Thank in Advance  I have three source type Micro, application, CsID and i want to fetch details from these three source type .In Micro source type i want to run every 11 hours and other two source type with all time. 1.In micro source type i want to populate 16 fields in this i have cluster, namespace, microservice etc. 2.In Application source type i have cluster, namespace and csid. 3.In csid source type i have only csid but i want populate all the fields from this source type . How to merge all those without join. Its working in join but while using in dashboard its very slow .I will paste sample query which i tried but i cant able to get data from csid source type and in micro field name as cluster but in other sourcetype as ose_cluster and we also map using lookup file for ose_cluster. (index=int* (sourcetype="micro" OR sourcetype="application" OR sourcetype="csiID" NOT "test_cluster")) | eval creation_time_epoch=creation_time | eval creation_time_human=strftime(creation_time, "%Y-%m-%d %H:%M:%S") |eval ose_cluster=coalesce(ose_cluster,cluster) |eval csiId=trim(toString(csiId)),namespace=trim(lower(namespace)) |stats values(*) as * by ose_cluster namespace |mvexpand csiId |stats latest(*) as * by ose_cluster csiId |lookup inventory.csv ose_cluster OUTPUT sector as cluster_sector datacenter region env |fillnull value="NA" | table ose_cluster namespace type microservice creation_time_epoch creation_time_human cluster_sector app_sector datacenter region env csiId acronym applicationName applicationManager soeid supportManager status org level3 level4 level5 ... View more

Hi All, Thanks in Advance I have a requirement we are onboarding CSV files that contain events. I am writing query to display in the data in a table, and these events contain some dynamic fields names. Since the field names are lengthy a I need to shorten them for better readability. I tried using rename command in Splunk, but it did not work as expected Could you please help me with how to rename multiple dynamic fields to shorter names? Index=Test sourceType=csv | fillnull value="NA"|rename "count/deploymentconfigs.apps.os.io_max_configured" AS "max_configured"|table index host sourcetype *|fields - _raw,_time   ... View more

How to filter using text box with multiple keywords using comma separated.How to filter my table data. This is  my query      index=atvi_test sourcetype=ncc |rename hostname as Host component as Component filename as FileName | eval source_list=split("*ORA*", ",")| search Environment=QTEST Component IN (*) |search NOT Message IN (null)| table PST_Time Environment Host Component FileName Message |sort PST_Time|search [| makemv delim="," source_list|eval search_condition=mvjoin(source_list, " OR Message=*")|eval search_condition="Message=*" . search_condition|return $search_condition]   ... View more

How to filter events in the dashboard with help of search box.In the search box i have to give multiple strings like error,warning so i need to sort out only error and warning logs.      In Dashboard XML: <input type="text" token="Text_Token" searchWhenChanged="true"> <label>Error Search (comm-seprated)</label> </input> index=test Message="*"| eval error_list=split("$Text_Token$", ",")| table PST_Time Environment Host Component FileName Message | search Message IN ("error_list") OR Environment=QDEV Component IN (AdminServer) FileName=*| search NOT Message IN ("*null*")|sort PST_Time   ... View more

In my splunk dashboard i have table with time stamp of UST time .But my team is working in multiple timezone .So they want me to make default PST timezone in dashboard.How can we acheive this in splunk dashboard? ... View more

Hi Team, I am connecting any point studio with Splunk using HEC. The logs are forwarding but some of the logs are missing in Splunk but it is presented in Any point studio logs. How to troubleshoot the issue?   Thanks, Karthi ... View more

Hi , How to collect server logs without installing the Splunk Universal forwarder. Because the server owned team is not interested to install UF. Please let me know is any other way to collect the data and how?   Thanks, Karthi ... View more

Hi All, I have a Splunk dashboard with dynamic token, Here a simplified example of my setup. In the dashboard $new_value$ and $env$  are dynamic token that user can select. I want to convert this panel into report that can accommodate these dynamic values. Could you guide me how to achieve this ?.I need to understand. Any details steps or examples would be greatly appreciated. Base Query: index=Test environment=$env$ applicationName=$new_value$ | stats values(content.InterfaceName) as InterfaceName values(content.payload) as payloadFile values(content.ErrorMsg) as errormsg values(content.Error) as error BY applicationName,correlationId | table Status Timestamp InterfaceName ApplicationName CorrelationId | search interfaceName=$new_interface$ Panel Query with dynamic tokens: <search base="BankSearch"> <query>| where Status LIKE ("$countStatus$")|sort -Timestamp</query></search>   ... View more