Please find the sample query with the data points, hope it helps you to change your query accordingly -  Also, in most of the cases you can skip using join command if one of your datasources is a lookupfile, you can use |lookup filename.csv command in those cases. Considering the below is in lookupfile emp.,csv code name 123 Smith 456 Myers Final Query -  | makeresults | eval BRAND_EMPID="Nike,123;Adidas,456;Lotto,123" | makemv delim=";" BRAND_EMPID | mvexpand BRAND_EMPID | eval Brand=mvindex(split(BRAND_EMPID,","),0) | eval ID_EMP=mvindex(split(BRAND_EMPID,","),1) | table Brand ID_EMP | lookup emp.csv Code AS ID_EMP | table Brand ID_EMP NAME  Let me know if the above query helped or if you feel anything needs to be changed in the above example. ... View more

You can use the below format to achieve the same -    $firsttable with all the VPN Queue data avaialble (bigger dataset)$ |table VPN Queue |join type=left VPN Queue [ $Secondtable with only the VPN Queue data where the activity is done$ | table VPN Queue Client_Name ActivationTime ] | fillnull value="Not_Available"   Example query -    | makeresults | eval VPNQueue="vpn1,queue1;vpn2,queue2;vpn3,queue3;vpn4,queue4" | makemv delim=";" VPNQueue | mvexpand VPNQueue | eval VPN=mvindex(split(VPNQueue,","),0) | eval Queue=mvindex(split(VPNQueue,","),1) | table VPN Queue | join type=left VPN Queue [| makeresults | eval VPNQueue="vpn1,queue1;vpn2,queue2" | makemv delim=";" VPNQueue | mvexpand VPNQueue | eval VPN=mvindex(split(VPNQueue,","),0) | eval Queue=mvindex(split(VPNQueue,","),1) | eval Client_Name=case(VPN="vpn1","client1",VPN="vpn2","client2") | eval ActivationTime=case(VPN="vpn1","01-01-2021",VPN="vpn2","01-01-2022") | table VPN Queue Client_Name ActivationTime ] | fillnull value="Not_Available"   ... View more

Not sure if I understand it correctly, but if you are trying to trigger an alert if the no.of events is equal to 10, you can append the same condition in the query and in the alert conditions, trigger the alert only if you get any results. sourcetype="access_combined" POST 401 "/cas/login" | stats count by clientip | search clientip=10   ... View more

You dont need to use join here when the data is in lookup file and for charts you can use stats command , you can try something like below -  $FirstQuery which gives appId and reponseTime as output$ | lookup tmpfile.csv appId AS appId output serviceA | stats avg(responseTime) AS responseTime by appId,serviceA ... View more

It looks like you might be using the wrong token. This is a sample dashboard which might help you troubleshooting the issue. <form> <label>Dummy</label> <fieldset submitButton="false"> <input type="dropdown" token="field1"> <label>field1</label> <choice value="Number1">Number1</choice> <choice value="Number2">Number2</choice> <default>Number1</default> <initialValue>Number1</initialValue> </input> </fieldset> <row> <panel> <title>Temporary to check the token value - "$field1$"</title> <table> <search> <query>| makeresults | eval Key="Number1",Value="11" | append [| makeresults | eval Key="Number2",Value="22" ] | search Key="$field1$"</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> ... View more

Can you share what you have tried?   ... View more

Something like below should work -  index=secondsearchindex sourcetype=sourcetype [ search index=firstsearchquery_withIPaddresses | stats c by ipaddress | table ipaddress] You can schedule an alert if you get 0 results from the above.   For reference - https://docs.splunk.com/Documentation/Splunk/9.0.0/Search/Aboutsubsearches ... View more

Is there a reason why you have used the below condition check for the "METHOD Dropdown"?   <change> <condition value="Alle"> <set token="token_method">*</set> </condition> </change>   If you just need to have the token of METHOD to be passed to "Operation" dropdown , delete the above piece of code as you dont need to have it. Once done you should be able to see the results as expected. ISSUE As you are using * as the token output for Method=Alle, you are seeing multiple values for 'Operation' dropdown. Removing the above piece of code should help in resolving it. ... View more

Awesome, thanks for the graphs!! Really Appreciate it. Also, I have built a similar one (network graph) on react web framework. The reason I am requesting for that particular data is, if at all something happens to the node (say kid1) I am able to assign a color red to it (by passing a new column ofcourse). In a similar way, I want to find out the parent-child relationship data and convert all of them into red. So I just need to add a search which takes kid1 as red, and gives xyz,child1,son1,parent as red too. I was able to achieve this using js in my code, but personally I dont like doing any data operations outside of Splunk. Hence trying to figure out how to get this recursive loop function and get the expected output. Below is a high level view of how I am planning to get the output as. Changing just the color of kid1 is possible, but I am unable to get the info till parent. Do you think that can be achieved? Thanks for the help. ... View more

HI @niketn  @woodcock can you help me here if possible. thanks ... View more

The best way would be to make it a multivalued and send the first event alone. that way the first row will consists the other data too. ... View more

are you asking the inputs.conf from the indexer(which is HF in this case) or UF? why is that? And yes the receiving port is 8201 [splunktcp://8201] disabled=0 ... View more

yes, you are absolutely right, this is what I got as output. ... View more

The connection is successful got the below when ran the query you have provided on the connection part. CONNECTED(00000003) write:errno=104 ... View more

I did restart it good number of times, but no luck. ... View more

@woodcock @niketnilay @somesoni2 any suggestions? ... View more

Thanks for the answer. It certainly worked. ... View more