Hi, I have four pulldowns, which will populate the list from the search query. Every change of a value on a pulldown causes all pulldowns whose values are filled using a search to reload.I dont want the cascading effect. If i select one pulldown , the others should not change. This is my pulldown code <module name="Search" layoutPanel="panel_row1_col2" autoRun="True"> <param name="search"> source="*\\CPES_List_Details.csv" DeviceAvailable="YES" | table VendorName | eval flag =if(VendorName="Thomson",1,0) | table VendorName,flag | sort -flag | table VendorName</param> <module name="Pulldown"> <param name="name">VendorName</param> <param name="label">VendorName:</param> <param name="template">$value$</param> <param name="float">left</param> <param name="postProcess">dedup $name$</param> <param name="staticOptions"/> <param name="valueField">$name$</param> <module name="Search" layoutPanel="panel_row1_col2" autoRun="True"> <param name="search"> | inputlookup months.csv | sort time</param> <module name="Pulldown"> <param name="name">FromMonth</param> <param name="label">From:</param> <param name="template">$value$</param> <param name="float">left</param> <param name="postProcess">dedup $name$</param> <param name="valueField">$name$</param> <param name="staticOptions"/> <module name="Search" layoutPanel="panel_row1_col2" autoRun="True"> <param name="search"> | inputlookup bds_year.csv | table FromYear</param> <module name="Pulldown"> <param name="name">FromYear</param> <param name="label">-</param> <param name="template">$value$</param> <param name="float">left</param> <param name="valueField">$name$</param> <param name="staticOptions"/> <module name="Search" layoutPanel="panel_row1_col2" autoRun="True"> <param name="search"> | inputlookup months.csv | rename FromMonth to ToMonth | table time,ToMonth | sort -time</param> <module name="Pulldown"> <param name="name">ToMonth</param> <param name="label">To:</param> <param name="template">$value$</param> <param name="float">left</param> <param name="postProcess">dedup $name$</param> <param name="valueField">$name$</param> <param name="staticOptions"/> <module name="Search" layoutPanel="panel_row1_col2" autoRun="True"> <param name="search"> | inputlookup bds_year.csv | rename FromYear as ToYear | table ToYear </param> <module name="Pulldown"> <param name="name">ToYear</param> <param name="label">-</param> <param name="template">$value$</param> <param name="float">left</param> <param name="valueField">$name$</param> <param name="staticOptions"/> Please help me in this Thanking in advance ... View more

Hi , I have a field with VendorName Example : HOMOLOGATED-(Contrend CT 5072s) HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @ HOMOLOGATED-(OPTICOM-DLINK 279) I want to extract only the message inside the brackets,my output should be Contrend CT 5072s DLINK-DLINK 500B OPTICOM-DLINK 279 If i have two messages in single field Example "(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2)". I want only first message within the brackets output-DLINK-DLINK 500B Can anyone help me how to write rex command for this..? Thanking you in advance ... View more

Hi I have a date field called Time_Line(01-Jan-13) in my source file. My search query is: source=foo | eval startdate=strptime("01-JAN-13","%d-%b-%y") | eval enddate=strptime("31-DEC-13","%d-%b-%y") | eval timein=strptime(Time_Line,"%d-%b-%y") | eval month =strftime(timein,"%b") | table line_id,startdate,enddate,timein,month | stats count(line_id) as cnt by month My results will be: month cnt Apr 6684 Aug 9120 Dec 9925 Jan 3692 Feb 2564 But i want the months to be sorted according to the calender. Please help me in this. Thanking you in advance ... View more

Hi I need to display table along with percentage This is my search query : source=foo | fields DS_CLIENTE,DS_STATUS_TRIAGEM,DT_TRIAGEM,PROJETO| where PROJETO="Contratada" | chart count over DS_CLIENTE by DS_STATUS_TRIAGEM This is my table DS_CLIENTE Aprovado Garantia Reparo Sucata Contractor1 11509 1882 21651 323 Contractor2 1 0 5 0 I need to display the same table along with percentage. This is just example DS_CLIENTE Aprovado Garantia Reparo Sucata Contractor1 11509(65.98) 1882(32.86) 21651(94.34) 323(29.65) Contractor2 1 0 5 0 Please help me in this. Thanking you in advance ... View more

Hai i have a field which has dates example : 1-Oct-13 4-Dec-13 28-Oct-13 I have to convert to below format 01-Oct-13 04-Oct-13 and so on.... Please help me Thanking you in advance ... View more

Hi Can Splunk forwarders be installed on network switches to capture data? I have a CISCO network switch from which I need to extract data for monitoring purposes. I was wondering if I can use Splunk forwarder instead of any network probes Also is there an app for network devices monitoring espeically for CISCO devices? Awaiting your response Thanks, ... View more

Hi I have some results in Dashboard1 Example- No of Students in Classroom=120 I need the above result to be used in Dashboard2 for some computation. Is this possible in splunk to pass the Dynamic results from one Dashboard to another ..? Please help me in this.. Thanking you in advance ... View more