Actually its a query that is being sent as an alert. The query actually has some conditions that brings out those people whose booked hours is less than estimated for a particular month. It also has a supervisor column which is matched with their respective employee. Then i am trying to run this as an email alert. say like if my booked hours is less than the allocated then an email should be triggered to my supervisor saying that i have booked less hours.The email will not send any number related to hours. And this will not go as a pdf ... View more

before there is ... View more

Hello jangrid, Actually i am a dot net programmer with no knowledge on python language. Please provide a sample (python program) of the requirement Thanks in advance ... View more

Please find the working and not working stanzas of input.conf file as below and give your inputs [monitor://C:\OneDrive - Accenture\Extracted Delta Files\TimesheetMaster\Timesheet*] ---[Working] disabled = 0 index = slb_index sourcetype=TimesheetMaster_03102016_2.csv [monitor://Z:\TimeTracker_SharePoint\TimesheetMaster\Timesheet*] -------------[not working] disabled = 0 index = slb_index sourcetype=TimesheetMaster_03102016_2.csv [monitor://\10.194.186.53\SLB-ADM_Applications$\TimeTracker_SharePoint\TimesheetMaster\Timesheet*] ---[not working as well] disabled = 0 index = slb_index sourcetype=TimesheetMaster_03102016_2.csv Thanks in Advance ... View more

Yes we have permission ... View more

Thanks this command is working But our Splunk instance is a cloud instance. So we have to connect to cloud through putty and that would be an additional work for monitoring (Again we have to specify the path for the instance and the connection for Putty and so on) Is there any other way? Thanks for the answer by the way This really works ... View more

I also have the date field in my alert(which i am calling through token $result.Date$)...but tis not working ... View more

The problem is $result.$ is not working in case of PDF Delivery alerts. My question was is there any way to make this work? ... View more

Actually i still couldn't get it. Your xml uses tokens for panels but my panel already uses token.Let me give you the specifics: My dashboard consist of 2 drop downs(one for domain and other is for time period) and 1 checkbox on the header. In the panel level there are 3 panels the first panel is an account label panel which uses the domain token for the overall time period to give the desired result.No dependency on Time period token since it gives the result for a year. The second panel uses the time period token to generate result according to time period (like for 6 months period or for a quarter). The third panel should display result from the starting of the current month till the last working day of the current month(like the current month is July ,so the display will be from 1st of July till 10th of July ).And this third panel will only come to play if the checkbox id chosen and this should override the second panel. BTW Thanks for the taking out time and answering my concern .Although your solution is ideal but my requirement is'nt covered. I would be obliged if you can devise some other alternative. ... View more

I am providing below a summary of my query: "|Query for calculating the number of days in a week|append[|Macro for bringing out latest values from TicketMaster source] |joining a primary key with another macro for calculating booked hours of respective employee|eval Email=employee+"@domain.com"| A Search command to extract those employees from the table whose booked hours is less than working hour note:working hours is calculated from the first statement of the query "Query for calculating the number of days in a week"." This query gives a table which contains Employee Id,booked hours ,working hours respective domain and email id along with their supervisor's Id.This sends an alert to those employees who are mentioned in the table (which is generated by above query). Here are my mail settings: Expiration:after 24 hours Severity:Critical Schedule type : Cron Cron Schedule:runs the alert every day except weekends "10 12 * * 1-5" alert mode:Once Per Result alert conditions:Always Throttling checkbox:not checked Alert Actions checkbox:checked To field: $result.Email$ cc:$result.SupervisorId$ ... View more

Like i said, If email is a.b.c@gmail.com the booked hours is 12 and working hours is 20. Since booked hours is less so an email should be sent from server to his mail notifying this. I cannot send it to all users at a time (which is "Once per search" mode in mail settings) since every user must get his/her individual alerts. ... View more