Hi Team, Im trying to combine events which are generated in a specific span of 1hr and show the count as 1 instead of the actual count. I tried with a bucket and its clubbing them the count is still not coming to 1. Irrespective of how many events has been geenrated for a specific condition in a span of 1hr I want to keep it as count 1. Can someone help on how to achieve this .Thanks ... View more

Hi Team, I'm looking for a query to compare Splunk ingestion volume between the current date and a week ago i.e compare today's ingestion volume with exact same day a week ago and get the % difference. Please let me know if there are any queries available preferably with REST Services.Thanks     ... View more

Hi All, I have 2 different queries and I want to combine their results. These 2 queries return a single value output I want these 2 values in the same search result. Thanks for any help.     index=“abc” (TYPE="Run bot finished" OR TYPE="Run bot Deployed") | search STATUS=Successful TYPE="Run bot finished" | stats count |rename count as Success_Count index = “abc” RPAEnvironment = "prd" ProcessName = "*" LogType = "*" TaskName = "*Main*" (LogLevel=ERROR OR LogLevel=FATAL) | eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S") | eval LogDescription = trim(replace(LogDescription, "'", "")) | eval LogMessage = trim(replace(LogMessage, "'", "")) | eval TaskName = trim(replace(TaskName, "'", "")) | eval host=substr(host,12,4) | eval Account=if(User!= "" ,User,LoginUser) | table Time, LogNo, host, Account, LogType, LogMessage, TaskName ,ProcessName | rename LogMessage as "Log Message", TaskName as "Task Name", host as "VDI" | sort - Time|stats count|rename count as Failure_Count                     ... View more

Hi Everyone, I'm working on a Splunk dashboard visualisation using a line chart, and I span the data for every 1week.But the line is not consistent if there is no data and I see dots scattered here and there. Is there a way to optimise this view. Attached is the screenshot. Thanks   index = "abc" Environment = $environment$ ProcessName=*$task$* LogType = "*" TaskName =* |bucket span=1w _time |stats count(eval(LogMessage = "errorneously")) as Failed_Count, count(eval(LogMessage = "execution")) as Success_Count ,count(eval(LogMessage = "execution2")) as Success_Count1 by _time |eval tot_count= Failed_Count + Success_Count + Success_Count1|eval scount=Success_Count + Success_Count1 | eval succ_per=round((scount/tot_count)*100,0) |timechart span=1w avg(succ_per)       ... View more

Hi Splunkers, We are looking for a solution to send the Splunk data to the snowflake schema using DB connect. Anyone has implemented this setup if yes, please let me know the solution here . Thanks in advance. ... View more

I have a dashboard that has 5 single value charts in 4 rows and all these rows display collective information about more than 1 process and now I'm using a drill down to a new dashboard to display detailed info about them. Is there a way we can add a button or split view kind of thing in the same dashboard when someone clicks on that button it should display that and should have hide or unhide functionality rather than using drilldown.Any help is highly appreciated.Thanks ... View more

I have 2 Dashboards and the second dashboard is a drill-down for the 1st one. Everything is working as expected but in the second dashboard, the post-processing search is not working. I want to hide the rows if any of the panels in that row has 0 as output.I tried many ways but not working. I'm pasting the code for 2 dashboards here, please let me know what is missing. Thanks for the help Dashboard: 1 has this drill down: <drilldown> <link target="_blank">/app/search/business_detailed?form.time_second_dashboard.earliest=$field1.earliest$&amp;form.time_second_dashboard.latest=$field1.latest$&amp;form.environment=$env$&amp;form.task=$click.value$</link> </drilldown>   Dashboard 2 : Code   <form> <label>business_detailed</label> <fieldset submitButton="false"> <input type="time" token="time_second_dashboard"> <label>Select Time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="environment"> <label>Environment</label> <choice value="&quot;UAT&quot;">UAT</choice> <choice value="&quot;PROD&quot;">PROD</choice> <fieldForLabel>env</fieldForLabel> <fieldForValue>env</fieldForValue> </input> <input type="dropdown" token="task"> <label>BOT Process</label> </input> </fieldset> <row > <panel rejects= "$panel_show$" > <single> <search> <query>| makeresults |eval bot="cp Main"|table bot</query> <earliest>$time_second_dashboard.earliest$</earliest> <latest>$time_second_dashboard.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> <panel rejects= "$panel_show$" > <single> <title>Total Runs</title> <search> <query>index = "abc" env =$environment$ LogType = "*" TaskName = $task$-Main | eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S") |eval LogDescription = trim(replace(LogDescription, "'", "")) |eval LogMessage = trim(replace(LogMessage, "'", "")) |eval TaskName = trim(replace(TaskName, "'", "")) |eval host=substr(host,12,4) | rename TaskName as "Task Name", host as "VDI" | stats count(eval(LogMessage = "FATAL: process ended errorneously")) as Failed_Count, count(eval(LogMessage = "END: cp-Main execution")) as Success_Count1 |eval tot_count= Failed_Count + Success_Count1|table tot_count</query> <earliest>$time_second_dashboard.earliest$</earliest> <latest>$time_second_dashboard.latest$</latest> <progress> <condition match="$job.resultCount$ == 0"> <set token="panel_show">true</set> </condition> <condition> <unset token="panel_show"></unset> </condition> </progress> </search> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="link.visible">0</option> <option name="rangeColors">["0x53a051","0x0877a6","0xdc4e41"]</option> <option name="rangeValues">[0,100000000]</option> <option name="refresh.display">progressbar</option> <option name="refresh.link.visible">1</option> <option name="useColors">1</option> </single> </panel> <panel rejects="$panel_show$"> <single> <title>Process completed Successfully</title> <search> <query>index = "abc" env = $environment$ LogType = "*" TaskName = $task$-Main LogMessage= "END: cp-Main execution" | eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S") |eval LogDescription = trim(replace(LogDescription, "'", "")) |eval LogMessage = trim(replace(LogMessage, "'", "")) |eval TaskName = trim(replace(TaskName, "'", "")) |eval host=substr(host,12,4) | table Time, LogNo, host, LogType, LogMessage, TaskName | rename LogMessage as "Log Message", TaskName as "Task Name", host as "VDI" | sort - Time|stats count</query> <earliest>$time_second_dashboard.earliest$</earliest> <latest>$time_second_dashboard.latest$</latest> </search> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0xdc4e41"]</option> <option name="rangeValues">[1000000000]</option> <option name="refresh.display">progressbar</option> <option name="link.visible">false</option> <option name="refresh.link.visible">true</option> <option name="useColors">1</option> </single> </panel> <panel rejects="$panel_show$"> <single> <title>Process completed with Error</title> <search> <query>index = "abc" env = $environment$ LogType = "*" TaskName = $task$-Main "FATAL: process ended errorneously"| eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S") |eval LogDescription = trim(replace(LogDescription, "'", "")) |eval LogMessage = trim(replace(LogMessage, "'", "")) |eval TaskName = trim(replace(TaskName, "'", "")) |eval host=substr(host,12,4) | table Time, LogNo, host, LogType, LogMessage, TaskName | rename LogMessage as "Log Message", TaskName as "Task Name", host as "VDI" | sort - Time|stats count</query> <earliest>$time_second_dashboard.earliest$</earliest> <latest>$time_second_dashboard.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="rangeColors">["0xdc4e41","0xdc4e41"]</option> <option name="rangeValues">[10000000]</option> <option name="refresh.display">progressbar</option> <option name="link.visible">false</option> <option name="refresh.link.visible">true</option> <option name="useColors">1</option> </single> </panel> <panel rejects="$panel_show$"> <single> <title>Success Percent</title> <search> <query>index = "abc" env = $environment$ LogType = "*" TaskName =$task$-Main | eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S") |eval LogDescription = trim(replace(LogDescription, "'", "")) |eval LogMessage = trim(replace(LogMessage, "'", "")) |eval TaskName = trim(replace(TaskName, "'", "")) |eval host=substr(host,12,4) | rename TaskName as "Task Name", host as "VDI" | stats count(eval(LogMessage = "FATAL: process ended errorneously")) as Failed_Count, ,count(eval(LogMessage = "END: cp-Main execution")) as Success_Count1 | eval tot_count= Failed_Count + Success_Count1 | eval succ_per=round((Success_Count1/tot_count)*100,0)|table succ_per</query> <earliest>$time_second_dashboard.earliest$</earliest> <latest>$time_second_dashboard.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="rangeColors">["0x581845","0xdc4e41"]</option> <option name="rangeValues">[100]</option> <option name="refresh.display">progressbar</option> <option name="link.visible">false</option> <option name="refresh.link.visible">true</option> <option name="unit">%</option> <option name="useColors">1</option> </single> </panel> </row> <row depends="$panel_show1$"> <panel> <single> <search> <query>| makeresults |eval bot="cp Adhoc"|table bot</query> <earliest>$time_second_dashboard.earliest$</earliest> <latest>$time_second_dashboard.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> <panel> <single> <title>Total Runs</title> <search> <query>index = "abc" env =$environment$ LogType = "*" TaskName = $task$-Main-Adhoc | eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S") |eval LogDescription = trim(replace(LogDescription, "'", "")) |eval LogMessage = trim(replace(LogMessage, "'", "")) |eval TaskName = trim(replace(TaskName, "'", "")) |eval host=substr(host,12,4) | rename TaskName as "Task Name", host as "VDI" | stats count(eval(LogMessage = "FATAL: process ended errorneously")) as Failed_Count, count(eval(LogMessage = "END: process execution")) as Success_Count1 |eval tot_count= Failed_Count + Success_Count1|table tot_count</query> <earliest>$time_second_dashboard.earliest$</earliest> <latest>$time_second_dashboard.latest$</latest> <sampleRatio>1</sampleRatio> <progress> <condition match="'job.resultCount' > 0"> <set token="panel_show1">true</set> <unset token="panel_hide1"></unset> </condition> <condition> <set token="panel_hide1">true</set> <unset token="panel_show1"></unset> </condition> </progress> </search> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="link.visible">0</option> <option name="rangeColors">["0x53a051","0x0877a6","0xdc4e41"]</option> <option name="rangeValues">[0,100000000]</option> <option name="refresh.display">progressbar</option> <option name="refresh.link.visible">1</option> <option name="useColors">1</option> </single> </panel> <panel> <single> <title>Process completed Successfully</title> <search> <query>index = "abc" env = $environment$ LogType = "*" TaskName = $task$-Main-Adhoc LogMessage= "END: process execution" | eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S") |eval LogDescription = trim(replace(LogDescription, "'", "")) |eval LogMessage = trim(replace(LogMessage, "'", "")) |eval TaskName = trim(replace(TaskName, "'", "")) |eval host=substr(host,12,4) | table Time, LogNo, host, LogType, LogMessage, TaskName | rename LogMessage as "Log Message", TaskName as "Task Name", host as "VDI" | sort - Time|stats count</query> <earliest>$time_second_dashboard.earliest$</earliest> <latest>$time_second_dashboard.latest$</latest> </search> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0xdc4e41"]</option> <option name="rangeValues">[1000000000]</option> <option name="refresh.display">progressbar</option> <option name="link.visible">false</option> <option name="refresh.link.visible">true</option> <option name="useColors">1</option> </single> </panel> <panel> <single> <title>Process completed with Error</title> <search> <query>index = "abc" env = $environment$ LogType = "*" TaskName = $task$-Main-Adhoc "FATAL: process ended errorneously"| eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S") |eval LogDescription = trim(replace(LogDescription, "'", "")) |eval LogMessage = trim(replace(LogMessage, "'", "")) |eval TaskName = trim(replace(TaskName, "'", "")) |eval host=substr(host,12,4) | table Time, LogNo, host, LogType, LogMessage, TaskName | rename LogMessage as "Log Message", TaskName as "Task Name", host as "VDI" | sort - Time|stats count</query> <earliest>$time_second_dashboard.earliest$</earliest> <latest>$time_second_dashboard.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="rangeColors">["0xdc4e41","0xdc4e41"]</option> <option name="rangeValues">[10000000]</option> <option name="refresh.display">progressbar</option> <option name="link.visible">false</option> <option name="refresh.link.visible">true</option> <option name="useColors">1</option> </single> </panel> <panel> <single> <title>Success Percent</title> <search> <query>index = "abc" env = $environment$ LogType = "*" TaskName =$task$-Main-Adhoc | eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S") |eval LogDescription = trim(replace(LogDescription, "'", "")) |eval LogMessage = trim(replace(LogMessage, "'", "")) |eval TaskName = trim(replace(TaskName, "'", "")) |eval host=substr(host,12,4) | rename TaskName as "Task Name", host as "VDI" | stats count(eval(LogMessage = "FATAL: process ended errorneously")) as Failed_Count, ,count(eval(LogMessage = "END: process execution")) as Success_Count1 | eval tot_count= Failed_Count + Success_Count1 | eval succ_per=round((Success_Count1/tot_count)*100,0)|table succ_per</query> <earliest>$time_second_dashboard.earliest$</earliest> <latest>$time_second_dashboard.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="rangeColors">["0x581845","0xdc4e41"]</option> <option name="rangeValues">[100]</option> <option name="refresh.display">progressbar</option> <option name="link.visible">false</option> <option name="refresh.link.visible">true</option> <option name="unit">%</option> <option name="useColors">1</option> </single> </panel> </row> </form>   In the second Dashboard I want to hide the entire row if any Total Runs panel has 0 as output . I tried but its not working. Is there anything messing up with the tokens from dashboard -1   I tried both depends and rejects but its not working  <progress> <condition match="$job.resultCount$ == 0"> <set token="panel_show">true</set> </condition> <condition> <unset token="panel_show"></unset> </condition> </progress> ... View more

I have a  KPI dashboard with all single value panels, I'm passing the time token from this dashboard to other dashboard using drill-down options but Im also looking to get click.value from a single panel to pass it as input token for another dashboard but its not working , Is there any other way we can capture the value on the single value panel and pass it to other dashboard Any help is highly appreciated. Thanks ... View more