Like this: index=Application sourcetype=Servers | stats count by host | appendpipe [|inputlookup hostLookup | table host | eval sourcetype="LOOKUP"] | stats values(*) AS * dc(sourcetype) AS numDatasets BY host | search numDatasets=1 AND sourcetype="LOOKUP" | table host ... View more

Hi Thanks for answering my question here . My apologies if the question was not clear ,but you got it exactly what i mean to say there . Now coming to the solution you gave, Its not giving the desired result . On running this query its giving the output as bellow: host Message count 123 Started 1 456 Started 1 2 ... View more

No, because you can't have two cron schedules under one saved search. You have to create two nearly identical saved searches where the only difference is the Cron schedule and the name/ID. ... View more

Thank you for your answer, but I have already accepted the above answer 🙂 ... View more

HI Cusello , I have this query can we set up a alert and send 2 separate mails as per the condition in the query . index=xyz sourcetype=123 Message="Started" (host=host1 OR host=host2 OR host=host3) | dedup host | stats count | where count <=3 One mail if count is < 3 and one mail when count is = 3 . Is this possible 😐 ... View more

|stats count|eval _raw="Application photobuf message : dhfksdhkfhksdhfk hdfkshfskhfk dfhkshdfkshfhs"|append [|stats count|eval _raw="Application Data loaded successfully for Photo No - 123456789 ; OrderIPlaceno - 987654321"]| eval delim = if(like(_raw,"%:%"),":","for")|eval _raw=split(_raw,delim)|eval split1=mvindex(_raw,0)|eval split2=mvindex(_raw,1) ... View more

Fantastic 🙂 ... View more

I have just used .....chart count by env |addcolstotals |fillnull value="Total" env Its actually giving result as: env Count POD1 5 POD2 2 POD3 3 Total 10 I want it to be like POD1 POD2 POD3 Total 5 2 3 10 I used transpose command but its giving result like: column row1 row2 row 3 env POD1 POD2 POD3 Count 5 2 3 Is it possible to make "POD1" POD2 as table header instead of row 1, row 2 etc. Please help me with this . ... View more

Following are some of the dashnoard/panel refresh options. I am not sure as to how to make this refresh work only betwee 8:30 to 5:30 PM. 1) Refresh entire view on periodic basis (following is for every 5 minutes) <dashboard refresh="300"> or <form refresh="300"> 2) Individual Panel auto-refresh (i) Splunk Enterprise 6.5 onward. Create your Search Panel and edit the search to add Auto Refresh Delay or do the same via Simple XML for specific Search Panel add following code <refresh>5m</refresh> (ii) refresh.auto.interval to refresh individual panel (deprecated feature now, however you can use the same in case you are using Splunk Enterprise 6.1 or greater but not on Splunk 6.5) <option name="refresh.auto.interval">300</option> ... View more

Thank you ..... It really helped ... View more

A little different approach which will print row numbers against each row, but without nested Splunk search query, hence should not cause performance issue. index=xyz sourcetype=123 Message ="*" | stat count by host Message | fields - count Save as dashboard table and set the table properties to enable Row Numbers. You can do the same by editing Dashboard XML also. <option name="rowNumbers">true</option> ... View more

this should be the correct answer ... View more