Hi, Do you have any resolution for this? Please post if you have any sample query. ... View more

I think like somesoni2 is saying please try to achieve the same through the stats command like he ahs shown. Join has limitations. And also in your join usage , since you did not specify a join type , the default is an innder join meaning only extid common to both searches will be considered as the 'key' fields. If you really want to go for join (I still feel somesoni's stat query will work out for you) please read the join docuementation - http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Join if you want all of the events in the main search and only those values in the subsearch have matching field values, consider using a left join. ... View more

there is problem in your request sum(count) the field count doesnt exist so you wont get any interesting result If the output is always sorted by clientkey, its because of this: "timechart span=1w sum(count) by clientkey limit=5" To have them sorted by Clientpercent you need have a count by Clientpercent n your request ... View more

The timechart UI expects full times, not days of week. If you're willing to lose the hourly details within a day, something like this should work: index=volume_hourly_summary report="volumebyhour" earliest=-4w@w latest=@w | timechart span=1d sum(count) as TotalVolume | timewrap w series=exact| eval time=strftime(_time, "%A") | fields - _time | table time * (note, this removes _time and uses 'time', and I replaced 1h with 1d) You might have to sort the days of the week. ... View more

Try this [af_dev] BREAK_ONLY_BEFORE=\d{4}-\d{2}-\d{2} NO_BINARY_CHECK=1 SHOULD_LINEMERGE=true TIME_FORMAT=%Y-%d-%m %H:%M:%S,%3Q ... View more

I see what I was doing wrong. I should not have been adding stats count by _time to the query on the hourly summary. The correct query is: index=summary report="summary_by_hourly"| timechart span=1h avg(count) as avgcount max(count) as maxcount min(count) as mincount, sum(count) as totalcountperhour ... View more

great. Please close the question if there are no followup questions. ... View more

Well there are two ways. The first is probably the simplest, and the idea is to do the switching in the search language. 1) Here we make two fields on the fly using a PostProcess module - message and className , and then display the appropriate message , with the appropriate classname right in the HTML module. <module name="HiddenSavedSearch" layoutPanel="panel_row3_col2" autoRun="True"> <param name="savedSearch">AF-Search-Datacenter-Health-VA</param> <module name="PostProcess"> <param name="search">eval message=if(range=="1","Health Status is Missing data","Health Status is Normal") | eval className=if(range=="1","missing-data","normal"</param> <module name="HTML" > <param name="html"><![CDATA[ <div class="dataCenterHealth-$className$"> $results[0].message$ </div> ]]></param> </module> </module> </module> 2) The other way is to use PostProcess with a little eval to make a field called isMissingData that will have one of two values - lets say "true" and "false" are our two values. Then to use a ResultsValueSetter module downstream from the PostProcess to pull that field value from the search results down so that it's available as a simple $isMissingData$ token in the XML. Then downstream from the ResultsValueSetter to use a Switcher module tha tlistens for that $isMissingData$ key and basically forks between two different HTML modules. You'd have one HTML module downstream from the Switcher with group="true" and the other HTML module downstream from the Switcher with group="false" . The advantage of the Switcher way is that you can have arbitrarily different module config in each of the Switcher branches. here, since the only difference is a small difference in HTML, it's almost certainly overkill. Doing things with PostProcess and ResultsValueSetter and Switcher feels really weird the first few times you do it, but you can do a weirdly large range of things with it once you get the hang of it. All in all though I think your use case is simple enough where the first way is easier and that's what I recommend (the posted XML above) - using a little eval and just using the HTML module's internal $results[0].fieldName syntax. ... View more

|inputlookup EATSourceHostLookup | search NOT [ search index=iam_eat earliest=-1m host=* source=* ] | dedup host,source|fields host,source ... View more

My goal is to simple. I want to display a table with host, source and last time updated. Basically, everything listed in the "|metadata type=sources" results, plus add a host column ... View more

ALSO! My comments are about the version of the module in Sideview Utils 2.6.5. If you're talking about the old LGPL version of the app - version 1.3.5, then no - the SavedSearch module was just a prototype back then. go to http://sideviewapps.com/apps/sideview-utils to get the latest. ... View more

Great! Could you please mark my answer as accepted? That way it's easier to keep track of what issues are solved or not on the site. ... View more

Note: coming in the next version of Sideview Utils (1.2) I have added some more examples and more documentation to the linking page to cover this. It'll be up in a few days. ... View more

This does not work if your savedsearch evals something to the passed parameter, and then you want that to be included in the email. In this case you must include strings in the savedsearch eval statement eval test="$passed_param$" NOT eval test=$passed_param$ . If you aren't evaling then this solution works as described without the quotes. ... View more