I am using this query index=dtwn sourcetype = sessionserver Serverid=$sev$ | dedup _raw | join Serverid [search index=dtwn sourcetype=latencyuser $user$ | rename Server AS Serverid] | chart max(Max_Session_Startup_sec) AS "Max Session Startup - Sec" max(Max_Profile Load_sec) AS "Max Profile Load - Sec" max(Max_Obtain_Creds_sec) AS "Max Obtain Credentials" max(Max_Logon_Script_sec) AS "Max Login Script (secs)" avg(Avg_Session_Startup_sec) AS "Avg Session Startup - Sec" avg(Avg_Profile_Load_sec) AS "Avg Profile Load - Sec" avg(Avg_Obtain_Creds_sec) AS "Avg Obtain Credentials" avg(Avg_Logon_Script_sec) AS "Avg Login Script (secs)" by Serverid | head 20 I want the common values as well as the non common ones: common ones only for the same dashboard and non commons for the drilldown purpose. Is there any way that I can use join with If and case statements? ... View more

Where do we find the libraries of splunkjs like "splunkjs/mvc/searchmanager" , "splunkjs/mvc/tableview" how many libraries are there? and what all methods are defined in those libraries? ... View more