In the past I once knew how to create a single radio button that, when selected, would reset all desired dashboard tokens, by using XML. This button would also reset itself back to being de-selected (not filled).  Does anyone know how to do this?   I learned how to do this previously in one Splunk's courses but I am not entirely sure which course it was. (SF 1-3 or Adv. DB Creation) ... View more

The command I am running is: basesearch | eval number = case ( number = "1" , "Number 1" , number = "2" , "Number 2" , number = "3" , "Number 3" , number = "4" , "Number 4" ) | stats count by number But when I run this I also want to display the values that are undefined in the eval line. How would one go about this? ... View more

I have two fields with the same values but different field names. index= network sourcetype= firewall The source IP field is "src" sourcetype= logins The source IP field is "src_ip" I would like to be able to combine the results of both in a stats table to have a line item contain info from both sourcetypes: example: index=network sourcetype=firewall OR sourcetype=logins |(Whatever I need to do to combine two fields into one) | stats values(username) as Usernames, values(alert) as Alerts by (NEW_Source_IP_Field_Name) ... View more

I am trying to create a cluster map (never successfully been able to do this except in Adv. Dashboards course) by only using a field that contains the country name attributed to the events which are being counted. There are no IPs or Lat/Lon in these events. Any help is greatly appreciated. ... View more

Would it be difficult to create a rex search for an email scheme starting with alpha characters (no set amount of characters) and ending in 3 or more numbers before the "@" symbol of an email address? If anyone knows how and can explain, that would be greatly appreciated! ... View more