I am creating a splunk dashboard pie chart panel and the values I am displaying are too large (long strings) to be displayed in a small panel. Is it possible to display the chart values in a readable / concise labels? For e.g., If the below is my sample query: index=network sourcetype=logserver | stats dc(Field.ID) by Field.Message   If Field.Message is "All transfers were successful", I want to display just "Success" in the pie chart If Field.Message is "Some transfers failed", I want to display just "Failed" and so on..   What is the best way to achieve this? Thanks in advance   ... View more

I am trying to create a splunk alert for duplicate data and would like some help in creating the splunk search. The data looks something like this for a giving search time duration Server Ping ID ref0120 60 125gt ref0125 53 456hy ref0365 45 125gt ref0012 32 526yu The alert should look for the following: 1. If I get more than 1 event for the same ID in the specified duration, Trigger an alert 2. In our example, we have 2 events with the same ID '125gt'. I want an alert to be triggered when this happens. Any help would be greatly appreciated! ... View more

Disclaimer : I'm new to Regex and using the Rex function I have a field "Message" that has the following string format: "EWT_Print=282, CIQ=1, Did not meet the threshold, 009s5td" All the Message field values are going to have the same format "EWT_Print=[some number], CIQ=[some number], some text" I am trying to extract the value of the EWT_Print, in this example 282 and display it in a table, however, I always get an empty table when I try this: <my base search> | rex field=Message "EWT_Print=(?<EWT>[0-9]+)*" What am I doing wrong? ... View more