Hi @lish123 ,   I have developed solution based on timestamp in sample data you provided. Is there any more types of timeformat in the log ? Regards. ... View more

Hi @lish123 , Please place below parameters in props.conf, replace SOURCETYPENAME with actual sourcetype.  If you are aware about regex, you can define your own regex [SOURCETYPENAME] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) TIME_PREFIX = \<(?<Time>\w{3} \d{1,2}, \d{4} \d{1,2}:\d{2}:\d{2}[,\d{3}]* PM CST)\> TIME_FORMAT = %b %d, %Y %I:%M:%S,%Q %p %Z   Regards.  ... View more

I believe this can be helpful to you | makeresults | eval data="14/01/2020 10:00:00,first;13/01/2020 11:00:00,second;13/01/2020 12:00:00,third;13/01/2020 13:00:00,forth;" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval timefield=mvindex(data,0),header=mvindex(data,1) | table timefield header | streamstats min(timefield) as StartTime max(timefield) as EndTime | tail 1       ... View more

What is your requirement ? are you looking for ingesting these 2 events in splunk with 2 time format ?  or you are looking to make constant time format for an all event when ingested to splunk . I can try to provide solution once requirement are specified.  Meanwhile for both type of question you will get answer in example of below documentation.  ... View more

@vamshiverma , Kindly accept answer for question, which is most helpful, So that others can use it if required.  Regards,  Ankush ... View more

index=myindex sourcetype=foo.bar* | eval status=case(like(DETAIL,"%error%"),"Fail",like(DETAIL,"%exception%"),"Fail",true(), "Success") | stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype | fields sourcetype Total Fail Hi @vamshiverma , can you please try using  above.    Regards, Ankush   ... View more

Hi @adonio , Thanks for your help in search anywhere. Thanks, Ankush ... View more

Hi @VatsalJagani , Thanks for your quick help. This solution worked for me. Below is the run anywhere query (@adonio: thanks for providing run anywhere search) | gentimes start=-2 increment=30m | eval _time = starttime | eval number = random()%200 | bin _time span=15m | stats latest(number) as COUNT by _time | eval _time=_time/100 | eval _time=if(_time%2==0,_time-9,_time) | eval _time=_time*100 | chart last(COUNT) as COUNT over _time Regards, Ankush ... View more

It can be achieve using case also - I have used case, Thanks to @varun99 for providing concept. <format type="color" field="status"> <colorPalette type="expression">case(like(value,"ok"),"#53A051",like(value,"warn"),"#F8BE34", !like(value,"ok"),"#DC4E41")</colorPalette> </format> ... View more

@rpradeep , To use above solution, if you are trying to show vacation from 01-Apr-2019 to 05-Apr-2019, you need to have 5 rows in your data as below - Pradeep,01-Apr-2019 Pradeep,02-Apr-2019 Pradeep,03-Apr-2019 Pradeep,04-Apr-2019 Pradeep,05-Apr-2019 this will show you required details over a dashboard. I am not sure how to help you out in changing the data format. ... View more

@rpradeep can you please share screen shot with error, it will be easy to understand. ... View more

Hi @kenntun , I have used above data as input and loaded it into Splunk. Below is one possible solution. I hope this solution can help you. P.S.: I have used sorting on the basis of hostname and mount and accordingly. | makeresults | eval data="host1,x, , ;host2,x, , ;host3,x, , " | makemv data delim=";" | mvexpand data | makemv data delim="," | eval hostval=mvindex(data,0),mount=mvindex(data,1),Disksize=mvindex(data,2),Free=mvindex(data,3) | table hostval,mount,Disksize,Free | append [search index=test source="C:\\Splunk_Data\\Test\\testdata_splunk.csv" | dedup hostval,mount | table hostval,mount,Disksize,Free ] | sort hostval,mount | eval hostval=if(mount="x","",hostval),mount=if(mount="x"," ",mount) ... View more

@utk123 , To get result of above subsearch, src field result need to be present in Search 1. If this criteria is fulfilled, then query will work. n events will be return by search. Please refer below queries - Below query will return the result- index=_internal group=pipeline [search index=_internal component=Metrics | top limit=1 name | table name] Below Query might not return a result index=_internal group=executor [search index=_internal component=Metrics | top limit=1 name | table name] PS: Above queries are heavy query. ... View more

Hi @jip31 , I have checked the dashboard color coding using anywherre search, it was working correctly. Please try changing your query to, hopefully it will work. | loadjob savedsearch="admin:FO_Workstations_Monitoring:FO_Workstations_Disk_Status" | search host="$tok_filterhost$" | fields - host | eval state="BAD" | dedup state | table state ... View more

Hi @jip31 , In Code you have used 2 different panel and single. Below changes required : Use CSS code in both Panel. Give "id" to second panel single tag. NOTE: Make sure you are using different token name in eval tag. If token name in eval match with other panel token then there are changes of wrong color coding. Token will be set by last visualization, last eval tag. <done> <eval token="tokColor2">case($result.state$=="GOOD","#53a051",true(),"#dc4e41")</eval> </done> Please find below changed code : <dashboard> <label>Single Value Color By Rangemap</label> <row> <panel> <title>Disk Remaining Space Status</title> <html depends="$alwaysHideCSSStylePanel$"> <style> #singleWithCSSOverride1 svg.svg-container rect{ fill: $tokColor1$ !important; } </style> </html> <single id="singleWithCSSOverride1"> <title>Good : &gt; 15% - Bad : &lt; 15%</title> <search> <done> <eval token="tokColor1">case($result.state$=="GOOD","#53a051",true(),"#dc4e41")</eval> </done> <query>| loadjob savedsearch="admin:FO_Workstations_Monitoring:FO_Workstations_Disk_Size" | search host="$tok_filterhost$" | fields - host | eval state="GOOD"</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="colorMode">block</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> <panel> <title>Disk Health Status</title> <html depends="$alwaysHideCSSStylePanel$"> <style> #singleWithCSSOverride2 svg.svg-container rect{ fill: $tokColor2$ !important; } </style> </html> <single id="singleWithCSSOverride2"> <title>Good : Status = OK - Bad : Status = Not OK</title> <search> <done> <eval token="tokColor2">case($result.state$=="GOOD","#53a051",true(),"#dc4e41")</eval> </done> <query>| loadjob savedsearch="admin:FO_Workstations_Monitoring:FO_Workstations_Disk_Status" | search host="$tok_filterhost$" | fields - host | eval state="BAD"</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="rangeColors">["0x555","0x555"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> </row> </dashboard> ... View more

Hi @niketnilay , It worked, Thank you for help ! and Thanks for providing logic. I have made some small changes in Step 3 query to match the color code. I am posting the Changed code for other people reference below. Changes : 1. To check Null values function used - isnull(). 2. Additional condition added. Step 3 : With Changes: | transpose 0 header_field="Header" column_name="Header" | foreach "group*_group_row_no1" [| eval "<<FIELD>>"=case(isnull(<<FIELD>>) AND isnull(group<<MATCHSTR>>_group_row_no2) AND isnull(group<<MATCHSTR>>_group_row_no3) ," |White", isnotnull(<<FIELD>>) AND isnull(group<<MATCHSTR>>_group_row_no2) AND isnull(group<<MATCHSTR>>_group_row_no3) ,<<FIELD>>."|Yellow", isnotnull(<<FIELD>>) AND isnotnull(group<<MATCHSTR>>_group_row_no2) AND isnotnull(group<<MATCHSTR>>_group_row_no3) ,<<FIELD>>."|Green", true(),<<FIELD>>)] | foreach "group*_group_row_no2" [| eval "<<FIELD>>"=case(isnull(group<<MATCHSTR>>_group_row_no2) and match(group<<MATCHSTR>>_group_row_no1,"dummy|Yellow")," |Yellow", isnull(group<<MATCHSTR>>_group_row_no2) and match(group<<MATCHSTR>>_group_row_no1,"dummy|White")," |White", match(group<<MATCHSTR>>_group_row_no1,"dummy|Green"),<<FIELD>>."|Green", match(group<<MATCHSTR>>_group_row_no1,"dummy|Yellow"),<<FIELD>>."|Yellow", match("group<<MATCHSTR>>_group_row_no1","|White"),<<FIELD>>."|White", true(),<<FIELD>>)] | foreach "group*_group_row_no3" [| eval "<<FIELD>>"=case(isnull(group<<MATCHSTR>>_group_row_no3) and match(group<<MATCHSTR>>_group_row_no1,"dummy|Yellow")," |Yellow", isnull(group<<MATCHSTR>>_group_row_no3) and match(group<<MATCHSTR>>_group_row_no1,"dummy|White")," |White", match(group<<MATCHSTR>>_group_row_no1,"dummy|Green"),<<FIELD>>."|Blue", match(group<<MATCHSTR>>_group_row_no1,"dummy|Yellow"),<<FIELD>>."|Yellow", match(group<<MATCHSTR>>_group_row_no1,"|White"),<<FIELD>>."|White", true(),<<FIELD>>)] Thanks to @kamlesh_vaghela for CSS and JS. Also Please refer below link for CSS and JS which will be used to color code the cell - https://answers.splunk.com/answers/661894/how-to-color-cell-contents-with-css-and-js.html ... View more

@niketnilay , Thank you for your response.. I will try and will let you know, is it works or not.. Thank You, Ankush ... View more

@kamlesh_vaghela , Thank you for your response - I have gone through this and applied the same, but for this i need to make changes in data which loading it to Splunk, I am trying to avoid that scenario. From the JS I can get current cell value using below code - render: function($td, cell) { var label = cell.value.split("|")[0]; var val = cell.value.split("|")[1]; ... } My requirement will be fulfilled if I get solution to retrieve the data of next 2 rows and I tried to do some changes in JS, but unable to retrieve data of next 2 row cell. Is there any way to get the next row in the same ? ... View more