Since the comment section mentioned in this answer is gone from docs but this thread comes up first when googling for splunk strptime %Q %N (at least for me), I'll add a link to a different place where I found an explanation by @DalJeanis : https://community.splunk.com/t5/Splunk-Search/How-can-I-find-the-time-duration-between-two-fields/m-p/372494/highlight/true#M109556 Basically, %N and %Q can do the same if you provide them with a length (such as %6N or %3N). Without length specified, %N will default to three and %Q to six digits. ... View more

Did you correct the index names to be the ones you assigned to your files? ... View more

<input type="dropdown" token="VEHICLE_NAME" searchWhenChanged="false"> <label>Select Vehicle Type</label> <default>TRACTOR</default> <fieldForLabel>VEHICLE_NAME</fieldForLabel> <fieldForValue>VEHICLE_NAME</fieldForValue> <search> <query>index="idx_dropdown" | fields VEHICLE_NAME | dedup VEHICLE_NAME | table VEHICLE_NAME</query> <change> <condition label="*"> <unset token="COMPANY_NAME"> <unset token="MODEL"> <unset token="YEAR"> </condition> </change> <earliest>0</earliest> <latest></latest> </search> </input> ... View more

converted somesoni's answer/comment to an answer so that op CAN accept it. 😉 ... View more

Try this simple XML <fieldset> <input type="dropdown" token="column_tok"> <label>Choose column to display</label> <choice value="Apples">Apples</choice> <choice value="Bananas">Bananas</choice> <default>Apples</default> <search> <query>yoursearchhere | table SID $column_tok|s$ <earliest>-7d@h</earliest> <latest>now</latest> </search> </input> </fieldset> ... View more

This approach worked for me! https://answers.splunk.com/answers/768091/how-to-add-vertical-scrolling-to-a-bar-chart.html ... View more

@splunklakshman I would request you to post a new questions in future for separate questions.... However, if you have downloaded the Splunk 6.x Dashboard Examples app, you can check out Table Row Expansion (More Details) example. This involves Javascript extension to Simple XML which may require you to restart Splunk and also clear browser history for changes to reflect. Please check out and see if it suits your needs. ... View more

index=summary sourcetype=dbx_server source=TB_Azure_Summary | stats sum(Feb_2018) as Totals by SubscriptionName | fillnull value=0 |sort 10 Totals desc Try this, Use Sort ... View more

@splunkazureteam, kindly check if answer of the following question helps. https://answers.splunk.com/answers/594322/how-to-use-multiple-text-tokens-even-with-no-value.html ... View more