report over a dashboardpanel... Is it true that i cant see the difference between a report and a panel when I view them both in a dashboard only when I choose for 'edit'? "A report in Splunk is essentially a single Search query that runs to produce a single visualization" , isn't this not also the case for a panel? ... View more

Thanks, but this is also possible with a panel? (clone from dashboard) ... View more

Aha, thanks. This clearifies the 'modulair division' . But also very usefull because I did not know of the accum command, gentimes. 😉 Also I did not know it was possible to 'insert' values (Dividend in your example). All in all, I learned a lot again. ... View more

Great idea. Thanks. I am trying to understand, what if the count is e.g. 4? Then Total(4) divided by 2 isn't 0. Or do i not understand the way "%2==0" works? ... View more

Great, it works. Ony thing is that 'list' has a maximum. ... View more

If I use: | eval epochCreationDate=strptime('message.CreationDate',"%Y-%m-%dT%H:%M:%S.%N%z") | stats list(message.CreationDate) as CreationDate |stats values(message.location) as Location values(message.RequestId) as RequestId values(message.PreviousRequestId) as PreviousRequestId range(epochCreationDate) as Duration by message.MessageId I get 'no results' ... View more

Hi, this gives me duration but ik still get the results as i got them earlier (like in the screenshot) i still miss both the creationdates ... View more

Unfortunately this is also not giving the wanted results. It seems splunk gives only the unique values, ... View more

Still struggling, i need to group by message.BusinessId. I have got: | stats values(message.MessageId) as MessageId values(message.location) as location count by message.BusinessId |table * MessageId count location message.BusinessId 143d7685-120e 5 Fetcha 4445646545465 2c659a59-6317 Fetchb 5c3d7f96-ed84 Fetchc 66ccf168-aa82 823d50a8-9997- What I want is something like this: MessageId count location message.BusinessId CreationDate 143d7685-120e 5 Fetcha 4445646545465 Date1 2c659a59-6317 Fetcha Date2 5c3d7f96-ed84 Fetchb Date3 66ccf168-aa82 Fetchb Date4 823d50a8-9997- Fetchc Date5 How can I create this? I've tried also withe the list command but then I run into maximum event ... View more

Thank you very much for your help, Fortunately the messageid will be unique for each set in the future. I can use that field. nevertheless, your input was very usefull for me. ... View more

Hai Niketnilay, i noticed that also last night. I requested the developer to ensure this Id is always unique for the set. Thank you (again) for the help ... View more

No, I am not very clear I am afraid. Sorry for that. In my example both the question and the answer are different events. Main difference is that the question does not contain the field 'PreviousRequestId' . I want to check that for every question there is a answer received ... View more

The events can be like this (question and answer) Initial request (question) { [-] date: 2017-11-21T10:41:10,599 level: INFO logger: XYX message: { [-] BusinessId: 1360158 BusinessObject: PP CreationDate: 2017-11-21T10:41:10.599+01:00 MessageId: 1 Origin: test RequestId: 01a7bf89-8fff-473e-a713-5f006014b087 component: CKF location: FFBCD } thread: [dom_mst].domeinHttpsListener.worker.168 } Answer: { [-] date: 2017-11-21T10:41:10,875 level: INFO logger: XYX message: { [-] BusinessId: 1360158 BusinessObject: PP CreationDate: 2017-11-21T10:41:10.599+01:00 MessageId: 1 Origin: test PreviousRequestId: 01a7bf89-8fff-473e-a713-5f006014b087 RequestId: 428aa3b9-11d7-4692-841b-388cf1914ef0 component: CF location:FFBCA } thread: [dom_mst].domeinHttpsListener.worker.168 } The fields are handling te values correctly. Anyway thank you for your contribution , I am gonna look further. ... View more

I dont really understand what you mean by 'correct' .The fields exists and there events where the value in 'PreviousRequestId' is the same as 'RequestId' ... View more

No, that does not work ... View more

Initial request (question) { [-] date: 2017-11-21T10:41:10,599 level: INFO logger: XYX message: { [-] BusinessId: 1360158 BusinessObject: PP CreationDate: 2017-11-21T10:41:10.599+01:00 MessageId: 1 Origin: test RequestId: 01a7bf89-8fff-473e-a713-5f006014b087 component: CKF location: FFBCD } thread: [dom_mst].domeinHttpsListener.worker.168 } Answer: { [-] date: 2017-11-21T10:41:10,875 level: INFO logger: XYX message: { [-] BusinessId: 1360158 BusinessObject: PP CreationDate: 2017-11-21T10:41:10.599+01:00 MessageId: 1 Origin: test PreviousRequestId: 01a7bf89-8fff-473e-a713-5f006014b087 RequestId: 428aa3b9-11d7-4692-841b-388cf1914ef0 component: CF location:FFBCA } thread: [dom_mst].domeinHttpsListener.worker.168 } ... View more