hi all i have created the view contains the dropdown for index and if i select the index i will get all the sources in that index like below then if i select the any source i takes me to the search app as here the source contains only one single backslash ..but i need double back slash in my source This is the rough piece of code i have used ..to get the double slash in my source please tel help at what place i have to modify the code .. Now we take a bunch of leaps ahead and put it all together. We put in a Sorter module, a Paginator module. We put in a HiddenSearch+SimpleResultsHeader pattern to give us 'Sources (208)'. Then we duplicate the same pattern for both Sourcetypes and Hosts. which index index_setting | eventcount summarize=false index=* | search index!="splunklogger" index!="summary" index!="history" | sort -index True main index index <module name="ConvertToIntention"> <param name="settingToConvert">index_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="index"> <param name="fillOnEmpty">True</param> <param name="prefix">index=</param> <param name="value">$target$</param> </param> </param> </param> <module name="HiddenSearch"> <param name="search">| metadata type=sources $index$</param> <module name="SimpleResultsHeader" layoutPanel="panel_row4_col1_grp1"> <param name="entityName">results</param> <param name="headerFormat">Sources (%(count)s)</param> </module> </module> <module name="SearchLinkLister"> <param name="settingToCreate">list1</param> <param name="search">| metadata type=sources $index$</param> param name="applyOuterIntentionsToInternalSearch">True</param> <param name="settingToCreate">list1</param> <param name="searchFieldsToDisplay"> <list> <param name="label">source</param> <param name="value">source</param> </list> <list> <param name="label">totalCount</param> <param name="labelFormat">number</param> </list> </param> <module name="HiddenSearch"> <param name="search"> source=$pub$| transaction TaskBP startswith=START endswith=Succeeded </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> <module name="ConvertToIntention"> <param name="settingToConvert">list1</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="pub"> <param name="value">$target$</param> </param> </param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> thanks in advance poornima ... View more

Hi all, i created the the trend chart for my Task Manager log files ...some of the Task are showed in legend and remaining Tasks are grouped as OTHER ,.. How it groups the Task and put it in OTHER or it has any criteria so that it groups the Task Plz clarify me Thanks poornima ... View more