Thanks tiagofbmm, this solved my question. ... View more

Hi Nabeel, I am more concern on how to get the chart out then the colouring. Thanks. ... View more

Hi David, I am current running my stats by Ticket_Status. How would i go about in using stats by weeks if i am already using Ticket_status as my by clause? Thanks. ... View more

Would it be possible to achieve this without javascripts? ... View more

Hi @DavidHourani , Thanks for the information provided. Would like to know how to create a chart like this in splunk. So far I was only able to get the chart to show the modules and statuses which is pending and In progress . How woud I be able to add the column of date to show different months? Much appreciated. Thanks ... View more

Hi if i want to add the results of INC Tickets Resolved by resolved into this search , how can i do it? thanks ... View more

Hi gouravdashtcs , Thanks for the help! I have tried the code above and found out that the stats earliest didn't produce any results when i ran a table for it. Hence I am not fetching any results currently. Am trying to work on it to see what is wrong. Would appreciate your help on this! Thanks. |stats earliest(Last_Resolved_Date) as first_week_date, latest(Last_Resolved_Date) as last_week_date by week_no I have tried using first and last command instead , but the results fetched were all 1. |stats first(Last_Resolved_Date) as first_week_date, last(Last_Resolved_Date) as last_week_date by week_no However, I would not need the date to be display in that format. Just showing the week and year is enough. My trouble now is on how I could display both the INC report and INC resolved results together . I would like to count the INC_reported by week_no while INC_Resolved by week_no2. I have also realise that when i try to do 2 stats count with count(Incident_Number) only 1 column of value would show up. index=* |dedup Incident_Number |table Last_Resolved_Date Incident_Number Reported_Date |sort -Last_Resolved_Date |sort -Reported_Date |eval week_no=strftime(Last_Resolved_Date, "%Y-%W") |eval week_no2=strftime(Reported_Date, "%Y-%W") |stats count(Incident_Number) as INC_Resolved, count as INC_Reported by week_no ... View more

HI gouravdashtcs, I have tried the code above but my results display were " No Results Found" Not sure if its regarding the format my Last_Resolved_Date is in , but here is the format of my Last_Resolved_Date="1557384854" index=* |dedup Incident_Number|table Last_Resolved_Date Incident_Number|eval week_no=strftime(Last_Resolved_Date, "%W") |stats earliest(Last_Resolved_Date) as first_week_date, latest(Last_Resolved_Date) as last_week_date by week_no |convert timeformat="%d-%m-%Y" ctime(first_week_date) ctime(last_week_date) |eval Week = first_time. " To " .last_time |stats count(Incident_Number) as INC_Count by Week Thanks! ... View more

Hi, The results I'm looking for are as shown. Thanks! _time Inflow closed (Inflow - closed) ( accumulated (inflow - closed ) ) Jan 10 | 5 | 5 | 5 Feb 10 | 5 | 5 | 10 Mar 20 | 7 | 13 | 23 ... View more

I have tried this out and only the first stats count results was displayed. ... View more

Hi, Still have not been able to get a solution for this. Is there anyone with a solution for this? Thanks! ... View more

Hi , I have attached a screenshot of what I am seeing. https://imgur.com/a/JWC77Tc ... View more

Hi , Yes I have records in that duration, have also tried all time but it still shows no results found. Thanks ... View more

Hi Have tried out the query and not sure if I am doing it right as it has return no results found. Thanks! Have attached my query below. <row> <panel> <input type="time" token="time1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" depends="$hide$"> <search> <query>|makeresults </query> <earliest>$time1.earliest$</earliest> <latest>$time1.latest$</latest> <progress> <eval token="toEarliest">strptime($job.earliestTime$,"%Y-%m-%d%H:%M:%S.%Q")</eval> <eval token="toLatest">strptime($job.latestTime$,"%Y-%m-%d%H:%M:%S.%Q")</eval> <set token="jobEarliest">$job.earliestTime$</set> <set token="jobLatest">$job.latestTime$</set> </progress> </search> </input> </panel> </row> <row> <panel> <title>SLA Email Response Time Breached Rate %</title> <single> <search base="base_search"> <query>|eval earliest = $toEarliest$ |eval latest = if($toLatest$ &lt;0,now(),$toLatest$) |where _time &gt;=earliest AND _time &lt;=latest |where reportedsource="Email"|stats count(eval(responsetime &gt;2)) as "Breached" , count(eval(reportedsource ="Email")) as total_count | eval percentage= round((Breached/total_count)*100,2) |eval Breached Rate=percentage| table "Breached Rate"</query> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[50,80]</option> <option name="refresh.display">preview</option> <option name="unit">%</option> <option name="unitPosition">after</option> <option name="useColors">1</option> </single> </panel> ... View more

Hi vnravikumar, Could you provide some explanation as I'm kind of new to splunk and have some trouble understanding how this works. Greatly appreciated. Thanks! ... View more

@vnravikumar Yes I have a base query in my code. Is there still any approach I could take to do up individual time filters with a base query while keeping my global filter that filters everything together? Thanks! ... View more

Hi renjith, How would i go about on checking the timezone for my user setting and event settings. Thanks! Best Regards, Aloysius ... View more