Hi @yuanliu  I am working on a dashboard in splunk and need help implementing specefic filtering requirements.I have a table with the following fields. message (contain log details) component (indicates the source components) My requirement are: 1.Add multiselect dropdown to filter the component field. 2. add textbox input to filter the message field using comma-separated keywords. for example: if the textbox contains error, timeout it should filter rows where the message field contain error or timeout in case both present we need to show both the values.   Any suggestions or example are greatly appreciated, Thank you.  ... View more

Hi @yuanliu    In my case i need to search in textbox with dynamic values from message field not with predefined values. ... View more

@gcusello If i want to search multiple keywords using comma seperate in the same text field. ... View more

I am using multiple filter in that Error search is one of the filter in which i need to type the values or multiple values with comma and i need to filter the result    ... View more

Hi @gcusello  I agree that point but our client is not intrested to install agent and as you mentioned the syslog the application team have multiple logs .So is there any ways to monitor the logs .And how to onboard syslogs any examples.   Thanks, Karthi ... View more

Hi @ITWhisperer  This is my code in xml dashboard. In my dashboard some link should be present. So if i click on the link it showing null. So i used below code. Still i am getting null value. <condition field="Link"> <eval token="link">if(isnull($row.URL$),"","https://$row.URL|n$"</eval> <link target="_blank">$row.URL|n$</link> </condition> ... View more

Thanks for the brief  explanation. ... View more

Hi @bowesmana  My actual  requirement is that if the field with empty values then I dont want to show in the table.IF some of the correlationID we dont have ImpconID so i used above query to filter the empty values. Now i want to filter the null values from the field. PFA ... View more

Hi @bowesmana  Still the null field values is appearing. ... View more

Thanks, Provided query which i am trying to do. ... View more

index=mulesoft applicationName=test | stats values(content.payload.requestID) as Request1 values(content.payload.impConReqId) as ImpConReqId values(content.payload.batchId) as batch1 values(content.payload{}.batchId) as batch2 values(content.payload{}.impConReqId) as impConReqId1 values(content.payload.OutputParameters.X_REQUEST_ID ) as Request2 BY applicationName,correlationId | eval ImpConReqID= coalesce(ImpConReqId,impConReqId1) | eval RequestId= coalesce(Request1,Request2) | eval batchId= coalesce(batch1,batch2) | eval ImpCon=mvmap(ImpConReqID,if(match(ImpConReqID,".+"),"ImpConReqID: ".ImpConReqID,null())) | eval batch=mvmap(batchId,if(match(batchId,".+"),"batchId: ".batchId,null())) | eval ReqId=mvmap(RequestId,if(match(RequestId,".+"),"RequestId: ".RequestId,null())) | eval oracle=mvappend(ImpCon,batch,ReqId) | eval orcaleid=mvfilter(isnotnull(oracle)) | eval OracleResponse=mvjoin(orcaleid," ") | rename applicationName as ApplicationName correlationId as CorrelationId | table ApplicationName OracleResponse CorrelationId This the query which i am trying to get batchID, requestID, ImpconID.If the field value contains then i need to show in the table based on correlationID. Right now I am getting values properly. But in some scenario for the particular correlationID we have two or three ImpconIDwith values and with null values. So i want filter that null value ImpconId in the table .     ... View more

Hi @gcusello  Thanks for the reply. Actually i want to improve my dashboard performance. So i try to convert as report. But as you said its static. So if i use summary index or data model we can pass token ?any sample data model .And both will consume license right? ... View more

Thanks @gcusello  After creating dashboard.Can we make it the dashboard panel as reports will be more effective? ... View more

Hi @ITWhisperer  How to check if the url is null in xml dashboard. ... View more

Not like that,I have a table with 5 column and one of the column URL field. Instead of showing full URL .I need to show only click here instead of URL. Then we need to open the complete URL on clicking click here.   Name  URL App DSR click here Web app   ... View more

Yes i am used the below drilldown. Instead of full url in column want to use Click here name. ... View more