Hi, here is the description of the status quo. There is multiselect element defined by a token tkn1. Output variable is “value”. The default and initial value is defined as All. All has its static value “*”. There are 2 items to be picked up. “1”, “2”. The syntax of logic using pick up fcn is: token prefix: value IN ( token suffix: ) token value prefix: “”” token value suffix: ““” delimiter: “,” So if user choose these 2 values except All, the token has its value: value IN ("1","2"). If I use in the query where condition like this: | where $tkn1$ and these 2 items are picked up, everything is ok. Question: if the user choose only All, not working: | where value (“*”) Any idea, how to handle with it, please? ... View more

Hi, any help, pls? Here is the description: lookupTable(links.csv):columnName(Link) lookupTable(links.csv):columnValue(https://www.google.com) in the dashboard Table Visu: | inputlookup links.csv | head 1 | table Link how to click on the tableCell (https://www.google.com) and new browser window with the https://www.google.com will be opened?   ... View more

Hi, any help, please? Here is the code | makeresults | eval tmp_1=1 | eval tmp_2="" | eval tmp_3=3 | eval tmp="" | foreach tmp_* [| eval tmp = tmp ."|".if(isnotnull(<<FIELD>>),<<FIELD>>,"")] | eval tmp=substr(tmp, 2) | table tmp Output is: tmp=1||3 I would like to have output tmp="1|3", it means how to skip the step in foreach, if the <<FIELD>> is null? ... View more

Hi, any help, please. Here the situation machine1: Windows 2016 with Splunk 7.1.2 machine2: Windows 2022 with Splunk 9.4.4 (splunk installed already here) How to migrate the Splunk env from machine1 to machine2? ... View more

Hi, can anybody help, please? Description of very simple problem | makeresults | eval tmp1=1, tmp2=1 | table tmp1, tmp2 How to add new event based on values of tmp1, tmp2? Expected results 2 rows\2events 1 row: tmp1=1, tmp2=1 2 row: tmp1=tmp1+1, tmp2=tmp2*5   ... View more

Hi, can anybody help, please? Here the status quo: In the Dashboard there is time picker object. selected time range: 2025.08.25 07:00:00 - 2025.08.25 22:00:00 (it can be universall picked with the user) goal: to have a pie chart, where the duration of several signals (state) in selected time range is displayed. simple query: | sort Zeitstempel | delta Zeitstempel as dlt | table Zeitstempel, Zeit, state, dlt results: pie chart code something like this: | eval dlt=abs(dlt) | stats sum(dlt) as Status by state Problem: The start of the time range is 2025.08.25 07:00:00. The first event comes at 2025.08.25 07:44:15. Is there a possibility to catch somehow the information about the event before 2025.08.25 07:00:00, to catch the state and to calculated the duration of this state in the range 2025.08.25 07:00:00-2025.08.25 07:44:15? ... View more

Hi, can anybody help, please? Here the code and small description. | inputlookup tmp.csv | where workplaceId=111 | sort - Zeitstempel | tail [ | inputlookup tmp.csv | where workplaceId=111 | sort - Zeitstempel | stats count as search | eval search=search-1 | fields search]] | append [ | inputlookup tmp.csv | where workplaceId=112 | sort - Zeitstempel | tail [ | inputlookup tmp.csv | where workplaceId=112 | sort - Zeitstempel | stats count as search | eval search=search-1 | fields search]] | eval prod="testtest" | eval _time=Zeitstempel | fields _time, Zeit, Zeitstempel, workplaceId, workplace, App, state, prod | collect index=workplace source="workplace_app" addtime=f testmode=f Description: the code takes the [first:last-1] entries from the lookup table tmp.csv for every specific workplaceId. An error occures, if there is count(workplaceId)<2 entries. Goal: how to skip, if | stats count as search <2? How to skip the whole append part of the code. Or is there any exception for error states of tail? Or any idea for smart workaround? I can send to index empty, or dummy entries.  ... View more

Hi, any support please. I have 2 lookups. tmp1_1.csv WorkplaceId,PK1,Description,Contract 1234567890,7535712,Contract1,19 1123456789,7535712,Contract2,18 1234567890,7456072,Contract3,14 1234567890,7456072,Contract4,15 1234567891,7456072,Contract5,16 tmp1_2.csv WorkplaceId,State,Timestamp,ContractId 1234567890,Start,1752838050,12 1234567890,End,1752838633,12 1123456789,Start,1752838853,13 1123456789,Break,1752839380,13 1123456789,End,1752839691,13 1234567890,Start,1752839720,14 1234567890,Start,1752839745,15 1234567891,Start,1752839777,16 1234567891,Start,1752839790,18 1234567890,Start,1752839892,19   The primary key between these tables is WorkplaceId,Contract=WorkplaceId,ContractId The task is always to select the content from tmp1_2.csv based on conditions cond1: select everything from tmp1_2.csv where WorkplaceId,Contract!=WorkplaceId,ContractId. In this case the result should be WorkplaceId,State,Timestamp,ContractId 1234567890,Start,1752838050,12 1234567890,End,1752838633,12 1123456789,Start,1752838853,13 1123456789,Break,1752839380,13 1123456789,End,1752839691,13 2. cond2: select everything from tmp1_2.csv where WorkplaceId,Contract=WorkplaceId,ContractId. In this case the result should be WorkplaceId,State,Timestamp,ContractId 1234567890,Start,1752839720,14 1234567890,Start,1752839745,15 1234567891,Start,1752839777,16 1234567891,Start,1752839790,18 1234567890,Start,1752839892,19 Any support, please? ... View more