Ah, in this case... you can grab the search they used, and then you can use tokens to add a time range input (and others.) ... View more

Yes, this is possible. If you'd like to have the two be identical (meaning no change to the underlying search at all), you can have your peers save the search as a report. From that point, you can add that report as a dashboard panel to the dashboard of your choice. How to modify a report's permissions: https://docs.splunk.com/Documentation/Splunk/7.3.0/Report/Managereportpermissions How to add a report to your dashboard: https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Addreportstodashboard ... View more

If you are on version 2.0.3, there's a bug that causes an "authentication failure" when using passwords with special characters. If you take out the special characters, you should find that data collection will function as expected. ... View more

There may be something possible using the DSP beta, but at this point in time, it would be much less efficient to do it inside of Splunk - you would potentially cause some amount of ingestion latency. ... View more

Could you include what the file paths look like, and your inputs.conf stanza for this directory? ... View more

I think you'd be better off doing this at the source rather than in Splunk. Is it possible to write a script to cleanse the data before it's written to a file that Splunk monitors? ... View more

You could use the table command to hardcode the ordering of the table - do you have a need to make it dynamic? ... View more

Hi Apple143, Would you mind posting this as a new question since it is a separate question? ... View more

Hi Ben, This is still using your original search string that is plotting out sumCost and sumHours, which are not being rounded. Can you post the result of this string from above? | stats sum(Cost1) as SumCost1, sum(Hours) as SumHours by Quarter | eval SumCost1 = round(SumCost1, 1) | eval SumHours = round(SumHours, 1) | eval HourlyCost = round(('Cost1') / ('Hours'),1) ... View more

Could you share a screenshot of the resulting chart and search string? This wouldn't be a version issue - the round function has been stable historically. ... View more

\nhttps://acs2-dealer-orders-api.mcf-np.local/orderChangeLog?soldToPartnerId=0001662715&soldToPartnerIdType=SAP&seedYear=2018\n{\"headers\":{},\"body\":{\"dealerOrderChangeLogResponseEntityList\":[{\"soldToPartnerEBID\":\"1100027381904\",\"soldToPartnerGLNID\":\"1100027381904\",\"soldToPartnerSAPID\":\"0001662715\",\"soldToPartnerName\":\"MFA BOONVILLE MO\",\"soldToPartnerAddress\":\"1605 RADIO HILL ROAD\",\"sellerPartnerId\":\"0062668030000\",\"sellerPartnerIdType\":\"EBID\",\"requestingSource\":\"\",\"seedYear\":\"2018\",\"requestType\":\"LOG\",\"buyerId\":\"0001662715\",\"sellerId\":\"0062668030000\",\"dealerOrderChangeLogLineItemList\":[]}],\"apiErrors\":[],\"apiMessages\":[],\"apiResponseTimes\":{},\"requestId\":\"f325f348-48f2-4dba-5f40-a8a3f264c247\"},\"statusCode\":\"OK\",\"statusCodeValue\":200} Starting from this section, you begin to include backslashes in the field names whereas previously you did not have them. Every now and then there's a line break (\n) but it's not quite clear when/why they are sometimes included? "messageBody":"https://acs2-dealer-orders-api.mcf-np.local/orderChangeLog?soldToPartnerId=0001662715&soldToPartnerIdType=SAP&seedYear=2018host = acs2-dealer-orders-api.mcf-np.local In this snippet, there are missing ampersands so the host actually isn't extracted properly because it's viewed as part of the seedYear. Besa0903, if you were able to get the query working, could you accept this as your answer? ... View more

Upon further inspection - there's some inconsistency to the formatting of the data (which is why spath won't quite work in this case.) I put together a janky search string that gets you the conversationId and serviceName - but it won't pick up field names/values out of the second half of your messageBody until the formatting is fixed.. index=datapower host=mq-tst sourcetype=mq ServiceName=SC_GLOBAL_B2B_GenericSplunkLogger_MPGW *error* |spath | spath input="MessageViewer.MessageBody" | table conversationID, serviceName ... View more

Hi Besa0903, I brought your data into my own splunk env and used spath - I can see serviceName extracted properly, while conversationID is set to null. If you run your search like this, do you see serviceName and other fields extracted from the json blob? index=datapower host=mq-tst sourcetype=mq ServiceName=SC_GLOBAL_B2B_GenericSplunkLogger_MPGW *error* | spath ... View more

Ben, I tested on my own env and can confirm that I can see the ".0" even if the output is a whole number. I think one issue may be with all the spaces in your code.. try this.. | stats sum(SumCost1) as SumCost1, sum(SumHours) as SumHours by Quarter | eval HourlyCost = round((SumCost1/SumHours),1) ... View more

Nice catch, Niketnilay 🙂 @apple143, if this works for you, can you accept the answer? ... View more

Hi Marklindo, It looks like your search is plotting SumCost1 and SumHours by quarter, but those two fields are not being manipulated to show the first decimal place - you are only manipulating HourlyCost. If you'd like the two lines on the chart (SumCost1 and SumHours) to include the first decimal place, try this.. | stats sum(Cost1) as SumCost1, sum(Hours) as SumHours by Quarter | eval SumCost1 = round(SumCost1, 1) | eval SumHours = round(SumHours, 1) | eval HourlyCost = round(('Cost1') / ('Hours'),1) ... View more

Hi GeoCouloute, Unless you are an admin, you may not have visibility into all the indexes in your splunk env. To see which indexes you have access to, you can use this search | tstats count where index=* by index ... View more

Syntactical issue, perhaps? Stanzas need to have a linebreak inbetween. Try inserting a space between whitelist.0=* and [serverClass:FWD2Local:app:LWFoutputs] ... View more