Where I need to keep this JS? In dashboard or in any path?  ... View more

Is there a way to add the java script in xml inline. I am using cloud version and don't have rights to add the script in path. ... View more

with stats i was able to get the result of a tabular data in a single row, however with streamstats the stats are applied consecutively to the aggregated data on a per row level, basically aggregates fields and the applies the stats until that row and appends the stats fields to that row. Good to know, but did not help. ... View more

I would suggest installing it on DMC and you would be able to get the results you are looking for. ... View more

Hey, There is no direct way of onboarding encrypted data to Splunk. In case there is a requirement to do so, you can go ahead and write a script (python/shell) that access the API of encrypted source, parse it and send it to Splunk. There is a python library to address this  https://pypi.org/project/py-pgp/   The below code should be a starter for you import pgpy emsg = pgpy.PGPMessage.from_file(<path to the file from the client that was encrypted using your public key>) key,_ = pgpy.PGPKey.from_file(<path to your private key>) with key.unlock(<your private key passpharase>): print (key.decrypt(emsg).message)   ... View more

Yup baiscally the rest API was sending out the data is random order everytime it polled and the regex was written without that things to be taken into consideration. Later on it was realized that the JSON response is completely jumbled up on every hit and fixing the Regex solved the prblm. Thanks for your help! ... View more

PLZ upvote if you use this! Copy out all field names from your DataModel. (move to notepad++/sublime/or text editor of your choice). 1. add "values" command and the inherited/calculated/extracted DataModel pretext field to each fields in the tstats query (in the following example I'm using "values(authentication.YourDataModelField) *note add host, source, sourcetype without the authentication.fieldname - as they are already in tstats so is _time but I use this to groupby) 2. add "from" clause to choose your DataModel (in the following example I'm using authentication DataModel) 3. add "where" clause to specify field values (in the following example I'm using action=failure and limiting the signature_id to the 3 windows failures I care about in this usecase) also can specify nodename or child datamodel object/etc - note you cannot wildcard this field) 4. add "by" clause to help narrow the dataset (in the following example I'm using user, src, signature_id, and _time) 5. table all (note this will give you a table view of all the data in that datamodel - I like to use this as it makes more sense to me starting with everything and removing what I do not need) | tstats count as count values(Authentication.user) , values(Authentication.tag) , values(Authentication.dest_bunit) , values(Authentication.dest_category) , values(Authentication.dest_nt_domain) , values(Authentication.dest_priority) , values(Authentication.duration) , values(Authentication.response_time) , values(Authentication.signature) , values(Authentication.signature_id) , values(Authentication.src_bunit) , values(Authentication.src_category) , values(Authentication.src_nt_domain) , values(Authentication.src_priority) , values(Authentication.src_user_bunit) , values(Authentication.src_user_category) , values(Authentication.src_user_priority) , values(Authentication.user_bunit) , values(Authentication.user_category) , values(Authentication.user_priority) , values(Authentication.action) as action , values(Authentication.app) , values(Authentication.src) , values(Authentication.src_user) , values(Authentication.dest) , values(host) , values(source) , values(sourcetype) from datamodel="Authentication"."Authentication" where Authentication.action=failure (Authentication.signature_id=4625 OR Authentication.signature_id=4772 OR Authentication.signature_id=4771) by Authentication.user, Authentication.src, Authentication.signature_id, _time | table * Lastly, specify the fields you want - replace those in the tstats and table commands, add post processing stats/rex/lookups/ etc. (note this part I did not show in example) and as Christopher Walken would say "BAM!" ... View more

@visngla1 What is your log? If not, ask another question. ... View more

Hi, if you set the CHECK_METHOD in a props.conf on the universal forwarder to modtime, then the splunkd.log will have a entry when the file is created. E.g: If /opt/splunkforwarder/etc/system/local/inputs.conf had an entry: [monitor:///data/test/*.trg] And there was a /opt/splunkforwarder/etc/system/local/props.conf with an entry: [source::/data/test/*.trg] CHECK_METHOD = modtime Then when a file is created the splunkd.log will have an entry liek the following: # date Thu Jul 5 15:19:53 AEST 2018 # touch /data/test/my_new_file.trg # grep trg /opt/splunkforwarder/var/log/splunk/splunkd.log 07-05-2018 15:20:08.415 +1000 INFO WatchedFile - Will use tracking rule=modtime for file='/data/test/my_new_file.trg'. If these splunkd logs are forwarded, you can search them in the index=_internal ... View more

I just copied your entire lookup in the image and tried this myself by creating a .csv. I don't have zeros in all rows and so it seems that your csv is not well formatted. Can you try what I just did? Create a csv in a plaintext file: _time,image_name,os_name 10/01/2018, azure1, CentOS7 10/02/2018, azure1, CentOS7 15/02/2018, azure1, CentOS7 20/02/2018, azure3, CentOS7 10/03/2018, azure3, CentOS7 11/03/2018, azure2, CentOS7 12/03/2018, azure2, CentOS7 Save it like this and to csv_timechart.csv, put it in the lookup folder of the app you are using, and run the command I told you. Feed us back please ... View more

Is this what you are looking for? <drilldown target="My New Window"> <link> /app/search/<dashboardname>?form.fieldname=$row.fieldname$ </link> </drilldown> http://docs.splunk.com/Documentation/Splunk/6.0.2/Viz/Dynamicdrilldownindashboardsandforms so steps : you need to create two dashboards..so suppose your main dashboard is test3 and drilldown dashboard is test4 so test3 XML is <dashboard> <label>test3</label> <row> <panel> <table> <search> <query>index=test clientip=* | table file clientip</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <drilldown target="My New Window"> <link> /app/search/test4?form.file=$row.file$ </link> </drilldown> </table> </panel> </row> </dashboard> and test4 XML is <form> <label>test4</label> <fieldset submitButton="false"> <input type="text" token="file" searchWhenChanged="true"></input> </fieldset> <row> <panel> <table> <search> <query>index=test clientip=* | search file=$file$| stats latest(referer) by clientip | transpose 0 column_name=clientip header_field=clientip | fields - clientip</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form> I hope that helps ! This is working XML's but it won't work in your as you do not have data for those queries so customize the XML and you will get the output! let me know if it helps ! ... View more

This guidance, made me get what i was looking for! Thanks ... View more

duplicate GUID was the issue & deleting the instance.cfg and restarting the service fixed the issue. ... View more

thanks for the prompt, revert @rjthibod ... View more

This option didn't worked for me for some reason the result contained everything of table 1, but i wanted only contents which are non common. Thanks for your revert though! ... View more

Hi @ashish9433 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks. ... View more

http://conf.splunk.com/files/2016/slides/anomaly-detection-on-business-items-with-machine-learning-algorithms.pdf http://conf.splunk.com/files/2016/slides/machine-learning-using-splunk-and-r.pdf http://conf.splunk.com/files/2016/slides/splunk-for-donuts-optimizing-the-customer-experience-at-dunkin-with-splunk.pdf http://conf.splunk.com/files/2016/slides/splunk-as-an-intelligent-platform-from-log-aggregation-to-machine-assisted-analysis-at-nordstrom.pdf http://conf.splunk.com/files/2016/slides/best-practices-for-working-with-splunk-cloud.pdf http://conf.splunk.com/files/2016/slides/splunking-aws-for-end-to-end-visibility.pdf http://conf.splunk.com/files/2016/slides/real-world-advantages-of-choosing-a-lean-soc-approach-over-a-legacy-soc-lessons-learned-from-the-uks-largest-home-improvement-retailer.pdf http://conf.splunk.com/files/2016/slides/splunk-cloud-at-bbc-worldwide-operational-and-business-analytics-to-support-a-new-digital-service.pdf http://conf.splunk.com/files/2016/slides/using-splunk-to-create-the-first-hipaa-cloud-compliant-infrastructure-at-harvard-to-secure-clinical-and-genetic-patient-data-on-aws.pdf http://conf.splunk.com/files/2016/slides/building-splunk-visualizations-with-the-new-custom-visualization-api.pdf http://conf.splunk.com/files/2016/slides/http-event-collector-in-splunk-more-super-powers.pdf http://conf.splunk.com/files/2016/slides/faster-splunk-app-certification-with-splunk-appinspect.pdf http://conf.splunk.com/files/2016/slides/monitoring-the-industrial-internet-of-things-a-guide-to-application-performance-management-with-splunk.pdf http://conf.splunk.com/files/2016/slides/mqtt-cep-and-the-other-lmnops-of-the-iot.pdf http://conf.splunk.com/files/2016/slides/business-analytics-with-splunk-the-secret-behind-our-saas-growth-success.pdf http://conf.splunk.com/files/2016/slides/splunking-sap-provide-instant-business-value-by-unlocking-sap-data-for-it-ot-and-security-use-cases-across-your-enterprise.pdf http://conf.splunk.com/files/2016/slides/monitor-your-business-transactions-with-splunk-to-gain-real-time-insights-into-your-business-performance.pdf http://conf.splunk.com/files/2016/slides/gaining-new-insight-into-the-payment-business-process.pdf http://conf.splunk.com/files/2016/slides/tracking-trading-fix-environments-with-splunk.pdf http://conf.splunk.com/files/2016/slides/listen-to-the-wind-it-talks-monitoring-wind-energy-production-from-scada-systems-with-splunk.pdf http://conf.splunk.com/files/2016/slides/how-splunk-can-provide-real-time-operational-insights-to-drive-performance-and-customer-excellence-in-a-call-center-environment.pdf http://conf.splunk.com/files/2016/slides/leveraging-splunk-analytics-for-business-intelligence-and-devops-api-activity-and-performance.pdf http://conf.splunk.com/files/2016/slides/from-it-troubleshooting-and-service-monitoring-to-predicting-student-achievement-an-operations-research-love-story.pdf http://conf.splunk.com/files/2016/slides/lesser-known-search-commands.pdf http://conf.splunk.com/files/2016/slides/behind-the-magnifying-glass-how-search-works.pdf http://conf.splunk.com/files/2016/slides/fields-indexed-tokens-and-you.pdf http://conf.splunk.com/files/2016/slides/its-10pm-do-you-know-where-your-data-is.pdf http://conf.splunk.com/files/2016/slides/architecting-splunk-for-high-availability-and-disaster-recovery.pdf http://conf.splunk.com/files/2016/slides/observations-and-recommendations-on-splunk-performance.pdf http://conf.splunk.com/files/2016/slides/shop-smart-at-the-kv-store-best-value-tricks-from-the-splunk-kv-store-and-rest-api.pdf http://conf.splunk.com/files/2016/slides/the-chargeback-app.pdf http://conf.splunk.com/files/2016/slides/splunking-your-zos-mainframe.pdf http://conf.splunk.com/files/2016/slides/quis-custodiet-ipsos-custodes-who-watches-the-watchmen-or-how-do-you-know-when-splunk-stops-searching.pdf http://conf.splunk.com/files/2016/slides/superspeeding-transaction-monitoring-with-the-kvtransaction-command.pdf http://conf.splunk.com/files/2016/slides/internet-of-big-rolling-things-at-db-cargos-european-rolling-stock-increased-customer-satisfaction-through-higher-availability-and-reliability.pdf http://conf.splunk.com/files/2016/slides/indexer-clustering-internals-scaling-and-performance.pdf http://conf.splunk.com/files/2016/slides/multi-tenant-architecture-securing-splunk-to-combat-snooping-users.pdf http://conf.splunk.com/files/2016/slides/dashboard-wizardry.pdf http://conf.splunk.com/files/2016/slides/whats-new-custom-visualizations.pdf http://conf.splunk.com/files/2016/slides/keeping-the-junk-out-of-splunk-maximizing-the-value-of-your-splunk-license-and-being-prepared-for-floods-of-data.pdf http://conf.splunk.com/files/2016/slides/solve-big-problems-with-machine-learning.pdf http://conf.splunk.com/files/2016/slides/search-optimization.pdf http://conf.splunk.com/files/2016/slides/splunk-and-open-source-integrations-with-spark-solr-hadoop-and-nosql-storage.pdf http://conf.splunk.com/files/2016/slides/confidence-in-conclusions-leveraging-splunk-for-data-driven-insights.pdf http://conf.splunk.com/files/2016/slides/predicting-incidents-with-supervised-and-unsupervised-machine-learning-on-splunk.pdf http://conf.splunk.com/files/2016/slides/scada-and-splunk-soul-mates-forever.pdf http://conf.splunk.com/files/2016/slides/extending-spl-with-custom-search-commands-and-the-splunk-sdk-for-python.pdf http://conf.splunk.com/files/2016/slides/splunk-app-lifecycle-management-with-more-peace-love-and-rock-n-roll.pdf http://conf.splunk.com/files/2016/slides/leveraging-splunks-ecosystem-for-your-own-products.pdf http://conf.splunk.com/files/2016/slides/step-up-your-app-dev-game.pdf http://conf.splunk.com/files/2016/slides/fast-time-to-extraordinary-value-quickly-add-powerful-machine-learning-to-your-splunk-apps-and-dashboards-with-splunks-new-machine-learning-toolkit.pdf http://conf.splunk.com/files/2016/slides/how-to-extend-splunk-with-an-ai-assistant-for-pattern-recognition.pdf http://conf.splunk.com/files/2016/slides/extending-splunks-rest-api-for-fun-and-profit.pdf http://conf.splunk.com/files/2016/slides/scaling-security-incident-investigations-with-interactive-event-graphs-and-spark.pdf http://conf.splunk.com/files/2016/slides/universal-forwarder-security-dont-input-more-than-data-into-your-splunk-environment.pdf http://conf.splunk.com/files/2016/slides/you-cant-protect-what-you-cant-see-aws-security-monitoring-and-compliance-validation-from-adobe.pdf http://conf.splunk.com/files/2016/slides/worst-practices-and-how-to-fix-them.pdf http://conf.splunk.com/files/2016/slides/let-stats-sort-them-out-building-complex-result-sets-that-use-multiple-source-types.pdf http://conf.splunk.com/files/2016/slides/best-practices-for-developing-splunk-apps-and-add-ons.pdf http://conf.splunk.com/files/2016/slides/jiffy-lube-quick-tune-up-for-your-splunk-environment.pdf http://conf.splunk.com/files/2016/slides/best-practices-for-deploying-splunk-on-amazon-web-services.pdf http://conf.splunk.com/files/2016/slides/deploying-splunk-enterprise-on-microsoft-azure-cloud.pdf http://conf.splunk.com/files/2016/slides/building-a-crystal-ball-forecasting-future-values-for-multi-cyclic-time-series-metrics-in-splunk.pdf http://conf.splunk.com/files/2016/slides/become-a-regular-expressions-ninja-and-unlock-your-splunk-potential.pdf http://conf.splunk.com/files/2016/slides/integrating-with-third-party-tools-using-splunk-alert-actions.pdf http://conf.splunk.com/files/2016/slides/architecting-splunk-for-epic-performance-at-blizzard-entertainment.pdf http://conf.splunk.com/files/2016/slides/how-to-scale-from-raw-to-tstats.pdf http://conf.splunk.com/files/2016/slides/onboard-your-data-faster-using-the-splunk-add-on-builder.pdf http://conf.splunk.com/files/2016/slides/puppet-enterprise-and-splunk-platform-improve-your-application-delivery-velocity.pdf http://conf.splunk.com/files/2016/slides/the-impossibles-a-story-from-a-devops-team.pdf http://conf.splunk.com/files/2016/slides/biz-pmo-dev-qa-sec-build-stage-ops-biz-shared-metrics-as-a-forcing-function-for-end-to-end-enterprise-collaboration.pdf http://conf.splunk.com/files/2016/slides/splunks-of-war-creating-a-better-game-development-process-through-data-analytics.pdf http://conf.splunk.com/files/2016/slides/building-a-smarter-strategy-for-alarms-with-machine-learning.pdf http://conf.splunk.com/files/2016/slides/hunting-the-known-unknowns-the-powershell-edition.pdf http://conf.splunk.com/files/2016/slides/conquering-the-ids-alert-challenge-with-splunk.pdf http://conf.splunk.com/files/2016/slides/anomaly-hunting-with-splunk-software.pdf http://conf.splunk.com/files/2016/slides/splunking-the-endpoint-hands-on.pdf http://conf.splunk.com/files/2016/slides/detecting-the-adversary-post-compromise-with-threat-models-and-behavioral-analytics.pdf http://conf.splunk.com/files/2016/slides/autonomous-threat-hunting-with-niddel-and-splunk-enterprise-security-mars-inc-customer-case-study.pdf http://conf.splunk.com/files/2016/slides/forwarder-management-in-splunk-cloud.pdf http://conf.splunk.com/files/2016/slides/im-a-windows-girl-in-a-red-hat-world-reducing-the-splunk-learning-curve.pdf http://conf.splunk.com/files/2016/slides/show-the-board-the-value-of-your-incident-response-team-detect-a-live-attack-with-splunk-and-knock-their-socks-off.pdf http://conf.splunk.com/files/2016/slides/through-the-security-looking-glass-operationalizing-cloud-enterprise-security-an-adaptive-response-approach.pdf http://conf.splunk.com/files/2016/slides/exploring-the-frameworks-of-splunk-enterprise-security.pdf http://conf.splunk.com/files/2016/slides/powershell-power-hell-hunting-for-malicious-use-of-powershell-with-splunk.pdf http://conf.splunk.com/files/2016/slides/maturing-workdays-soc-with-splunk.pdf http://conf.splunk.com/files/2016/slides/speeding-up-incident-response-using-splunk.pdf http://conf.splunk.com/files/2016/slides/live-demonstration-bypassing-application-whitelisting-and-stealing-your-data.pdf http://conf.splunk.com/files/2016/slides/beyond-regular-regular-expressions.pdf http://conf.splunk.com/files/2016/slides/global-enterprise-security-without-security-analysts-yes-you-can.pdf http://conf.splunk.com/files/2016/slides/demystifying-machine-learning-and-anomaly-detection-practical-applications-in-splunk-for-insider-threat-detection-and-security-analytics.pdf http://conf.splunk.com/files/2016/slides/finding-straw-in-a-hay-field-the-art-of-devops-log-farming.pdf http://conf.splunk.com/files/2016/slides/data-driven-devops-using-splunk-software-and-ansible-tower.pdf http://conf.splunk.com/files/2016/slides/from-devops-to-bizops.pdf http://conf.splunk.com/files/2016/slides/how-to-use-splunk-to-detect-and-defeat-fraud-theft-and-abuse.pdf http://conf.splunk.com/files/2016/slides/how-to-use-splunk-for-automated-regulatory-compliance.pdf http://conf.splunk.com/files/2016/slides/building-the-pipeline-presented-by-csaa-insurance-group-featuring-devops-and-splunk.pdf http://conf.splunk.com/files/2016/slides/securing-splunk-with-proxy-sso-saml-and-multi-factor-authentication.pdf http://conf.splunk.com/files/2016/slides/rebalancing-data-across-an-indexer-cluster.pdf http://conf.splunk.com/files/2016/slides/enriching-your-data-using-the-latest-features-of-splunk-db-connect.pdf http://conf.splunk.com/files/2016/slides/tco-savings-through-storage-reduction.pdf http://conf.splunk.com/files/2016/slides/easing-into-clustering.pdf http://conf.splunk.com/files/2016/slides/time-after-time-comparing-time-ranges-in-splunk.pdf http://conf.splunk.com/files/2016/slides/anatomy-of-a-successful-splunk-it-service-intelligence-deployment.pdf http://conf.splunk.com/files/2016/slides/it-seemed-like-a-good-idea-at-the-time-architectural-anti-patterns.pdf http://conf.splunk.com/files/2016/slides/buckets-full-of-happy-tiers-scale-out-enterprise-infrastructure-and-splunk-apps-for-deploying-massive-and-efficient-splunk-environments.pdf http://conf.splunk.com/files/2016/slides/the-truthiness-of-wire-data-using-splunk-app-for-stream-for-performance-monitoring.pdf http://conf.splunk.com/files/2016/slides/how-to-run-splunk-as-a-docker-image.pdf http://conf.splunk.com/files/2016/slides/monitoring-and-troubleshooting-docker-across-cloud-and-on-prem-environments.pdf http://conf.splunk.com/files/2016/slides/splunk-it-service-intelligence-keep-your-boss-and-their-bosses-informed-and-happy-and-still-have-time-to-sleep-at-night.pdf http://conf.splunk.com/files/2016/slides/how-anaplan-used-splunk-cloud-and-itsi-to-monitor-its-cloud-platform.pdf http://conf.splunk.com/files/2016/slides/security-ninjutsu-part-three-real-world-correlation-searches.pdf http://conf.splunk.com/files/2016/slides/find-a-hay-in-haystack.pdf http://conf.splunk.com/files/2016/slides/splunk-gone-wild-innovating-a-large-splunk-solution-at-the-speed-of-management.pdf http://conf.splunk.com/files/2016/slides/how-md-anderson-cancer-center-uses-splunk-to-deliver-world-class-healthcare-when-patients-need-it-the-most.pdf http://conf.splunk.com/files/2016/slides/an-ongoing-mission-of-service-discovery.pdf http://conf.splunk.com/files/2016/slides/metrics-driven-devops-with-jenkins-and-splunk.pdf http://conf.splunk.com/files/2016/slides/advanced-machine-learning-in-spl-with-the-machine-learning-toolkit.pdf http://conf.splunk.com/files/2016/slides/unified-open-sourced-splunk-configuration-management-system.pdf http://conf.splunk.com/files/2016/slides/the-power-of-data-normalization-a-look-at-cim-under-the-hood.pdf http://conf.splunk.com/files/2016/slides/harnessing-performance-and-scalability-with-parallelization.pdf http://conf.splunk.com/files/2016/slides/splunking-your-mobile-apps.pdf http://conf.splunk.com/files/2016/slides/earn-a-seat-at-the-business-table-with-splunk-it-service-intelligence.pdf http://conf.splunk.com/files/2016/slides/finding-your-faults-before-mom-deploying-splunk-for-it-troubleshooting-and-capacity-planning-on-large-scale-integrated-datacenter-infrastructure.pdf http://conf.splunk.com/files/2016/slides/writing-actionable-alerts.pdf http://conf.splunk.com/files/2016/slides/best-practices-and-better-practices-for-admins.pdf http://conf.splunk.com/files/2016/slides/splunking-azure-gain-insights-into-your-microsoft-azure-data-using-splunk.pdf http://conf.splunk.com/files/2016/slides/avoid-fines-and-save-money-automating-regulatory-compliance-with-qmulos.pdf http://conf.splunk.com/files/2016/slides/analytics-at-speed.pdf http://conf.splunk.com/files/2016/slides/splunk-performance-reloaded-best-practices-for-a-performant-splunk-deployment.pdf http://conf.splunk.com/files/2016/slides/power-of-spl.pdf http://conf.splunk.com/files/2016/slides/enterprise-security-multi-tenant-fundamentals.pdf http://conf.splunk.com/files/2016/slides/splunk-and-open-source-build-vs-buy-decisionmaking.pdf http://conf.splunk.com/files/2016/slides/bucket-diversity-choosing-your-search-mate-wisely.pdf http://conf.splunk.com/files/2016/slides/machine-learning-and-anomaly-detection-in-splunk-it-service-intelligence.pdf http://conf.splunk.com/files/2016/slides/introduction-to-splunk-it-service-intelligence.pdf http://conf.splunk.com/files/2016/slides/satellites-choropleth-maps-and-itsi-oh-my.pdf http://conf.splunk.com/files/2016/slides/a-very-brief-introduction-to-machine-learning-for-itoa.pdf http://conf.splunk.com/files/2016/slides/you-cannot-manage-what-you-dont-monitor-correlated-monitoring-of-an-enterprise-alm-environment-at-bosch.pdf http://conf.splunk.com/files/2016/slides/faster-time-to-value-with-itsi-modules.pdf http://conf.splunk.com/files/2016/slides/welcome-to-tomorrow-today-why-you-need-to-merge-it-and-security-in-todays-connected-world.pdf http://conf.splunk.com/files/2016/slides/from-30-minutes-to-40-seconds-applying-adaptive-response-to-automate-human-event-triage-with-splunk-es-and-phantom.pdf http://conf.splunk.com/files/2016/slides/splunk-cloud-a-peek-under-the-hood.pdf http://conf.splunk.com/files/2016/slides/infrastructure-analytics-driving-outcomes-through-practical-use-cases-and-applied-data-science-with-splunk-at-cisco.pdf http://conf.splunk.com/files/2016/slides/a-framework-for-developing-and-operationalizing-security-use-cases.pdf http://conf.splunk.com/files/2016/slides/increasing-engineering-productivity-in-micro-services-world.pdf http://conf.splunk.com/files/2016/slides/indexer-clustering-basics-internals-and-debugging.pdf http://conf.splunk.com/files/2016/slides/managing-a-large-scale-multi-site-distributed-deployment-without-going-insane.pdf http://conf.splunk.com/files/2016/slides/how-fast-is-fast-enough-improving-splunk-performance-with-batch-mode-search.pdf http://conf.splunk.com/files/2016/slides/real-world-role-based-access-controls-in-a-decentralized-environment.pdf http://conf.splunk.com/files/2016/slides/splunk-to-a-cure-be-inspired-by-a-lifesaving-use-case-of-managing-t1-diabetes.pdf http://conf.splunk.com/files/2016/slides/its-a-family-affair-splunk-and-the-art-of-home-iot.pdf http://conf.splunk.com/files/2016/slides/help-how-do-i-get-help-with-all-things-splunk.pdf http://conf.splunk.com/files/2016/slides/help-how-do-i-get-help-with-all-things-splunk.pdf http://conf.splunk.com/files/2016/slides/moving-from-data-to-wisdom.pdf http://conf.splunk.com/files/2016/slides/kick-start-a-cmdb-with-the-splunk-platform.pdf http://conf.splunk.com/files/2016/slides/the-10x-tool-splunk-development-force-multiplier-for-workday.pdf http://conf.splunk.com/files/2016/slides/proactive-oracle-database-monitoring-and-capacity-planning-with-splunk-software.pdf http://conf.splunk.com/files/2016/slides/splunk-and-control-systems-enabling-a-secure-iot-strategy.pdf http://conf.splunk.com/files/2016/slides/managing-day-to-day-operations-of-a-large-scale-splunk-deployment-cost-effectively.pdf http://conf.splunk.com/files/2016/slides/big-data-analytics-for-healthcare-decision-support-operational-clinical-and-fraud-waste-and-abuse.pdf http://conf.splunk.com/files/2016/slides/data-that-matters-a-devops-expert-panel.pdf http://conf.splunk.com/files/2016/slides/wrangling-your-iot-data-into-splunk.pdf http://conf.splunk.com/files/2016/slides/what-you-need-to-know-about-the-http-event-collector.pdf http://conf.splunk.com/files/2016/slides/whats-new-with-splunk-scheduler.pdf http://conf.splunk.com/files/2016/slides/your-splunk-sandbox.pdf http://conf.splunk.com/files/2016/slides/the-nosey-neighbor-challenge-physical-address-conversion-to-geolocation.pdf http://conf.splunk.com/files/2016/slides/dashboard-design-and-data-visualization-best-practices.pdf http://conf.splunk.com/files/2016/slides/next-generation-dashboards.pdf http://conf.splunk.com/files/2016/slides/splunk-for-google-analytics-how-to-gain-more-insight-into-site-performance-and-user-activity-by-correlating-google-analytics-data-within-splunk-software.pdf http://conf.splunk.com/files/2016/slides/customer-success-trends-best-practices-and-resources.pdf http://conf.splunk.com/files/2016/slides/lets-rebalance-data-across-an-indexer-cluster-in-15-minutes.pdf http://conf.splunk.com/files/2016/slides/tco-savings-through-storage-reduction-in-15-minutes.pdf http://conf.splunk.com/files/2016/slides/whats-new-enhanced-search-assistance.pdf http://conf.splunk.com/files/2016/slides/whats-new-with-data-analysis.pdf http://conf.splunk.com/files/2016/slides/replication-of-summary-data-in-indexer-cluster.pdf http://conf.splunk.com/files/2016/slides/lets-customize-those-visualizations.pdf http://conf.splunk.com/files/2016/slides/optimized-search-optimization.pdf ... View more

Hey Sekar, I am working on the similar use case and I am impressed with your answer. But my table has Dynamic column names i.e Month names and I only need to use previous 3 months names like lets say we are in august then I have to show data for may, june, july. So how can I use your search to show up the month names. and also i wanted to use chart command instead of table. Below is my query I've tried and I am failing with that. I am not able to include my dashboard screenshot here. Below is how my table looks like and eventually i wanted to add those months values and show up total count in Total Column. Server_name JUNE JULY AUGUST Total Host1 Patched Patched Patched 3 host2 NotPatched Patched NotPatched 1 host3 NotPatched NotPatched NotPatched 0 index="win" sourcetype="windowsupdatelog" | search "Deployment" AND "AGENT_INSTALLING_SUCCEEDED" | rex field=_raw "^(?:[^:\n]:){9}\s+(?P.+)" | eval servers = Upper(mvindex(split(host,"."),-0)) | eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") | eval day = strftime(start, "%a") | eval month = Upper(date_month) | replace "*KB" WITH "Patched" IN ApplicablePatch |eval count=if(JANUARY="Patched ",1,0) |eval count=count+if(FEBRUARY="Patched ",1,0) |eval count=count+if(MARCH="Patched ",1,0) |eval count=count+if(APRIL="Patched ",1,0) |eval count=count+if(MAY="Patched ",1,0) |eval count=count+if(JUNE="Patched ",1,0) |eval count=count+if(JULY="Patched ",1,0) |eval count=count+if(AUGUST="Patched ",1,0) |eval count=count+if(SEPTEMBER="Patched ",1,0) |eval count=count+if(OCTOBER="Patched ",1,0) |eval count=count+if(NOVEMBER="Patched ",1,0) |eval count=count+if(DECEMBER="Patched ",1,0) | stats values(ApplicablePatch) as ApplicablePatch sum(count) as Total by servers month | mvexpand servers | chart values(ApplicablePatch) as InstalledPatch values(Total) as Totals by servers month | fillnull value="Not Patched" ... View more

Check this link, https://answers.splunk.com/answers/63730/using-fieldformat-and-rename.html It seems that there is a bug or may be splunk has purposely made it that way! ... View more

Hi Sundareshr, Thanks for your revert. I understand that fieldformat can be used to retain the orignal value of field but i am not able to apply or may be it is not working in my query. Below is my query can you help me to point where exactly and what change do i need to do. index = abc | rename "Name" as Group | lookup parents Node as Group | eval parentsSplit=split(Parents,"|") | table "Group", parentsSplit, "Critical Count" | search parentsSplit="*_OS*" | rename "Critical Count" as new | join type=outer Group [search index = abc | rename "Name" as Group | lookup parents Node as Group | eval parentsSplit=split(Parents,"|") | table "Group", parentsSplit, "Critical Count" | search parentsSplit="*_OS*" | rename "Critical Count" as old] | fillnull VALUE=0 | eval delta=new-old | eval delta_perc=if(old==0,round((delta/1)*100,2),round((delta/old)*100,2)) | eval delta_perc = if(abs(delta_perc)>1000000,round(delta_perc/1000000,1)."M",if(abs(delta_perc)>1000,round(delta_perc/1000,1)."K",delta_perc)) | eval result=if((abs(new)>1000000),round(new/1000000,1)."M",if((abs(new)>1000),round(new/1000,1)."K",round(new,2)))." (".if ((abs(delta)>1000000),if(round(delta/1000000,0)>0,"+".round(delta/1000000,1)."M",round(delta/1000000,1)."M"),if((abs(delta)>1000),if(round(delta/1000,0)>0,"+".round(delta/1000,1)."K",round(delta/1000,1)."K"),if(round(delta,2)>0,"+".round(delta,2),round(delta,2))))."/".delta_perc."%)" | table Group, result | rename result AS "Val1" The output of above search query is as below Group | Val1 A |18.4K (-2.3K/-10.99%) B |1.1M (+217.1K/25.38%) C |313.6K (+236.0K/303.90%) D |3.4M (+2.0M/148.51%) E |44.00 (+22.00/100.00%) So now when i click on Val1 i want it to get sorted as M -> K -> Number && Number -> K -> M Can you help me where and how fieldformat will work in the above query? Thanks! ... View more

Inability to separate dotted styles by series makes it impractical to print multi-series Splunk charts with black ink for more than about three series. Trying to tell the lines apart by grayscale shade is tough beyond that. We really need this capability to be restored to Splunk. ... View more

Yes kind off! i was looking for alternatives But for time being, this can be good to go! ... View more