@sameena822 I couldn't get your query to work for several reasons. However, you're stating you want to have the endpoint, the count of that endpoint, and to do it by clientID. Assuming you can get your regular expressions in order, you are looking for a stats command: | stats count(Endpoint) AS Count BY clientID Endpoint I think what you were missing, was that you can do more than one field after the BY. ... View more

@ansif If this helped you, please accept the answer. ... View more

@sameena822 Can you add a log sample (fuzz any sensitive info)? That way we can see... - what your logs look like, in case there's a need for a regular expression to get the fields you need, beyond what you posted - what you mean by dynamic, because this sounds ambiguous - what a single "event" is, in order to get a count ... View more

@giorgiovolpini Please show the XML involved with both panels. ... View more

Check out these Splunk answers, which sound like one of them would give you the tools to address this question: https://answers.splunk.com/answers/496890/how-to-use-an-input-typebutton-to-reset-a-token-in.html https://answers.splunk.com/answers/149649/clean-all-filter-inputs-with-a-button.html ... View more

Last line in your search is limiting your fields, which, silly me, I didn't include. Your last line might be: | fields _time,sla10,mythreshold ... View more

Something like this (sorry for the multiple edits - there's no preview of comments in Splunk Answers): index=rl_ivr avg_speed_answer=* | eval nn=tonumber(replace(replace(avg_speed_answer,"\.",""),",",".")) | eval media_giorno = call_offered * nn | eval mythreshold="4" | timechart span=3mon first(mythreshold) sum(call_offered) as total_call sum(media_giorno) as total_avg_speed_answer | eval row_average=(total_call * total_avg_speed_answer) | eval sla10 = total_avg_speed_answer / total_call | eval sla10=round(sla10,2) | rangemap field=sla10 red=6-100 default=green | fields _time,sla10 ... View more

@gballanti I don't know if that's possible for #1. I would go with a separate panel with a status indicator. For #2, set your threshold in an eval, | eval mythreshold="4" This will appear as a line if you add this to your timechart first(mythreshold) It's not a bold line yet, but you could color it red or black, if you wanted. ... View more

I do not see the comments available at all. However, I can build a JQL query that searches for a keyword in a comment, Example: | jirarest jqlsearch "comment ~ tano" and then retrieve the results into Splunk, but I am not able to see the comment itself. ... View more

Maybe don't control it in your query, but control it in the textfield/form of your dashboard and set a default value of "all" on the formfield. If your dashboard text field passes nothing in, and the user loads the dashboard (or presses submit - however you have it set up), then they receive all the widgets. If you type something into the form field, then you get that. This means you already figured out the code you need for your query. where isNotNull(Type) AND "$targetWidget$" IN(Widgets)) | sort -_time ... View more

Are you changing the values if there's an error? Because you could end your search with an eval if errors >0, events=errors, which could turn it all red (let's say errors is red and non-errors is green). But then your green wouldn't show at all. Yyou probably wouldn't want to do that though. You could turn the background white or red based on an eval for errors and adjusting the CSS. The easiest route might be to add a status indicator panel next to it, showing only the icon, and it evaluates if errors >0. ... View more

Sort of. When you create a tag, you can create multiple tags in the same step by separating them with a comma. Your list of tags could be as creative as you want. i.e. webservers,webserverslinux,webserverslinuxralph For more information about how this would work, please see this Splunk Education video about Using Tags: https://www.splunk.com/view/SP-CAAAGYJ ... View more

Also, @damucka make sure you accept the answer. ... View more

It would be best if you let each question stand alone, as well as state what you tried. However, try this: https://regex101.com/r/xPYiLc/1 ... View more

Provide your users with bookmarklets, which allow them - with a button click from the browser bookmark bar, to change the mode: Change to Light Mode javascript:void((function(){var loc = location.href; if (loc.indexOf('theme') >= 0) return; loc.indexOf("?") < 0 ? (location.href = loc+"?&theme=light") : (location.href = loc+"&theme=light");})()); Change to Dark Mode javascript:void((function(){var loc = location.href; if (loc.indexOf('theme') >= 0) return; loc.indexOf("?") < 0 ? (location.href = loc+"?&theme=dark") : (location.href = loc+"&theme=dark");})()); I can't make these hyperlink bookmarklets here in Splunk Answers, so you would need to provide it to your users, rather than point them to this question. If you or your users aren't familiar with bookmarklets, they click and drag the bookmark link to their bookmark bar. Then click it when they want it to perform something. More details here: https://en.wikipedia.org/wiki/Bookmarklet ... View more

Appreciate the engagement. Thanks @ChrisG. I'll wait and see. ... View more

@sanjarmatin Your question doesn't match the details you provided. You say fetch, but provide POST. You say the curl authenticated command works, but not the token authenticated command. The commands listed are not the same commands. Please edit your question and provide more details to say what the goal is, what was tried, and where you think the problem is. Also, what version of Splunk are you on? Is this on-premise or cloud? Things to look for: - Make sure you are comparing the exact same endpoints (note: your two commands are not the same endpoint) - To the best of my knowledge, the authentication to the endpoints shouldn't matter - unless your token is valid and not expired. Check for that. - check your commands for -X GET and -X POST and other flags where appropriate. ... View more

If it was possible, I'm guessing you would need to edit files which would be overwritten when your installation is updated. This would not be ideal. Instead, I suggest using a change in the Navigation Menu, which would persist after an update. However, that also may not be ideal. Check this answer to see what I'm talking about: https://answers.splunk.com/answers/657095/where-is-my-app-navigation-bar-color-in-splunk-71.html ... View more

@zayra Here's something that may solve your problem. Starting with this (it works but hides the number), as percentages probably won't help - based on resolution of the screen. Here's a percentage. #panel5 { width:3% !important; } div[id="singlevalue"] { width:3% !important; } Try using an exact px size for the number. This is my proposed solution: #panel5 { width:3% !important; } div[id="singlevalue"] { width:65px !important; } If you want to move the panel body - it would impact all the panels in the dashboard, so probably not what you want (although it works): #panel5 { width:3% !important; } .panel-body { width:65px !important; } I think at this point you have enough to work with. Let me know if this solves your problem. ... View more

You mentioned an image, but I don't see it. Could you attach it? Or if you can't, put it up on imgur or where ever, and put a link here? ... View more

Seems possible. Please post the code you've tried and what version of Splunk (things change from the 6.x to the 7.x series). ... View more

This question is a few year old, but here's the latest answer in case someone else needs it... If your Windows 10 build is 17063 or later, you have curl.exe built into Windows. Source: https://techcommunity.microsoft.com/t5/Containers/Tar-and-Curl-Come-to-Windows/ba-p/382409 How to check your build? Press the Windows key and the r key at the same time, sometimes noted as WIN+R, to open the Run dialog box. Type winver in the run box and press enter. How to use curl on Windows? Call curl.exe and use parameters Just like curl on Linux or Mac. So your line #1 becomes: curl.exe -k https://10.19.16.101:8088/services/collector/event -H "Authorization: Splunk 982D05B0-8603-4311-A1AF-32462BA47C9F" -d "{\"event\":\"Breakfast Order\"} {\"event\":{\"coffee\":\"double cream double sugar\",\"muffin\":\"blueberry\",\"juice\":\"none\"}}" ... View more

Token expired? Try getting more information from your error. Look here: https://stackoverflow.com/questions/38419325/catching-full-exception-message ... View more

That's Buttercup the pony. Buttercup is a recurring theme in Splunk stuff. I can reproduce what you saw. A 404 error is produced when it should be a 403 for permissions. Even the screen reads in the top left corner (404 error). I don't know a current workaround. To me, this is a bug ... View more