Hi,  I am trying to create new field values from my json log base on the values that appear under a particular field So here is an example { "widget": { "text": [ { "data": "Click here", "size": 36 }, { "data": "Learn more", "size": 37 }, { "data": "Help", "size": 38 }, ] } }  So in my environment I currently have got widget{}.text{}.data as a field, however i would like to break it further and have widget{}.text{}.data{}.ClickHere,  widget{}.text{}.data{}.Help,  widget{}.text{}.data{}.LearnMore as individual fields I ask this because when we have thousands of logs and are looking for certain combinations, we have issues with filtering accurately, doing this will help us find the right combinations  Any assistance will be greatly appreciated, Thanks  ... View more

Hi People, I am trying to run a regex command to cut out a part of the REQ field, On regex 101 it is working fine, however on Splunk it is causing problems and i get an unknown search command error Here is the query i am using, index=was_unauth sourcetype=ibm:was:jmx ReqMethod="POST" NOT [| inputlookup policy_wlist_ipaddr_digital_ | fields src] | rename DIP as src, SIP as src CUST as username USR as username | rex field=_raw REQ\=\".*\/(?<page>\w*[^0-9]+(\.jsp)?)\/?\" | search src!="10.0.0.0/8" src!="141.92.0.0/16" NOT username=* page!="phoneauthentication" AND page!="1*" | stats count by page I do not want the regex command to cut out pages with numbers in them, so i've included [^0-9] in there which works on regex 101 but Splunk does not like it, even when i use a backslash to block it out but it still doesn't pull out the data, I've also tried using index=was_unauth sourcetype=ibm:was:jmx ReqMethod="POST" NOT [| inputlookup policy_wlist_ipaddr_digital_ | fields src] | rename DIP as src, SIP as src CUST as username USR as username | rex field=_raw REQ\=\".*\/(?<page>[a-zA-Z_]+(\.jsp)?)\/?\" | search src!="10.0.0.0/8" src!="141.92.0.0/16" NOT username=* page!="phoneauthentication" AND page!="1*" | stats count by page but this gives me the unknown search command :a error Any help would be greatly appreciated, Thanks ... View more

Hi People, I am trying to create a drill down into a set of hidden/show panels in another page from my Splunk dashboard, however, when I drill down from specific panel on my dashboard, the hidden/show panels which should be shown is not showing, it is passed through the form option in the drilldown url, even though the form is updating in the drilldown the panel is not showing, Here is some code from the drilldown <drilldown target="_blank"> <link> <![CDATA[/app/*/island_branches_wip__drilldown_lbil_dashboard?form.tkntime.earliest=$earliest$&form.tkntime.latest=$latest$&form.type=Island+UK]]> </link> </drilldown> so what should happen is the Island+UK part of the form should pass into the form of the second dashboard displaying the panel that depends on that part of the form, but its not automatically showing here is some code from the second dashboard <input type="dropdown" token="type" searchWhenChanged="true"> <label>Island Branch Type Search</label> <default>*</default> <choice value="Island Island">Island+Island</choice> <choice value="Island UK">Island+UK</choice> <choice value="UK Island">UK+Island</choice> <change> <condition value="Island Island"> <set token="show_islandisland"></set> <unset token="show_islanduk"></unset> <unset token="show_ukisland"></unset> </condition> <condition value="Island UK"> <unset token="show_islandisland"></unset> <set token="show_islanduk"></set> <unset token="show_ukisland"></unset> </condition> <condition value="UK Island"> <unset token="show_islandisland"></unset> <unset token="show_islanduk"></unset> <set token="show_ukisland"></set> </condition> </change> and then each panel would have this line of code depending on what it depends on <panel depends="$show_islanduk$"> I just want to drill down from the first dashboard and show the contents of the panel that should be displayed upon clicking, Any help would be greatly appreciated, I hope this makes sense ... View more

Hi, I am trying to create a dashboard with 2 drop down filters, The issue is, is that I have a lingering hidden drop down panel which I only want to appear when a specific value from the 1st drop down is picked Now when the 2nd drop down appears, I want to be able to further filter the entire dashboard based on its values, However the annoying this is, is that the the 2nd drop downs values stick to the entire dashboard even when it is hidden, I only want its filtering capabilities to be enabled when the 1st drop downs specific value is picked, So I think a solution would be to find a way to unset the token or remove that line of code in the search when the 2nd drop down is hidden however I can't seem to figure out a way to do this. I am using Splunk 6.5 Here is the current code for the drop downs <input type="dropdown" token="journey_tkn" searchWhenChanged="true"> <label>Journey</label> <choice value="*">NGA+MCA</choice> <choice value="NGA">NGA</choice> <choice value="MCA">MCA</choice> <prefix>Journey=</prefix> <default>NGA+MCA</default> <initialValue>*</initialValue> <change> <condition label="MCA"> <set token="nga_show_tkn"></set> <unset token="nga_hide_tkn"></unset> </condition> <condition label="NGA"> <unset token="nga_show_tkn"></unset> <set token="nga_hide_tkn"></set> </condition> <condition label="*"> <unset token="nga_show_tkn"></unset> <set token="nga_hide_tkn"></set> </condition> </change> </input> <input type="dropdown" token="mcatkn" searchWhenChanged="false" depends="$nga_show_tkn$"> <label>MCA Type</label> <choice value="Telephony">Telephony</choice> <choice value="Branch">Branch</choice> <choice value="*">*</choice> <prefix>MCAType=</prefix> <suffix></suffix> <change> <condition value="*"> <unset token="mcatkn"></unset> </condition> </change> </input> and here is a sample search which uses the tokens from the drop downs $tkn_index$ REQ="* " CLS="*" MSG="Get product types request handler ends" | eval Journey=if(CH="****Retail" OR CH="****Retail" OR CH="****Retail" OR CH="****Retail", "NGA", "MCA") | eval MCAType=case(CH="****RetailBranch" OR CH="****RetailBranch" OR CH="****RetailBranch" OR CH="****RetailBranch", "Branch", CH="****RetailTelephony" OR CH="****RetailTelephony" OR CH="****RetailTelephony" OR CH="****RetailTelephony", "Telephony") | search $journey_tkn$ $mcatkn$ | stats dc(SID) as UniqueSessionCount So I'd like to get get rid of $mcatkn$ when the 2nd dropdown is not in use (i.e hidden) because that causes there to be lingering filtering in the dashboard, I only want the 2nd dropdowns filter to be applied when the 1st drop downs specific value has been chosen (in this case when mca is picked, I want the 2nd dropdown panel to be displayed which it is, and then I want to be able to filter by Telephony or Branch, however when the 1st dropdown has nga or nga+mca picked, I want the 2nd drop down to disappear as well as the lingering filter being applied by it, I hope this makes sense, Any help will be greatly appreciated! Please do help 🙂 ... View more