Anyway, the only solution is the one I described: you have to create one single search and save it as an alert, it isn't possible to create an alert taking parameters from other panels or inputs. I could add that the concept of alert is to have a rule that automatically checks the conditions and triggers without human intervenes. You could also add the sendmail command to a panel, but in this way, the mail is sent every time you open the dashboard and I don't think that's acceptable. Ciao. Giuseppe ... View more

yes.. index=sswer sourcetype=abcdr [|inputlookup lookup_test.csv |eval hour_now = (floor(now()/(60*60))%24-6) |where Earliest <= hour_now AND Latest >= hour_now |table hour_now Earliest Latest ReportsName]  This is the search query that I used My actual query should like this. index=sswer sourcetype=abcdr "ReportsName" earliest=Earliest latest=Latest where ReportsName,Earliest & Latest values has to be picked from the lookup file   ... View more

You mean something like: index=abc sourcetype=bcd “abc” [| inputlookup <lookup-name> | where latest==now() | appendpipe [| stats count | where count=0 | eval File_Name="when no match found in the lookup", earliest=0, latest=0] | table File_Name, earliest, latest ]   The appendpipe is the condition when nothing in the lookup matches the current time. If you can update that part as you wish in that case. ... View more

| makeresults | eval _raw="State,Date,Desc,Count bc,11102021,vm,234569 bc,12102021,vm,456328 bc,11102021,vm,234569 bc,12102021,vm,4532178 cd,11102021,vm,234000 cd,12102021,vm,234000 cd,11102021,vm,234000 cd,12102021,vm,568902" | multikv forceheader=1 | table State,Date,Desc,Count | streamstats count as row by State | eval row=if(row=4,mvappend(row,"0"),row) | mvexpand row | sort 0 State -row | streamstats values(Count) as next current=f window=1 by State | where row>0 AND Count=next | sort 0 State row ... View more

I made a Dashboard with drilldownbuttons without using HTML nor JS. Note that its most likely not best practice but it works. ^^ I made a Lookup CSV with shortage and text ( example: shortage=showD, text=Show Details ) and use a searchmacro to get the lookup data ( searchmacro: inputlookup dashboardhelper | search shortage="$short$" | table text ). I can simply insert a SingleValue to my Dashboard with the search:  | `dashboardhelper(showD)` and can set, unset tokens or do other Drilldown actions in the SingleValue. ... View more

@prettysunshinez  Can you please try this? YOUR_SEARCH | rex field=_raw "(?<NumberOfIDs>\d*) IDs are found for the type (?<Type>\d*) and for the subtype (?<SubType>.*)" | rex field=_raw "sent to (?<emailId>.*)" | filldown Type SubType NumberOfIDs | streamstats count by Type | eval SubType=mvindex(split(SubType,"^"),count-2),Type=if(count=2,Type,null()), NumberOfIDs=if(count=2,NumberOfIDs,null()) | where count!=1 | table Type SubType emailId NumberOfIDs My Sample Search : | makeresults | eval raw="[7/14/21 3:00 CDT] 3 IDs are found for the type 234456 and for the subtype 12334^12344|[7/14/21 3:00 CDT] It is being sent to will@sons|[7/14/21 3:01 CDT] It is being sent to william@sons|[7/14/21 3:01 CDT] It is being sent to heather@sons|[7/14/21 3:02 CDT] 4 IDs are found for the type 234457 and for the subtype 12335^12345|[7/14/21 3:02 CDT] It is being sent to will3@sons|[7/14/21 3:03 CDT] It is being sent to william3@sons|[7/14/21 3:03 CDT] It is being sent to heather1@sons" | eval raw=split(raw,"|")| mvexpand raw | rename raw as _raw |rename comment as "Upto Now is sample data only" | rex field=_raw "(?<NumberOfIDs>\d*) IDs are found for the type (?<Type>\d*) and for the subtype (?<SubType>.*)" | rex field=_raw "sent to (?<emailId>.*)" | filldown Type SubType NumberOfIDs | streamstats count by Type | eval SubType=mvindex(split(SubType,"^"),count-2),Type=if(count=2,Type,null()), NumberOfIDs=if(count=2,NumberOfIDs,null()) | where count!=1 | table Type SubType emailId NumberOfIDs     Thanks KV ▄︻̷̿┻̿═━一 If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more

@prettysunshinez (and @inventsekar ) You can hide columns with CSS - the data is still there for the drilldown to use.   <row> <panel depends="$stayhidden$"> <html> <style> #twocolumns th:nth-child(2), #twocolumns td:nth-child(2){ display: none; } </style> </html> </panel> <panel> <table id="twocolumns"> <search> <query>| makeresults | eval _raw="Col_A,Col_B a1,b1 a2,b2" | multikv forceheader=1 | fields - _time _raw linecount</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <drilldown> <set token="selected_b">$row.Col_B$</set> </drilldown> </table> </panel> <panel> <table> <search> <query>| makeresults | eval _raw="Col_B,Col_C b1,c1 b2,c2" | multikv forceheader=1 | where Col_B="$selected_b$" | fields - _time _raw linecount</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row>   ... View more

I'm not that strong with this so these suggestions may not help.  My first thought is to set the color to a default value first and change it if "ALL" is selected.   <init> <set token="color">non-ALL value</set> </init> ... <change> <condition label="ALL"> <set token="color">"red","green","yellow"</set> </condition> </change>    My second thought is to try the match function.   <change> <condition label="ALL"> <set token="color">"red","green","yellow"</set> </condition> <condition match="foo!='ALL'"> <set token="color">"red","green","yellow"</set> </condition> </change>   ... View more

Hi.. Any suggestions pls ... View more

@prettysunshinez  - were you able to change the font color ? Actually the answers got read-only., hence could not post the solution. Actually I used the table_row_highlighting.js from dashboard examples and disabled the whole row highlighting code and used the table_row_highlighting CSS file and changed the font color instead of background color and removed the background-color property and used color property for changing the font color to green, amber and red. Hope this can help  you in case if you want to do it.  ... View more

Thanks @anthonymelita I will try this. But could yu pls explain how is relative time helping here. Relative time is basically dependant on the time the search is run.. But in the above query,now() always takes the value of the current time the search is run and not on the time for which the search is run. ... View more

I have this done by myself. Thanks 🙂 ... View more

Hi @prettysunshinez, you can rename more fileds at the same time, see this example: index=_internal | rename date* AS time* Ciao. Giuseppe ... View more

You can use the timewrap command to do this, e.g. index=_internal earliest=-4h | timechart span=1m count | timewrap 1h and it will generate 4 series, one for each hour on the same chart overlayed on top with the x-axis showing the last hour ... View more

Thank you so much..It helped!! ... View more

To be specific Post Processing Best Practices. The reason for use of transforming commands in base search is so that you reduce the number of rows by using some aggregation field/s and have base search pull only required (reduced) rows and colums. However, if only eventstats and streamstats are used you will still have original no. or rows and will not be reducing the total number of events. As far as performance is concerned depends upon factors like: 1. Your Splunk environment specs and configs 2. How much data is getting pulled in your base search. 3. Use loadjob vs. post-processing. 4. Other Acceleration techniques like metrics index, data model acceleration etc. ... View more

Create your base search before the first panel (not in a row). Be aware that this type of base search has limitations. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/Savedsearches#Post-process_searches_2. <search id="myBaseSearch"> <query>index= source= | regex field1 | regex field2</query> </search> <row>... ... View more

Any help pls ... View more

1.Yes.. 2.if they have not exceeded the threshold they will be in medium and if exceeded high(upgraded) And rest are all same ... View more

Try this: index = ... | regular expression to catch error max_match=0 | stats count BY error | lookup lookupfile_name error OUTPUT error_description comments | search comments="medium" | stats sum(count) AS count BY error_description ... View more

SHOW US THE FULL SEARCH SPL and a few sample events. ... View more

Are the 9 panels in the same row or different rows? The answer you have referred was created only for one panel. So I would need to know whether you plan to single rows with 9 panels next to each other and 9 show/hide buttons or you need to have 9 rows with one set of show/hide and panel? A whiteboard screenshot of expected design would help assist better. ... View more

Hi @prettysunshinez, you could try something like this: ^\w+\s+(?<my_field>[^ ]*) that you can test at https://regex101.com/r/B6ZNn4/1 Ciao and Merry Christmas. Giuseppe ... View more