I have the following dropdown menu: <fieldset autoRun="true" submitButton="false"> <input type="dropdown" token="select_wday"> <label>Select Day:</label> <choice value="Mon">Mon</choice> <choice value="Tue">Tue</choice> <choice value="Wed">Wed</choice> <choice value="Thu">Thu</choice> <choice value="Fri">Fri</choice> <choice value="Sat">Sat</choice> <choice value="Sun">Sun</choice> <default>Fri</default> </input> </fieldset> The default in the drop-down above would be Friday. Is there a way I could control it that if the user visited the dashboard on a Wednesday the would Wednesday as the value in the drop-down menu? I am thinking something liket the below which I have used to populate a checkbox, but I have not used it to set the default. <populatingSearch fieldForValue="userLabel" fieldForLabel="userLabel" earliest="-24h" latest="now"> <![CDATA[ <search goes here that would give the current day of the week> ]]> </populatingSearch> ... View more

I am trying to just show the devices that are X and Y and the devices that are X and have adj that meet this filter string1 and the devices that are Y and have adj that meet this filter string2 and string3 So basically or in other words I am trying to find 2 devices where i want to filter in some of the adj on each device. Then I wnat to do a timechart after this, I am just doing stats first to ensure I am looking at the correct filtered options. This is my search: index=snmp_stats sourcetype=snmp_collector_log device=X AND adj="*string1*" OR device=Y AND adj="*string2" OR adj="*string3*" OR kpi1 OR kpi2 OR kpi3 OR kpi4 | stats values(adj) by device And this give me this table: (e.g. string1 would be any adj that met that filter - same for string2 and string3 below) device values(adj) X *string1* *string1* *string1* ... This is what I want the below table: device values(adj) X *string1* *string1* *string1* ... Y *string2* *string3* ... NOTE: I would like to provide sample data but I don't think I can in this case, but I may look into this. Other Q's I am looking at https://answers.splunk.com/answers/240884/how-to-properly-use-and-or-in-search.html https://answers.splunk.com/answers/120097/query-on-using-and-or.html ... View more

This is my sample search and corresponding output: | makeresults | eval data = " 1 2017-12 A 155749 131033 84.1; 2 2017-12 B 24869 23627 95; 3 2017-12 C 117618 117185 99.6; " | makemv delim=";" data | mvexpand data | rex field=data "(?<serial>\d)\s+(?<date>\d+-\d+)\s+(?<type>\w)\s+(?<attempts>\d+)\s+(?<successfullAttempts>\d+)\s+(?<sr>\d+)" | fields + date serial type attempts successfullAttempts sr | rename date as _time | search serial=* | eval Q=attempts | eval Q=if(Q==24869,"",Q) | eval Q=if(Q==117618,"",Q) OUTPUT _time serial type attempts successfullAttempts sr Q 1 2017-12 1 A 155749 131033 84 155749 2 2017-12 2 B 24869 23627 95 3 2017-12 3 C 117618 117185 99 I want to be able to get the value of Q(e.g. 155749 ) and create a new field called W but all the values of W would be 155749. Basically, fill out all the values in W with one value and that value being 155749, the max of Q in this case. Sample Output of what I would like _time serial type attempts successfullAttempts sr Q W 1 2017-12 1 A 155749 131033 84 155749 155749 2 2017-12 2 B 24869 23627 95 155749 3 2017-12 3 C 117618 117185 99 155749 I was thinking of doing ... | eval W=max(Q) but that won't work but hopefully helps understand what I am trying to do. maybe I need to use streamstats or other. I couldn't quite get it. Maybe I need a for loop? advice appreciated. ... View more

How can I iterate through all the column names and replace space with underscore and replace : (colon space) with an underscore? MY Search: | makeresults | eval data = " 1 2017-12 A 155749 131033 84.1; 2 2017-12 B 24869 23627 95; 3 2017-12 C 117618 117185 99.6" | makemv delim=";" data | mvexpand data | rex field=data "(?<serial>\d)\s+(?<date>\d+-\d+)\s+(?<type>\w)\s+(?<attempts>\d+)\s+(?<successfullAttempts>\d+)\s+(?<sr>\d+)" | fields + date serial type attempts successfullAttempts sr | rename date as _time | search serial=* | eval "success full: Attempts"=5 | eval "success full: Attempts2"=6 My OUTPUT: _time serial type attempts successfullAttempts sr success full: Attempts success full: Attempts2 1 2017-12 1 A 155749 131033 84 5 6 2 2017-12 2 B 24869 23627 95 5 6 3 2017-12 3 C 117618 117185 99 5 6 Adding this to my search gives me what I want, but I am looking at being able to iterate as opposed to do it verbose. | rename "success full: Attempts" as success_full_Attempts | rename "success full: Attempts2" as success_full_Attempts2 related Q here ... View more

With multiple appendpipes how do I specify the number of rows above I want to apply it to? | makeresults | eval data = " 1 2017-12 A 155749 131033 84.1; 2 2017-12 B 24869 23627 95; 3 2017-12 C 117618 117185 99.6; " | makemv delim=";" data | mvexpand data | rex field=data "(?<serial>\d)\s+(?<date>\d+-\d+)\s+(?<type>\w)\s+(?<attempts>\d+)\s+(?<successfullAttempts>\d+)\s+(?<sr>\d+)" | fields + date serial type attempts successfullAttempts sr | rename date as _time | search serial=* | appendpipe [stats avg(sr) as sr | eval sr=round(sr,1) | eval successfullAttempts="average sr"] | appendpipe [stats sum(sr) as sr | eval sr=round(sr,1) | eval successfullAttempts="sum sr"] | appendpipe [stats sum(sr) as sr | eval sr=round(sr-92.7-370.7,1) | eval successfullAttempts="This is what I want - just the first 3 values of sr 84,95,and 99"] OUTPUT looks like this: I have lined up the sr column as that is the column of interest(seperate q does anyone know how best to format a table here?) How would I get a value of 278 in row 6 if I did not know the values of row 4 and 5?? _time serial type attempts successfullAttempts sr 1 2017-12 1 A 155749 131033 84 2 2017-12 2 B 24869 23627 95 3 2017-12 3 C 117618 117185 99 4 average sr 92.7 5 sum sr 370.7 6 This is what I want - just the first 3 values of sr 84,95,and99 278.0 ... View more