Thanks VatsalJagani, that kind of makes sense. As a user with no admin rights, I don't think I have access to change the owner that the search runs under, so I've been experimenting with applying my where statement to the timewrap results, but still can't quite get it right . . .  I can now get the chart to display a single day from 6am to 8pm, but it only displays results from the current time (here in New Zealand) until 8pm.  So it must be the use of now() in the relative_time command that is tripping me up? Would you have an example of some code that I could apply to my search to correct the timezone difference? Thanks for your help! ... View more

I was searching for something unrelated, and came across this old post. For what it's worth, I have the same issue with data ingested every 15 minutes, which is occasionally early or late, which creates missing or extra entries on my timecharts. I get around it by simply rounding  _time to the nearest 15 minutes (900 seconds): | eval _time=round(_time/900,0)*900     ... View more

Thanks cmerriman, I did see a similar answer in this forum, but I couldn't get it to work. It used index=_internal , which I didn't have access to (I'm just a user - not admin), so I applied for and got access, but it still didn't work, so maybe the _internal index was just because it was a 'run anywhere' example? Here is an example where I've removed index=_internal and added some code to show that the SID has been assigned to the token, but my loadjob still shows no results - are you able to tell me where I am going wrong? (I'm relatively new to Splunk so it's probably some rookie mistake ;o) Thanks, Doug. <dashboard> <label>Test SID</label> <search> <query> | makeresults count=99 | streamstats count as seq </query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <condition> <set token="subsearch_sid">$job.sid$</set> </condition> </done> </search> <row> <panel> <table> <title>Token Values</title> <search> <query> | makeresults | eval subsearch_sid = "$subsearch_sid$" | table subsearch_sid </query> </search> <option name="drilldown">none</option> </table> </panel> </row> <row> <panel> <event> <search> <query> | loadjob $subsearch_sid$ | table seq </query> <earliest>-24s@s</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="list.drilldown">none</option> </event> </panel> </row> </dashboard> ... View more

Have just managed to get it to work. This is the code for the input: <input type="dropdown" token="dedupToken" searchWhenChanged="true"> <label>Duplicates</label> <choice value="| dedup Source Memname Orderid Message">Exclude</choice> <choice value="| noop">Include</choice> <default>| noop</default> <initialValue>| noop</initialValue> </input> And this is the updated search code for the chart with the dedup token appended to the search: <search> <query> | inputlookup alerts_CTM_all_added_fields.csv | eval earliest=$toearliest$ | eval latest=if($tolatest$&lt;=0,now(),$tolatest$) | where eTime &gt;= earliest AND eTime &lt;= latest | search Source $sourceToken$ Nodeid="$nodeToken$" Application="$appToken$" Group="$groupToken$" Memname="*$jobToken$*" Message="*$messageToken$*" Cause $causeToken$ Support="$supportToken$" Essential="$essToken$" $dedupToken$ | sort 0 Time | chart count(Date) OVER Date BY $filterToken$ | eval eDate=strptime(Date,"%Y-%m-%d") | eval wday=strftime(eDate,"%a") | eval day=ltrim(strftime(eDate, "%e")) | eval suffix=if(day=1,"st",if(day=2,"nd",if(day=3,"rd",if(day=21,"st",if(day=22,"nd",if(day=23,"rd",if(day=31,"st","th"))))))) | eval month=strftime(eDate,"%b") | eval Date=wday+" "+day+suffix+" "+month | fields - eDate wday day suffix month </query> <sampleRatio>1</sampleRatio> </search> Thanks to everyone for their help and input! ... View more

Thanks @arjunpkishore5. That code works, but doesn't have the required result - sorry, it's hard to describe in words. (I just tried pasting some screenshots into this post, but it asked for the url of the screenshots, which I'm not sure how to do, so will have to persevere with words :o( On the dashboard, if I select a 'Source' of ctmsp and include duplicates and leave 'Filter By' as the default of 'Source', the dashboard returns a mono-colour chart showing 100-200 alerts per day from ctmsp over the last 30 days. If we say that 20% of alerts per day are duplicates of other alerts that same day, when I exclude duplicates I would expect the chart to show 80-160 alerts per day for the last 30 days from ctmsp. However, using your code, when I select exclude duplicates, the chart only shows 1 alert per day - I'm guessing that the dc is counting the number of items in filterToken, so it returns 1 because I only have a single source selected? So, sorry, not quite what I was after - but I think it's because I'm not describing it well enough. Basically, the source CSV file has about 10 fields, and when exclude duplicates is selected, the effect should be a dedup of all the fields except for 'Time', so as to only return unique alerts for each day. Does that make sense? Thank you for your suggestion. ... View more

Thanks HiroshiSatoh. I hadn't thought of noop, I think this is a really good idea. The source of the dashboard is a CSV file which is regularly appended to by a scheduled report - I do this to make the dashboard run faster. So where you mention deduping the sourcetype and storing it in a token, this would mean that the token would 'contain' several fields (the CSV source has 12 columns) and thousands of rows of data? I am new to Splunk but that sounds too powerful. I also apologise for not mentioning the CSV source file in my original question. If it helps, I have just posted the full XML code for the dashboard in a comment under my original question. ... View more

(sorry, not sure why lines numbers didn't appear in my previous post) ... View more

Thanks arjunpkishore5. Yeah good point. The question is complicated to explain, so I've posted the entire XML below. The dashboard has 12 inputs (4 with dynamically updating dropdowns), so to help with performance I have a scheduled report appending data to a CSV file, which is what the dashboard reads. The dedup dropdown/token is set between lines 152-158, and I would have thought that the dedup (or not) should happen after the search on line 180 but before the chart on line 182? <form theme="light"> <label>Batch Alerts By Source</label> <search> <query> | makeresults </query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> <progress> <eval token="toearliest">strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval> <eval token="tolatest">strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval> <set token="jobearliest">$job.earliestTime$</set> <set token="joblatest">$job.latestTime$</set> <unset token="showTokens">"x"</unset> </progress> </search> <fieldset autoRun="true" submitButton="false"> <input type="time" token="timeToken" searchWhenChanged="true"> <label>Date Picker</label> <default> <earliest>-30d@d</earliest> <latest>now</latest> </default> </input> <input type="multiselect" token="sourceToken" searchWhenChanged="true"> <label>Source</label> <choice value="ctmsd">ctmsd</choice> <choice value="ctmsq">ctmsq</choice> <choice value="ctmsp">ctmsp</choice> <choice value="MVSDEV">MVSDEV</choice> <choice value="MVSOAT">MVSOAT</choice> <choice value="MVSPROD">MVSPROD</choice> <initialValue>ctmsp,MVSPROD</initialValue> <delimiter> ,</delimiter> <prefix>IN(</prefix> <suffix>)</suffix> </input> <input type="dropdown" token="nodeToken" searchWhenChanged="true"> <label>Node ID</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>Nodeid</fieldForLabel> <fieldForValue>Nodeid</fieldForValue> <search> <query> | inputlookup alerts_CTM_all_added_fields.csv | eval earliest=$toearliest$ | eval latest=if($tolatest$&lt;=0,now(),$tolatest$) | where eTime &gt;= earliest AND eTime &lt;= latest | search Source $sourceToken$ Application="$appToken$" Group="$groupToken$" Memname="*$jobToken$*" Message="*$messageToken$*" Cause $causeToken$ Support="$supportToken$" | stats count by Nodeid | eval sorted=lower(Nodeid) | sort 0 sorted </query> </search> </input> <input type="dropdown" token="appToken" searchWhenChanged="true"> <label>Application</label> <initialValue>All</initialValue> <choice value="*">All</choice> <default>*</default> <fieldForLabel>Application</fieldForLabel> <fieldForValue>Application</fieldForValue> <search> <query> | inputlookup alerts_CTM_all_added_fields.csv | eval earliest=$toearliest$ | eval latest=if($tolatest$&lt;=0,now(),$tolatest$) | where eTime &gt;= earliest AND eTime &lt;= latest | search Source $sourceToken$ Nodeid="$nodeToken$" Group="$groupToken$" Memname="*$jobToken$*" Message="*$messageToken$*" Cause $causeToken$ Support="$supportToken$" | stats count by Application | eval sorted=lower(Application) | sort 0 sorted </query> </search> </input> <input type="dropdown" token="groupToken" searchWhenChanged="true"> <label>Sub Application</label> <initialValue>*</initialValue> <choice value="*">All</choice> <default>*</default> <fieldForLabel>Group</fieldForLabel> <fieldForValue>Group</fieldForValue> <search> <query> | inputlookup alerts_CTM_all_added_fields.csv | eval earliest=$toearliest$ | eval latest=if($tolatest$&lt;=0,now(),$tolatest$) | where eTime &gt;= earliest AND eTime &lt;= latest | search Source $sourceToken$ Nodeid="$nodeToken$" Application="$appToken$" Memname="*$jobToken$*" Message="*$messageToken$*" Cause $causeToken$ Support="$supportToken$" | stats count by Group | eval sorted=lower(Group) | sort 0 sorted </query> </search> </input> <input type="text" token="jobToken" searchWhenChanged="true"> <label>Job</label> <initialValue>*</initialValue> <default>*</default> </input> <input type="text" token="messageToken" searchWhenChanged="true"> <label>Message</label> <initialValue>*</initialValue> <default>*</default> </input> <input type="multiselect" token="causeToken" searchWhenChanged="true"> <label>Cause</label> <choice value="Failed">Failed</choice> <choice value="Late">Late</choice> <choice value="Info">Info</choice> <initialValue>Failed,Late,Info</initialValue> <prefix>IN(</prefix> <suffix>)</suffix> <delimiter>,</delimiter> </input> <input type="dropdown" token="supportToken" searchWhenChanged="true"> <label>Support Group</label> <initialValue>All</initialValue> <choice value="*">All</choice> <default>*</default> <fieldForLabel>Support</fieldForLabel> <fieldForValue>Support</fieldForValue> <search> <query> | inputlookup alerts_CTM_all_added_fields.csv | eval earliest=$toearliest$ | eval latest=if($tolatest$&lt;=0,now(),$tolatest$) | where eTime &gt;= earliest AND eTime &lt;= latest | search Source $sourceToken$ Nodeid="$nodeToken$" Application="$appToken$" Group="$groupToken$" Memname="*$jobToken$*" Message="*$messageToken$*" Cause $causeToken$ | stats count by Support | eval sorted=lower(Support) | sort 0 sorted </query> </search> </input> <input type="dropdown" token="essToken" searchWhenChanged="true"> <label>Non-Essential Alerts</label> <choice value="Exclude">Exclude</choice> <choice value="Include">Include</choice> <initialValue>Exclude</initialValue> <default>Exclude</default> <change> <condition label="Exclude"> <set token="essToken">Yes</set> </condition> <condition> <set token="essToken">*</set> </condition> </change> </input> <input type="dropdown" token="dedupToken" searchWhenChanged="true"> <label>Duplicates</label> <choice value="Exclude">Exclude</choice> <choice value="Include">Include</choice> <initialValue>Exclude</initialValue> <default>Exclude</default> </input> <input type="dropdown" token="filterToken" searchWhenChanged="true"> <label>Filter By</label> <choice value="Application">Application</choice> <choice value="Cause">Cause</choice> <choice value="Memname">Job</choice> <choice value="Nodeid">Node ID</choice> <choice value="Source">Source</choice> <choice value="Group">Sub Application</choice> <choice value="Support">Support Group</choice> <initialValue>Source</initialValue> </input> </fieldset> <row> <panel> <chart> <search> <query> | inputlookup alerts_CTM_all_added_fields.csv | eval earliest=$toearliest$ | eval latest=if($tolatest$&lt;=0,now(),$tolatest$) | where eTime &gt;= earliest AND eTime &lt;= latest | search Source $sourceToken$ Nodeid="$nodeToken$" Application="$appToken$" Group="$groupToken$" Memname="*$jobToken$*" Message="*$messageToken$*" Cause $causeToken$ Support="$supportToken$" Essential="$essToken$" | sort 0 Time | chart count(Date) OVER Date BY $filterToken$ | eval eDate=strptime(Date,"%Y-%m-%d") | eval wday=strftime(eDate,"%a") | eval day=ltrim(strftime(eDate, "%e")) | eval suffix=if(day=1,"st",if(day=2,"nd",if(day=3,"rd",if(day=21,"st",if(day=22,"nd",if(day=23,"rd",if(day=31,"st","th"))))))) | eval month=strftime(eDate,"%b") | eval Date=wday+" "+day+suffix+" "+month | fields - eDate wday day suffix month </query> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> </form> ... View more

Wow! . . . That is so cool the way it populates the dropdown. After a bit of experimenting, I got it working with the code below. Thanks for all your help - really appreciated! <input type="dropdown" token="appToken" searchWhenChanged="true"> <label>Application</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>Application</fieldForLabel> <fieldForValue>Application</fieldForValue> <search> <query> | inputlookup alerts_CTM_all_added_fields.csv | stats count by Application </query> <earliest>-4h@m</earliest> <latest>now</latest> </search> </input> </fieldset> <row> <panel> <table> <search> <query> | inputlookup alerts_CTM_all_added_fields.csv | search Application="$appToken$" | table Time Nodeid Application Memname Message Support </query> </search> ... View more

Thanks woodcock. I tried installing the dashboard examples app, but Splunk here at work is locked down and I don't have access. I dug out my private sandbox to try and install it, but my sandbox has long since expired. I tried your first example, but got the same result as my initial code - no rows were displayed. I then browsed through the online Splunk documentation on tokens, and under token filters, noticed $token_name|s$ which seemed promising. I tried this with your code and with my original code, and it seems to work for both - returned all rows when I entered 'All' through the dashboard, and returned just the rows containing the string when I overtyped 'All' with a string: | where like(Application, if($appToken|s$="All", "%", "%$appToken$%")) | where if($appToken|s$="All",like(Application,"%"),like(Application,"%$appToken$%")) However, I've been self taught so far - stitching together code I've googled - so I might well being doing things the wrong way. Therefore I'll persevere with trying to understand how value and label work and trying out your second example - it would be good to put 'best practice' in place. Thanks for your help. ... View more

Thanks richgalloway, although I am still a little confused, so I did a couple of tests . . . When I enter Test in the dashboard, I can see that $appToken$ is set to Test and only rows that have an Application with Test in their names are displayed in the dashboard, so the second clause like(Application,"%$appToken$%") is working successfully. I then changed the code to | where if($appToken$="Test" in attempt to trigger the first clause to show all Applications: | where if($appToken$="Test",like(Application,"%"),like(Application,"%$appToken$%")) However, I got the same result as the first test (only Applications with Test in their names showing in the dashboard), so the second clause was still triggering. Therefore, it must be the first part of the IF statement that is not working . . . for some reason | where if($appToken$="Test" is not matching the input from the dashboard, even though I can see that $appToken$ is set to Test? ... View more