Great! Glad we got it working. I've converted it to an answer. ... View more

Ok, in this case you'll need something like this: <search id="Extra"> <query>index=reports | stats count by reportname</query> <earliest>$time1.earliest$</earliest> <latest>$time1.latest$</latest> <done> <condition match="$job.resultCount$ != 0"> <set token="showResults"></set> </condition> </done> </search> <init> <unset token="showResults"></unset> </init> <option name="count">10</option> <option name="drilldown">none</option> </table> </panel> <panel depends="$showResults$"> <title>Offers</title> <table> <search base="Extra"> <query> | map [ search index=offered reportname="$$reportname$$" | table Offer ] maxsearches=0 | dedup Offer </query> </search> <option name="count">10</option> <option name="refresh.display">progressbar</option> </table> </panel> This conditionally sets a token called "showResults" if the result count from the base search is not zero. If the token is set, then the panel will display. The token defaults to being unset because of the <init> element. ... View more

Glad to help 🙂 ... View more

By the way - when you say that the baselineServer part is always static, do you mean that the DisplayVersion field that you're returning here will always be the same? If so, it would be a good idea to convert the data to a lookup table. Then you can run your search over various hosts and use the related fields to consult the lookup table and return the baselineServer version number. It will be more efficient and clearer. ... View more

Do you want the whole panel hidden, or are you OK with it just saying no results found? If the latter, then just add fill null reportname value="" before the call to map. ... View more

Just to be really explicit, I'll translate this SPL to English: | stats count by src_ip,bytes_out,bytes_in That says: "For every tuple of [src_ip, bytes_in, bytes_out] - keep a running total of the number of times that tuple was seen." If your data looked something like this: src_ip=1.1.1.1 bytes_in=5 bytes_out=10 src_ip=1.1.1.1 bytes_in=50 bytes_out=100 src_ip=2.2.2.2 bytes_in=2 bytes_out=2 src_ip=2.2.2.2 bytes_in=2 bytes_out=2 src_ip=1.1.1.1 bytes_in=5 bytes_out=10 src_ip=1.1.1.1 bytes_in=5 bytes_out=10 src_ip=1.1.1.1 bytes_in=5 bytes_out=10 Here's what you'd get from that query: src_ip=1.1.1.1 bytes_in=5 bytes_out=10 count=4 src_ip=1.1.1.1 bytes_in=50 bytes_out=100 count=1 src_ip=2.2.2.2 bytes_in=2 bytes_out=2 count=2 You could use that to calculate total bandwidth, but it would be less efficient than the method I'm suggesting in the comment below. ... View more

Can you clarify what this part is supposed to do: |rex field=_raw "DisplayName=(?\w.*)$" Are you trying to extract a new field called Name out of the _raw text? The way it's structured now, I don't think it runs. But assuming that part is working fine for you, I think something like this might work: index=main sourcetype="Script:InstalledApps" (host=server1 OR host=baselineServer) DisplayName="*" DisplayVersion="*" | rex field=_raw "DisplayName=(?\w.*)$" | search Name="Microsoft*" | eval baselineServer=if(host="baselineServer", DisplayVersion, NULL), DisplayVersion=if(host="server1", DisplayVersion, NULL) | stats list(DisplayVersion) AS DisplayVersion, list(baselineServer) AS baselineServer BY host Name | fields host Name DisplayVersion baselineServer ... View more

What is your actual goal? This query |top limit=5 bytes_in,bytes_out | sort src_ip reads to me as: "Find the five tuples of [bytes_in,bytes_out] that occur most frequently in my data, and then sort by src_ip." So putting aside the fact that the src_ip field is not propagating through the top command, I just want to make sure that's even matching your expectations. I read this query |top limit=5 bytes_in,bytes_out by src_ip as: "Find the five tuples of [bytes_in,bytes_out] that occur most frequently for each src_ip value in my data" - so I would expect a maximum of five results PER src_ip. Do either of these describe what you actually want? ... View more

Ahh, yes. That's what I thought. Sounds like we were just talking past each other accidentally. 🙂 So to conclude, you can either: 1. Clone the alert in the UI, giving it a new name in the process; or 2. Modify both the savedsearches.conf and local.meta files to reflect the new name ... View more

We also saw issues like this and changed our searches that were running every 5 minutes to not look at the _time field but instead at the _indextime field by creating a macro called alert_time that takes one parameter($minutes$) and is defined as: _index_earliest=-$minutes$m _index_latest=now , and then we set the searches to look back over maybe the previous hour but specify alert_time(5) inline in the search. This worked really well for us until we moved to a multisite approach with two indexer clusters that replicate between the sites. We have subsequently needed to delay our searches by creating a macro called alert_time_shifted that is defined as: _index_earliest=-10m _index_latest=-5m . You can play around with the times here and see what works well for your environment to avoid hitting the strange 2am-3am delays. ... View more

Yes, it will definitely be slow. I strongly urge you to change your approach to direct subsearch that I offered in the XML code sample above! ... View more

I don't quite understand your description. It sounds like you want D=C if 0<B<4 and A=1 . But this is true in both of the following lines: A=1,B=2,C=3 A=1,B=1,C=5 So I don't understand how you've determined that D=5 and not D=3. Can you explain? ... View more

Looking at this again - there's definitely a logic error that will arise at line 9, because the first_of_day and last_of_day won't pass through the stats command. But I'm not totally clear on the purpose of that line, so I can't quite figure out how to fix it. ... View more

The way I'd approach this is to add some calculations in the middle of the search to find the timestamp of the first event per day, per endpoint and also the last event per day, per endpoint. When calculating the active_time and inactive_time , I'd check to see if the current event was the first event of the day. If it is, then the calculation of active/inactive time will be _time-relative_time(_time, "@d") , and if it's the last event of the day, then the calculation of active/inactive time will be relative_time(_time, "+1d@d")-_time . So I think it would wind up like this: `urlendpoint` | search endpoint=* | eval Brand="xyz" | eval status=case(like(elb_status_code,"2%") OR like(elb_status_code,"3%") OR like(elb_status_code, "505") OR like(elb_status_code, "510") OR like(elb_status_code, "511"), "active", like(elb_status_code,"4%") OR like(elb_status_code,"500"), "inactive") | reverse | streamstats current=f last(_time) AS last_time last(status) AS last_status by endpoint | bin span=1d _time as day | eventstats earliest(_time) AS first_of_day latest(_time) AS last_of_day BY day | stats values(last_time) AS last_time values(last_status) AS last_status values(status) AS status by endpoint, _time Brand | eval active_time=case(last_status="active" AND _time=first_of_day, _time-relative_time(_time, "@d"), last_status="active" AND _time=last_of_day, _time-relative_time(_time, "@d"), last_status="active", _time-last_time) | eval inactive_time=case(last_status="inactive" AND _time=first_of_day, _time-relative_time(_time, "@d"), last_status="inactive" AND _time=last_of_day, _time-relative_time(_time, "@d"), last_status="inactive", _time-last_time) | eval day = strftime(_time, "%d") | eval month=strftime(_time, "%m") | eval Date = strftime(_time, "%d/%m/%y") | stats sum(active_time) AS active by day month Date Brand endpoint | eval active=active/(3600) | sort - month day | fields - month | fillnull value=0 I don't have a good dataset to test this on, so I'm happy to iterate if this gets you part of the way but has issues. 🙂 Hopefully the description at the top is clear enough to communicate the intent. ... View more

I understand that you'll need the <unset> logic to make the dashboard work as intended. This is just for troubleshooting. So if you remove all of the unset tags, then the page loads with the final panel hidden, and when you click to display it - it appears. Right? If so, that's a great first place to be. Now, try adding back in each unset token separately - the goal is to see if any single one causes the flicker. So first add the very first unset, then remove it and add the second, and then remove that and add the third. I suspect that something is causing one to update automatically, and hopefully not all three! Can you test each one and post an update here? It will likely help us isolate the part of the code that is causing the problem. ... View more

Good to know, thanks! I'll try to remember that. ... View more

Don't you also need to edit the related metadata file? I'm often nervous that there's a thread from one conf file to another that I'm failing to keep in sync when I go that route. ... View more

Nice correction, thanks! ... View more

Yeah, it's not always easy to wrap your head around the options in Splunk. 🙂 Once you progress this to something more than a toy demo (like - you have a series of Sid values you are looking up, some of which are found by the ldapfilter command and some of which are not), you'll probably need to add a transforming command after the subsearch to filter duplicates and such. ... View more