@ajayabburi508  I think you got the answer from below my comment. https://community.splunk.com/t5/Splunk-Search/How-to-insert-checkboxes-in-a-simple-statistics-results-table/m-p/613379#M213175     Can you please replace the below code in JS? Old:     var a = $('<div>').attr({"id":"chk-sourcetype"+cell.value,"value":cell.value}).addClass(checkbox_css).click(function() {       New:     var checkbox_css = selected_values_array.includes(cell.value) ? "checkbox checked" : "checkbox"; var a = $('<div>').attr({"id":"chk-sourcetype"+cell.value,"value":cell.value}).addClass(checkbox_css).click(function() {     If this resolved your issue then can you please accept it to close this question?   Thanks KV If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.   ... View more

@ajayabburi508  Can you please replace the below code in JS? Old: var a = $('<div>').attr({"id":"chk-sourcetype"+cell.value,"value":cell.value}).addClass(checkbox_css).click(function() {   New: var checkbox_css = selected_values_array.includes(cell.value) ? "checkbox checked" : "checkbox"; var a = $('<div>').attr({"id":"chk-sourcetype"+cell.value,"value":cell.value}).addClass(checkbox_css).click(function() {   Thanks KV If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more

I am able to run one shot searches but it is taking auto login , but it should take admin credentials only. ... View more

@ajayabburi508 it seems it is not possible with one single expression, both provided expressions are partial workarounds but not the solution that you asked ... View more

This can be accomplished with a batch upload to Splunk. Note: this deletes the file upon indexing. If you have a script that copies the csv file to the batch upload directory, then this should work for what you need. If not, use the monitor stanza. The following configurations are for the Universal Forwarder: # inputs.conf [batch:///var/log/mycsvfiles] index = [YOUR INDEX] sourcetype = [YOUR SOURCETYPE] move_policy = sinkhole whitelist = .*\.csv # props.conf [source::...csv] TIMESTAMP_FIELDS = [TIMESTAMP FIELD IN CSV] INDEXED_EXTRACTIONS = CSV ... View more

Hi @harishalipaka, Try this query: | makemv delim="," Drive | makemv delim="," Free_Space | eval fields = mvzip(Drive,Free_Space) | rex field=fields "(?<Drive1>[C]+):,(?<Free_Space1>[\d]+\sGB)" | rex field=fields "(?<Drive2>[D]+):,(?<Free_Space2>[\d]+\sGB)" | table Drive1, Drive2, Free_Space1, Free_Space2 Sample query: | makeresults | eval _raw="Drive Free_Space C:,D: 500 GB,450 GB E:,D: 250 GB,150 GB C:,E: 250 GB,1 TB S:,D:,C:,G 120 GB,450 GB,250 GB,800 GB" | multikv forceheader=1 | makemv delim="," Drive | makemv delim="," Free_Space | eval fields = mvzip(Drive,Free_Space) | rex field=fields "(?[C]+):,(?[\d]+\sGB)" | rex field=fields "(?[D]+):,(?[\d]+\sGB)" | table Drive1, Drive2, Free_Space1, Free_Space2 ... View more

unfortunatly this is not possible. I would recommend my co-workers viz which is very similar and I am pretty sure can create straight lines: https://splunkbase.splunk.com/app/4438/ All the best. ... View more

What are you really trying to do? Macros only run when a search is run, and a search is scheduled when someone creates the schedule, so your question seems to be somewhat confusing. ... View more

Location Tracker should do this by default if you construct a table with time, latitude, longitude, and user name: | makeresults count=4 | eval User="user ".random(), latitude=random()%90, longitude=random()%90 | table _time, latitude, longitude, User ... View more

| rest /servicesNS/AppName/UserName/data/transforms/lookups ... View more

have a look at transaction command: https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction ... View more

Hi @ajayabburi508. The app does not persist features drawn using the measure tool into that location. You need to first create KML with your features in another tool like Google Earth and then put them into the location so the app can load them. ... View more

niketnilay , This option is not working geo_us_states.kmz Simply i need , I need to create a Shape of about 400km around a particular lat/lon on Splunk Maps and whenever an object which is also defined by a lat/lon enters within the area of 400km, I should be able to get an alert and view it real time and also be able to see when it leaves this particular area. when your free help me out from this. ... View more

@ajayabburi508, I looked at the Shapester - Geo Shape App , seems like it will just create the kmz file with region details. You would need to use the Choropleth map on top of the kmz file created through Shapester app. I am not sure current visualization has something in place which would add both marker and fence for the visualization. So, I am afraid you might have to create one yourself if you have an example of the visualization (D3 or any other JS based visualization), using Splunk's Custom Visualization API. I would also suggest that if your intent is to draw out Location Tracker over map the Location Tracker Custom Visualization is a good fit once you have details on change in location over time. ... View more

@ajayabburi508, I have marked the question as answer. Please accept to mark this as answered! ... View more

Accepted bro ... View more

If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open. ... View more

Hi ajayabburi508 let me better understand: do you want a search that when for an hour you have only value=0 and not value=1, it displays from_time and to_time? if this is your need run an alert like this every five minutes: index=your_index sourcetype=your_sourcetype | transaction maxspan=1h | search value!=1 | stats earliest(_time) AS earliest latest(_time) AS latest Bye. Giuseppe ... View more

thanks bro ... View more

index=test ID_STUFF | rex max_match field=_raw "ID_STUFF=(|\S+,)(?.*?)(\s+|&)" | eval ID_VALUES =split(ID_VALUES ,",") | mvexpand ID_VALUES | stats count by ID_VALUES ... View more