@Allampally Instead of screenshot.. Can you kindly post log sample here. ... View more

@ renjujacob88 Please take a look into previous answers for the same issue. I believe it will help you. how long is your query running. https://answers.splunk.com/answers/107674/unknown-sid-error-when-doing-multiple-searches.html https://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-text-unknown-sid-code-none-type-fatal-when-searching-in-splunk-web-and-no-results.html Thanks, Shankar ... View more

@macadminrohit Below mentioned code is a sample one .. You can replace with your own lookup name in the place of (lookupname ). If you want to get any field from lookup file place in after the OUTPUT command. then simple stats and where clause to get the count.. Once you get the count from UI itself you can set the coloring .. index=main sourcetype="Perfmon:*" | lookup lookupname host OUTPUT hostType | where isnotnull(hostType) | stats count as Events_count by host,hostType ... View more

@ vrathore2016 As your data set have two time value. Splunk consider it as two events. Following are my suggestion .. Give a try. 1.While uploading data into splunk you will see a option called Timestamp below setting up source type. In that Timestamp you will have a option called Lookahead. Try to set the value over here like 30 or 40 based on your timestamp data volume.. 2. set up the props.conf as mentioned below .. TIME_PREFIX= \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2.\d{3} Give a try .... ... View more

@ willadams So your saying, by adding the below code your query is not working. If that is the scenario give a try like this. I'm not sure it will work, but this is my suggestion.. "destination network"=external NOT(action=blocked) "destination network" --> I believe this is a value. external --> I Hope this is a field try this Index=*** "destination network"=external NOT action IN("blocked") If "destination network" is a filed then try this Index=*** | rename "destination network" as destination_network destination_network=external NOT action IN("blocked") ... View more

@bollam Below one is a test query i have provided. What you need to do is .. Just assign the calculated field mytime to the _time. example | eval _time = mytime . Then you will get your own time field value in the timechart. | makeresults | eval mytrimexaxis =mvappend("1531981800","1531982400","1531982700","1531983000","1531983600") | eval mytime=strftime(mytrimexaxis, "%Y-%m-%d %H:%M:%S") | eval cpu_usedyaxis =mvappend("25","40","30","55","70") | eval _time = mytime | mvexpand mytrimexaxis | mvexpand cpu_usedyaxis | timechart span=1h values(cpu_usedyaxis) If your query is resolved and got the solution .. Please accept the answer.. ... View more

@ renjith.nair -- Thank you very much for your detail explanation 🙂 .. Yes i got what i needed .. ... View more

@renjith.nair Thank you very much for your response :-).. Yes i expect this one .. I need to add one more column in the drilldown option. How to achieve it .. I need help in achieving it .. If i need to go with two more column filter in same drill down how can i achieve it .. <form> <label>shankar cell level drill down search by frn</label> <fieldset submitButton="false"></fieldset> <row> <panel> <table> <search> <query>index="_internal" sourcetype="splunkd" log_level!="INFO" | bin span=1h _time | stats count by _time log_level component</query> <earliest>-15m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <condition field="log_level"> <set token="log_depend">true</set> <set token="log_level">$row.log_level$</set> <set token="component">$row.component$</set> <unset token="component_depend"></unset> </condition> <condition field="component"> <set token="component">$row.component$</set> <set token="component_depend">true</set> <set token="log_level">$row.log_level$</set> <unset token="log_depend"></unset> </condition> <condition field="_time"> <set token="_time">$row._time$</set> <set token="tracktime">true</set> <set token="log_level">$row.log_level$</set> <unset token="log_depend"></unset> </condition> </drilldown> </drilldown> </table> </panel> </row> <row> <panel> <title>$_time$ Summary</title> <table depends="$tracktime$"> <search> <query> index="_internal" sourcetype="splunkd" log_level!="INFO" | bin span=1h _time | where log_level="$log_level$" AND _time ="$_time$" | stats count by _time log_level component | table log_level component _time count </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <unset token="tracktime"></unset> </drilldown> </table> </panel> </row> <row> <panel> <title>Component $component$ Summary</title> <table depends="$component_depend$"> <search> <query> index="_internal" sourcetype="splunkd" log_level!="INFO" | bin span=1h _time | where log_level="$log_level$" AND component ="$component$" | stats count by _time log_level component | table log_level component _time count </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <unset token="component_depend"></unset> </drilldown> </table> </panel> </row> <row> <panel> <title>Log Level $log_level$ Summary</title> <table depends="$log_depend$"> <search> <query> index="_internal" sourcetype="splunkd" log_level!="INFO" | bin span=1h _time | where log_level="$log_level$" | stats count by _time log_level component | table log_level component _time count </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <unset token="log_depend"></unset> </drilldown> </table> </panel> </row> </form> ... View more

Hai All, If anyone have idea about above mentioned scenario .. please make your comments. Thanks in advance ... ... View more

@poete - one last question .. how can i change the background color of the field based on the value which I'm receiving .. For example if the value (SQL Server,Detail=Data Processed volume,Value=100% then Green color) else if the value (SQL Server,Detail=Data Processed volume,Value>=80 then Yellow color) else if the value (SQL Server,Detail=Data Processed volume,Value>=60 then light red color) else the value (SQL Server,Detail=Data Processed volume,Value<=59 then red color) .. How to achieve it .. ... View more

@poete - First of all Thank you very much. Yes it's working for me also now .. when i use one search query as index and another one as |makeresults one, as i mentioned above its not working. But when i use all the search query with my index in both the places it's working fine .. Thank you very much ... ... View more

@poete when i run the query in search window. I'm getting result. But while using inside the i dont know what is happening .. ... View more

@poete Thanks for your reply i can able to get the html view of the report now. But when I'm using real query in the query environment its not displaying the value as expected , but its displaying the $Totals$ as a value in the dashboard <dashboard> <search> <query> index=** sourcetype=** | eval Month=strftime(strptime(date,"%Y-%m-%d"),"%B") | eval Year=strftime(strptime(date,"%Y-%m-%d"),"%Y") | search Month="April" AND Year="2018" | eval Totals=if(isnull(error),0,error) </query> <done> <set token="Totals">$result.Totals$</set> </done> </search> <search> <query>|makeresults | eval Value1=3.8|eval Value2=100|eval Value3=85|eval Value4=87|eval Value5=75|eval Value6="Yes"|eval Value7="No"|eval Value8=40|eval Value9=44|eval Value10=54|eval Value11="Reach" </query> <done> <set token="Value2">$result.Value2$</set> <set token="Value3">$result.Value3$</set> <set token="Value4">$result.Value4$</set> <set token="Value5">$result.Value5$</set> <set token="Value6">$result.Value6$</set> <set token="Value7">$result.Value7$</set> <set token="Value8">$result.Value8$</set> <set token="Value9">$result.Value9$</set> <set token="Value10">$result.Value10$</set> <set token="Value11">$result.Value11$</set> </done> </search> <row> <panel> <html> <head> <style> table, th, td { border: 1px solid black; border-collapse: collapse; } th, td { padding: 5px; text-align: left; } </style> </head> <body> <table style="width:100%"> <tr> <th>Measures</th> <th>DB</th> <th>Detail</th> <th>Value</th> <th>Reached</th> </tr> <tr> <td rowspan="6">DB Connect</td> <td>Oracle</td> <td>Data Processed volume</td> <td><3.5%</td> <td>$Totals$</td> <!--<td rowspan="2">Logs</td> <td rowspan="2">lookup</td>--> </tr> <tr> <td rowspan="4">SQL Server</td> <td rowspan="4">Data Processed volume</td> <td>100%</td> <td>$Value2$</td> </tr> <tr> <td>>80%</td> <td>$Value3$</td> </tr> <tr> <td>>60%</td> <td>$Value4$</td> </tr> <tr> <td>>40%</td> <td>$Value5$</td> </tr> <tr> <td>DB2</td> <td>Data Processed volume</td> <td><=3</td> <td>$Value6$</td> </tr> <tr> <td rowspan="2">Logs</td> <td>Unstructured</td> <td>Data Processed volume</td> <td>>=80%</td> <td>$Value7$</td> </tr> <tr> <td>Structured</td> <td>Data Processed volume</td> <td>>=60%</td> <td>$Value8$</td> </tr> <tr> <td rowspan="3">Lookup</td> <td>Country</td> <td>Number of countries</td> <td>>=40%</td> <td>$Value9$</td> </tr> <tr> <td>State</td> <td>Number of State</td> <td><=3%</td> <td>$Value10$</td> </tr> <tr> <td>Continent</td> <td>Number of Continents</td> <td>>=80%</td> <td>$Value11$</td> </tr> </table> </body> </html> </panel> </row> </dashboard> ... View more

@poete - Please add some more points to your answer. only Reached filed is going to generate values rest of all are static .Even i can hard code the values for them .. can you kindly add some more point on achieving the html table format .. Its new to me .. ... View more

@kamlesh_vaghela convert your comment as answer. So i can vote it .. 🙂 ... View more

@ hgehrts [Splunk] Thanks for your reply .. No i don't believe it will help me.. Other than the Reached filed rest of the field i need as a static table. For example if its an html view also I'm ok with it .. its not going to change .. But in the each cell of the Reached field i need to write a separate query and bring up the result.. ... View more

@mcbradford May i know based on what datetime filed as source, now your getting data in the splunk index and its displaying. May i know using DB connect what is the method you pulling data into splunk . Either Batch or Rising. Have you provided your required date field in the below mentioned options(current index time or choose column) Batch & Rising: : In Batch you can see the Timestamp filed and with option like current index time and choose column. current index time - i don't have that much idea about it . choose column- if you specify the column. based on it date will be indexed into splunk. ... View more

@abhi04 - I have tested below sample query for the scenario what you have mentioned. you can try from your end and let know.. ... View more

@abhi04 Try below query. |makeresults | eval timeDiffsec=strptime("2018/05/31 23:45:02","%Y/%m/%d %H:%M:%S")-strptime("2018/05/31 22:45:00", "%Y/%m/%d %H:%M:%S") | eval Timediff_Mins=round((timeDiffsec/60),1) | eval Timediff_Hours=round((timeDiffsec/60/60),1) | table timeDiffsec Timediff_Mins Timediff_Hours I have used sample date and time value instead of it you can use your field. Eg | eval timeDiffsec=strptime(EndTime ,"%Y/%m/%d %H:%M:%S")-strptime(StartTime, "%Y/%m/%d %H:%M:%S") ... View more

@ abhi04 - Are you trying to calculate difference between StartTime EndTime in Duration_Min Duration_Sec ... View more