@architkhanna  If it is possible, provide inputs.conf and outputs.conf from the source side(UF). Maybe your log files are rotating and splunk is detecting the copy as a new log file to index. please check if : you are using the crcSalt option. If you are using "crcSalt=<SOURCE>" with rotated logs, this could also cause duplicates. This happens because the rotated file may stay in the same directory with a different name. check the rotation of your files, if no first lines are modified during the process. symlinks, verify that the multiple symlinks are not pointing to the same file/folder ... View more

Hi , I have the same problem, we are working with the Version: 8.2.5 I tried to take control of the div.splunk-timeline-tooltip and change the values but it didn't work. I would be happy to get help on this matter. ... View more

As a general rule - you don't "delete" data from indexes. Once the data is ingested and indexed it stays in the buckets until whole bucket is rolled out to frozen and deleted. True, there is a "delete" command but it doesn't really delete data from the buckets, it just marks it unaccessible. And in production I wouldn't really use that. Probably the easiest approach for you would be to drop your index completely, recreate it from scratch and reindex the data (yes, indexing it again will count against your license). ... View more

@gcusello  Absolutely it helped. I get what I was looking for. Thank you so much for your patience and quick response. ... View more

Hi @architkhanna, good for you, see next time! Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @architkhanna, as me and @richgalloway said, you have two choises: to make a PoC to see you data e.g. from one server and make a calculation, to see the dimension of a single event, calculate dimension x number of events, adding a margin in both cases. At first glance, 10 kb seems a bit too much for a single event, as it means an average of 10,000 characters for each event (in your case 200 fields each one with 50 chars!), just as an example a Windows event (that is among the most verbose) is always less than 1kb and if we talk about Linux, we normally have less of 0.1 kb. Anyway, put e.g. 1000 events in a file and see its dimension. At the same time, check the number og events, because 150k events are the usual number of few windows servers or 2-3 Domain Controllers. Ciao. Giuseppe ... View more

hello, Thanks for the response. however, lookup 1 has ticket number and all possible fields related to the ticketing info, while lookup2 has just ticket number(which shall be present in lookup 1 as well but) and a few other columns that shall not be matching with lookup1.Also do note lookup 2 just has UNRESOLVED tickets while Lookup 1 has BOTH resolved and Unresolved. Motive here is to get accurate list of all unresolved and resolved  tickets because lookup2 will have current unresolved tickets in source system while lookup1 will have tickets that has moved out of source but yet not flown into index with updates(and will never , hence they will remain unresolved always on dashboard) ... View more

In your navigation to subsequent dashboards, add  &form.varname=$varname|n$ where varname is your input form token i.e. link this in the drilldown <drilldown> <link target="_blank">new_dashboard?form.time_range.earliest=$time_range.earliest$&amp;form.time_range.latest=$time_range.latest$&amp;form.index=$row.index$</link> </drilldown> which passes the time picker earliest and latest with the time picker token name 'time_range' and a drilldown row value of index to the new_dashboard.   ... View more

@architkhanna  The customer is always right, but it will require custom web application development using Splunk JS. ... View more

Thank you for the code If it can help, I had to make a minor change to make it works properly in my case (some data were longer to load.) : var idSearchSelectIndex_results = idSearchSelectIndex.data("preview"); By  var idSearchSelectIndex_results = idSearchSelectIndex.data("results");   ... View more

Hi @architkhanna, you have tywo ways to do this: using Lookup editor app, you can modify a lookup but you haven't automatic date field and you have to add it manually; using a JavaScript, but it isn't so easy to describe! In few words, you have to: create a KV Store containing the fields you need (e.g. date and comment), create a dashboard to show the values of the lookup, containing a button; create a javaScript that, whwn clicked, runs a search that updates the KVStore. We did it in my company and you can find in Community some help to create this javascript&colon; https://community.splunk.com/t5/Dashboards-Visualizations/Button-to-run-splunk-query/m-p/454738 https://community.splunk.com/t5/Dashboards-Visualizations/xml-code-to-add-custom-button-in-dashboard/m-p/490153 and others. And to manage KV Store https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/aboutkvstorecollections/ Ciao. Giuseppe ... View more

That's my point, others have already given solutions to your question, I have even suggested (and shown) how you can access these solutions easily. There is no point other people wasting their time giving you answers which are already available to you. ... View more

😊 ... View more

Query is what I have asked for and the sample values I have provided. If you can understand well and good ,else Thanks for your time. ... View more

This works fine when there is no repetition in the multivalued field.It fails such scenraio. Any suggestions in this regard?   ... View more

Hand jamming on my phone from the docs, Assuming a known static value that’s being compared against:      ... | eval count=mvcount(mvfilter(mvfieldname="staticvalue")) Assuming Splunk 8 and the comparison is against different single value field in each row...     ... | eval mvresults=mvmap(mvfieldname,if(mvfieldname=svfieldname,"Y","N")), count=mvcount(mvfilter(mvresults="Y")) see: https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/MultivalueEvalFunctions ... View more

Just wanted to confirm with you what is the Date format you are passing is it relative time or absolute like Date Range? Also can you add some sample data and screenshot of example? If you have Splunk Entitlement, work with Splunk Support to find the root cause, workaround and solution of the issue. I am curious if you are hitting the following bug (please check and confirm): https://community.splunk.com/t5/Dashboards-Visualizations/7-1-Dashboards-not-converting-timepicker-to-timezone/td-p/399430 ... View more

Hi Check this, drilldown value will available in value token <dashboard> <label>drilldown</label> <row> <panel> <table> <title>$value$</title> <search> <query>| makeresults | eval A=1, B=2, C=3 | append [| makeresults | eval A=4, B=5, C=6]|table A B C</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <drilldown> <condition field="A"> <set token="value">$click.value$</set> </condition> <condition field="B"> </condition> <condition field="C"> </condition> </drilldown> </table> </panel> </row> </dashboard> ... View more

Hi Check @niketnilay solution from the below URL https://answers.splunk.com/answers/689652/how-do-i-color-a-table-cell-based-on-the-other-col.html ... View more

Specify the value of A in the field be set to AND myField="A" | replace "A" with "N/A" in myField and the value of B be AND myField="B" . Then have your search be something like this: index="foo" AND sourcetype="bar" $myFieldToken$ ... View more

Yeah. In that case you need to play with css. As there is no defualt option provided by splunk regarding this. Please find below the answer for similar request. You can refer that, https://answers.splunk.com/answers/610389/how-to-display-values-only-for-chart-overlay-field.html Sid ... View more

Hi Try with id like below <dashboard> <label>test</label> <row> <html> <style > #panel2 .panel-element-row { overflow: auto; max-height: 200px; } </style> </html> </row> <row> <panel id="panel1"> <chart> <search> <query>index=_internal|timechart span=1d count by source</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> <row> <panel id="panel2"> <chart> <search> <query>index=_internal|timechart span=1d count by source</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="charting.chart">area</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> </dashboard> ... View more

@architkhanna try one of default drilldown token $click.name2$ <drilldown> <set token="tokClickedColumnName">$click.name2$</set> </drilldown> Following is a run anywhere search based on sample data provided: <dashboard> <label>Table with drilldown</label> <row> <panel> <title>$tokClickedColumnName$</title> <table> <search> <query>| makeresults | fields - _time | eval data="2 A B C D;3 E F G H" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval 1=mvindex(data,0), 5=mvindex(data,1), 6=mvindex(data,2), 7=mvindex(data,3), 8=mvindex(data,4) | fields - data</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <set token="tokClickedColumnName">$click.name2$</set> </drilldown> </table> </panel> </row> </dashboard> ... View more