Hi,   When configuring dependencies between services, is it possible to filter down the entities for the dependent KPIs?   For example: I have a service called "OS Performance Monitoring", and CPU Utilization is a KPI, split by 80 entities. If I create another service called Application X, which has 5 entities out of the 80, and if I select the KPI as a dependency, the rolled up value will be for all 80 entities, or just the 5 ones configured for the application service? ... View more

Hi, I've been struggling with the horseshoe visualisation for a couple days. I have a specific scenario I would like to present but not sure if this can be done: I have a table with 2 rows and 3 fields per row: source, count, status. Example: source,count,status sourceA,200,0(not breached) sourceB,100,0(not breached) sourceC, 100,1(breached) I would like to show a horseshoe per source (trellis) where the dial shows the count but the color is based on the status. So, for instance, sources B and C would be similar looking (count-wise) but the color would be different as one is breached and the other one is not... Is that possible? I've seen some posts about showing a different value as a token, but this doesn't work because 1-I need to work with multiple sources and 2-Each row may have its own threshold.... Thanks! 🙂 ... View more

Hi guys & girls, about the following query: | makeresults | eval expectedm="10" | eval expectedM="1" | eval match=case(match(expectedm, expectedM), "Yes", true(), "No") | eval match1=if(expectedm=expectedM, "Yes", "No") ...Why are the results different? It's almost like the MATCH command is adding a hidden .* at the end of the string ... If so, how to fix this? Thank you, Robert ... View more

Hi, I am currently onboarding some data from a different instance of Splunk using a REST API call ... The data produced is JSON and it includes, sourcetype, source, host, _time and _raw. Is there any way I can match the details from the JSON extract to the corresponding fields in my local instance (i.e., source, sourcetype and host)? How can I also get Splunk to automatically extract the results._raw field? Do I need to create field extraction for all fields? the event is currently being onboarded like this: 7/18/19 4:15:00.041 AM { [-] offset: 7 preview: false result: { [-] _raw: 2019-07-18 02:15:00.041, LONG_RUN_TX="0" _serial: 3 _si: [ [+] ] _sourcetype: sql_x _subsecond: .041 _time: 2019-07-18 02:15:00.041 GMT host: SQL01 source: sqlx_extract_log sourcetype: sqlx_extract } } Thank you. ... View more

Hi, I know there is an Exchange app for Splunk, and it covers a few different use cases, such as performance, usage, health, etc ... But ... is there an app which can actually onboard data from mailboxes, i.e., received/sent emails including metadata, attachments, body, headers, etc...? Thank you. ... View more