Drill down with transpose not working as expected to fetch the row and colomn values, as its not giving me the accurate results, not sure if this is related to transpose. index=wso2 source="/opt/log.txt" "Count_Reportings" | fields api-rep rsp_time mguuid | bin _time span=1d | stats values(*) as * by _time, mguuid | eval onesec=if(rsp_time<=1000,1,0) | eval threesec=if(rsp_time>1000 and rsp_time<=3000,1,0) | eval threesecGT=if(rsp_time>3000,1,0) | eval Total = onesec + threesec + threesecGT | stats sum(onesec) as sumonesec sum(threesec) as sumthreesec sum(threesecGT) as sumthreesecGT sum(Total) as sumtotal by api-rep, _time | eval good = if(api-rep="High", sumonesec + sumthreesec, if(api-rep="Medium", sumonesec + sumthreesec, if(api-rep="Low", sumonesec, null()))) | eval per_call=if(api-rep="High", (good / sumtotal) * 100, if(api-rep="Medium" , (good / sumtotal) * 100, if(api-rep="Low" , (good / sumtotal) * 100, null()))) | eval per_cal=round(per_call,2) | timechart span=1d avg(per_cal) by api-rep | eval time=strftime(_time, "%Y-%m-%d") | fields - _time _span _spandays | fillnull value=0 | transpose 0 header_field=time column_name=APIs include_empty=true Below is the output for the above query, when i click on the 99.93 then need to pick GOOD and colomn header 2024-06-30 and pass it in the drilldown query When i click on 99.93 from colomn 2024-06-30 it gives me below output, its not giving me the row values as Good. Below are the drildown tokens. tokClickValue1 = $click.value$ tokClickName1 = $click.name$ tokClickValue2 = $click.value2$ tokClickName2 = $click.name2$ tokApi = $row.APIs$ i want token to fetch header and APIs values to pass it to drilldown query.  ... View more

I need to display priority data for 7 days with the percentage, however am unable to display it in 7 days. My below query works for a days search but doesn't displays for 7 days. Could you please help with fixing the query. Below is my query. | multisearch [ search index=myindex source=mysoruce "* from *" earliest=-7d@d latest=@d | fields TRN, tomcatget, Queue ] [ search index=myindex source=mysoruce *sent* earliest=-7d@d latest=@d | fields TRN, TimeMQPut, Status] [ search index=myindex source=mysoruce *Priority* earliest=-7d@d latest=@d | fields TRN,Priority ] | stats values(*) as * by TRN | eval PPut=strptime(tomcatput, "%y%m%d %H:%M:%S") | eval PGet=strptime(tomcatget,"%y%m%d %H:%M:%S") | eval tomcatGet2tomcatPut=round((PPut-PGet),0) | fillnull value="No_tomcatPut_Time" tomcatput | fillnull value="No_tomcatGet_Time" tomcatget | table TRN, Queue, BackEndID, Status, Priority, tomcatget, tomcatput, tomcatGet2tomcatPut | eval E2E_5min=if(tomcatGet2tomcatPut<=300,1,0) | eval E2E_20min=if(tomcatGet2tomcatPut>300 and tomcatGet2tomcatPut<=1200,1,0) | eval E2E_50min=if(tomcatGet2tomcatPut>1200 and tomcatGet2tomcatPut<=3000,1,0) | eval E2EGT50min=if(tomcatGet2tomcatPut>3000,1,0) | eval Total = E2E_5min + E2E_20min + E2E_50min + E2EGT50min | stats sum(E2E_5min) as sum_5min sum(E2E_20min) as sum_20min sum(E2E_50min) as sum_50min sum(E2EGT50min) as sum_50GTmin sum(Total) as sum_total by Priority | eval bad = if(Priority="High", sum_20min + sum_50min + sum_50GTmin, if(Priority="Medium", sum_50min + sum_50GTmin, if(Priority="Low", sum_50GTmin, null()))) | eval good = if(Priority="High", sum_5min, if(Priority="Medium", sum_5min + sum_20min, if(Priority="Low", sum_5min+ sum_20min + sum_50min, null()))) | eval per_cal = if(Priority="High", (good / sum_total) * 100, if(Priority="Medium", (good / sum_total) * 100, if(Priority="Low", (good / sum_total) * 100, null()))) | table Priority per_cal looking to get output in below format.   ... View more

New to splunk, need your help. Data: 4/5/2022 9:02 PM | Audit | hi user | something.MoveFiles | Copied File from C:\hello.txt to server/something.txt 4/5/2022 9:02 AM | Audit | hi user | something.MoveFiles | Copied File from D:\reportsSuccess\_CMS.txt to \\server_CMS.txt 12/15/2022 10:02 PM | Audit | hi user | something.MoveFiles | Copied File from D:\reportsSuccess\_CMS.txt to \\server_CMS.txt 4/4/2022 5:00 AM | Audit | hi user | FileSplitter.ProcessFiles | Started Processing : ID 4/4/2022 5:00 AM | Audit | hi user | FileSplitter.ProcessFiles | Started Processing 4/4/2022 5:00 AM | Audit | hi user | FileReader.FileReader | FileReader for D:\reportsInput\tsst.TXT initilized 4/4/2022 5:00 AM | Audit | hi user | something.something. 11/4/2022 5:00 AM | Audit | hi user | something.something. 10/4/2021 5:00 AM | Audit | hi user | something.something.   12/15/2022 is taking as 2/15/22. Below is the props.conf am using it.   SHOULD_LINEMERGE=true LINE_BREAKER=([/r/n]*)[0-9]+\/[0-9]+\/\d{4}\s[0-9]+:[0-9]+\s[P|A]M TZ=EST TIME_PREFIX =^ BREAK_ONLY_BEFORE=[0-9]+\/[0-9]+\/\d{4}\s[0-9]+:[0-9]+\s[P|A]M Can you please help me to get the correct parsing?  Thanks in advance.     ... View more

Am very new to splunk, i need a query to get the count and percentage of Error, Info and Warnings in a table. Error, Info and Warnings filed is already extracted. Thanks in advance team. Thanks, Nithin Setty ... View more

Hi - Need to create a Splunk dashboard for an application. Am very new to Splunk and doesn't have any Splunk experts within my organization, so need your help. Sample log format: 12-15 20:22:55,671 ERROR - logs/app/applog 1-426 DC1-4 connect fail host:port Connection refused (Connection refused) 12-15 20:25:13,860 INFO - logs/app/applog 1-423 DC1-4 connected host:port Time = 12-15 20:25:13 Status = INFO Log Path = logs/app/applog Stats Status = 1-426 Process = DC1-4 and DC1-4 Whenever apps is having issues connecting to other sources, it throws an error message with the stats status 1-426 for the particular process DC1-4. Once its fixed then INFO (Success) message will be printed in the logs with the stats status - 1-423 for the particular process DC1-4. Requirement: - I need to display the error message (DC1-4 connect fail host:port Connection refused (Connection refused)) in a column until logs have the info message (DC1-4 connected host:port) ... View more