tks too easy 🙂 ... View more

@kristian.kolb - how do I remove this column row1 row2 row3 and just have this: clientip 12.23.34.45 12.13.14.15 12.33.44.55 Success Ratio 87% 79% 82% Total 1243 5564 32331 ... View more

tks, but could not get that to work, it says page not found but is close I feel as it looks like a response from splunk. how do I check if enable_insecure_login = True is actuually working? just as an example, I would have thought urlencoding admin would be admin ? ... View more

tks, I got it to work I think it was more a user error!!! 😞 ... View more

if i pick last 30 days it works for my 1st search source="source1" and 2nd subsearch source="source2" if i understand correctly. then if i pick previous month I want that to work(or be applied) to my 1st search source="source1" and 2nd subsearch source="source2" Maybe you are saying that I have to put earliest=?? and latest=?? inside my 2nd subserch source="source2" ? I could give this a try but how would i write earliest=?? and latest=?? to be the previouse month? Is it earliest=-1m@m and latest=@m ? ... View more

further comment on EDIT3 maybe best to have holdback=1 on both predict functions so the graph lines up ... View more

Apologies if this is too much detail but this is just for my reference.... I have installed splunk on my PC and created this simple dashboard located here: http://localhost:8000/en-GB/app/search/gaugeexample [1] If i click on the url above it will bring me to this url [2], where I put in my un and pw and it works http://localhost:8000/en-GB/account/login?return_to=%2Fen-GB%2Fapp%2Fsearch%2Fgaugeexample [2] *That is fine but what I want now is when I click on the link it automatically does the login for me. * so what I done was put this file web.conf in the local directory(see below) I then tried using a different link 3 http://localhost:8000/en-GB/account/insecurelogin?username=admin&password=admin*return_to=%2Fen-GB%2Fapp%2Fsearch%2Fgaugeexample [3] I get this displayed {"success":false,"offset":0,"count":0,"total":0,"messages":[{"type":"ERROR","time":"2015-06-12T11:38:44","message":"Login failed"}],"data":null} and it is at this url [4] http://localhost:8000/en-GB/account/insecurelogin?username=admin&password=admin*return_to=%2Fen-GB%2Fapp%2Fsearch%2Fgaugeexample [4] Based on what you provided I have tried to get url [3] right above, but I may be slightly off. Can you advise if I am close? **web.conf file put in this directory C:\Program Files\Splunk\etc\system\local # Version 6.2.3 [default] [settings] #ks added this # Toggle the insecure login endpoint # enable_insecure_login = False ## setting it to true as want to be able to access links/dashboards externally enable_insecure_login = True ... View more

@paramagurukarthikeyan see my possible anser above. I am trying to get your advice to work. but unfortunately cannot post here!! ... View more

tks, I think this is exactly what I am looking for. transpose was the only way I could think of at the time. ... View more

@linu1988 how do you filter out the "column names whcih will come in the first row"? ... View more

I have come accross something similar myself ... | stats max(field1) as foo max(field2) as bar max(field3) as la by name | transpose gives me the below : column row 1 row 2 row3 name foo bar la b 1 5 9 c 2 4 8 d 3 3 7 e 4 2 6 f 5 1 5 but I dont want "column row 1 row 2 row3" as my column headers I want " name foo bar la" as my column headers ....| transpose | rename column as name | rename "row 1" as foo | rename "row 2" as bar | rename "row 3" as ls But now I have to work out a way to remove row1 " name foo bar la" after I have renamed the column headers Which will hopefull give me this: name foo bar la b 1 5 9 c 2 4 8 d 3 3 7 e 4 2 6 f 5 1 5 ... View more

sorry but could you elaborate on that more? I have tried reading all that and still do not fully get how it can be done. ... View more

i tried it like this, but the formatting did not work as well <choice value="| strcat subrackNo '-' SlotNo '-' boardType fields | timechart span=1h">short</choice> but this eventuall done it, using single quote and then double quotes inside that <choice value='| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h'>short</choice> ... View more

good to know that these methods exist but might be a bit over complex for me at this stage. ... View more

tks, good spot. ... View more

Interesting how this gives only 1 value in the dropdown of somwthing like, 0,1,2,3 index=core ... | stats values(subrackNo) as subrackNo ... View more

ah thanks the field name goes in here <fieldForLabel>subrackNo</fieldForLabel> <fieldForValue>subrackNo</fieldForValue> I thought it should be the token name. ... View more

index=core ...| stats count by subrackNo this search gives me a 2 column result, subrackNo and count. so when I put this search in the dropdown when the dashboard loads, the dropdown does not fill, under the dropdown it says > Duplicate labels causing conflict For clarification as I may not have been clear: the field that has the values I want to fill the dropdown is called subrackNo and not subrack_No , if that makes a difference. this is why my search in the dropdown should look like index=core ...| stats count by subrackNo I also tried using index=core ...| stats values(subrackNo) to fill the dropdown but it does not fill it. ... View more

easy as that, tks. ... View more