Thank you so much ... View more

For reports and alerts, how to hide the clone button....when we to report and alerts we see all the reprt along that action field under that we see clone...I want to hide that /or not show...from which conf file we can achive..? Default.meta I did not find option ... View more

Yes I tried that as well.. One curious thing....I see few of the example working fine like -https://intellectualpoint.com ...but when tried for https://tableau.com that did not work and I see same errror ... View more

Hi, Do we any documentation for this type of issue , as it's with every upgrade    I am havng same issue with Splunk 8.0.6, and the above is not helping me to load iframe  Tried the same in web.conf          ... View more

Thanks for this approach....although I had to do drilldown to another dashboard...but the split logic used in drilldown was the need for me...thanks a lot ... View more

Hi @vikashperiwal, yes, as I said, if you want divided fields, you have to divide them after display using e.g. a regex: | rex field=display_fields "^(?<field1>[^-]+)-(?<field2>[^-]+)-(?<field3>.+)" The problem is to give the correct name field to the column because SPL isn't a procedural language so you cannot rename a field based on an if  condition. Ciao. Giuseppe ... View more

Hi yannK, Now we have the same problem about one scheduled report, but the smart mode has no results, the verbose mode must have results. The problem is that the scheduled report is set to verbose mode, which does not take effect. Is there any other solution? Thanks in advance! ... View more

The solution I referenced is for tables, not singleValue visualizations. ... View more

@vikashperiwal unfortunately this will not be just CSS based solution as there is no direct link between Chart series being hovered and tooltip's DOM. You may have to try jQuery based approach. Try to adjust the example as per your needs: https://community.splunk.com/t5/Archive/How-to-change-the-dislay-value-in-graph/td-p/375473 ... View more

do not append all your raw events. you should append processed results from second search. this way you can improve the performance of search. ... View more

I could get the desired output, i have set the drilldown panle token to both the value of radio button, which magicaly worked. ... View more

@vikashperiwal Based on your question seems like only if value_status in your data is already failed you want to use that value for deriving Overall Status. For other value_status, the Overall Status is determined based on whether you have End Date present in data or not. So try the following eval:   | eventstats values(value_status) as status_values by id | eval Ov_status=case(status_values=="Failed","Failed", isnotnull(start_time) AND isnull(end_time ),"Inprogress", isnotnull(start_time) AND isnotnull(end_time ),"Completed", true(),"Unknown")    Following is a run anywhere example based on the details provided:   | makeresults | eval data="xyz.123 2020-07-22 Failed -;xyz.123 2020-07-22 Completed 2020-07-22;abc.321 2020-07-22 Inprogress -;" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval id=mvindex(data,0), start_time=mvindex(data,1), value_status=mvindex(data,2), end_time=mvindex(data,3) | eval end_time=case(end_time!="-",end_time) | table id start_time end_time value_status | eventstats values(value_status) as status_values by id | eval Ov_status=case(match(status_values,"Failed"),"Failed", isnotnull(start_time) AND isnull(end_time ),"Inprogress", isnotnull(start_time) AND isnotnull(end_time ),"Completed", true(),"Unknown")   ... View more

This is exactly what i was looking for..... Thank you very much .. @niketn  ... View more

I wonder if using unnamed capture groups might help.  Try this REGEX = write_log\svalues:(\w*.\.\w*\.\w*)\.([\w\.\-]*)\s*(\d{1,4})\s*(\d*) ... View more

Here it is <label>West</label> <choice value="ONHOOD-SPGW-05, ONHOOD-SPGW-06, ONHOOD-SPGW-07, ONHOOD-SPGW-08, PQPTFD-SPGW-03,">ALL</choice> <choice value="ONHOOD-SPGW-05,ONHOOD-SPGW-06">ONHOOD-SPGW-05/06</choice> <choice value="ONHOOD-SPGW-07, ONHOOD-SPGW-08">ONHOOD-SPGW-07/08</choice> <choice value="PQPTFD-SPGW-03 ,PQPTFD-SPGW-04">PQPTFD-SPGW-03/04</choice> This is just the multi select tab i am showing here, rest token is passed in my query.. query is working fine, only enhancement i want is for when ALL is selected , instead of showing the values in chart it should show "WEST", Only for ALL it should show value as "WEST" | timechart span=15m avg(a1) as "session_current" by host ... View more

Great! Do read the documentation for all other attributes and REST API for alternative approach. Also up vote the comment/previous answer that helped 🙂 ... View more

Try moving the filter for OPC to the base search index=ndspr sourcetype=ISUP_EVENT_ACCESS_VW O=* | lookup core_ip_voice_keystore DPC as N OPC as O CIC as K OUTPUT OPC DPC CIC ADNUM ADMININF NETNAME ROUTESET TRKGRSIZ | table A B C D E F K N O OPC DPC CIC ADNUM ADMININF NETNAME ROUTESET TRKGRSIZ If you need to configure automatic time lookup, use the following doc for reference https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/Makeyourlookupautomatic#Example_configuration_of_an_automatic_KV_Store_lookup In your case. [ISUP_EVENT_ACCESS_VW] LOOKUP-core_ip_voice_keystore = core_ip_voice_keystore DPC as N OPC as O CIC as K OUTPUT OPC DPC CIC ADNUM ADMININF NETNAME ROUTESET TRKGRSIZ And the your search would be. index=ndspr sourcetype=ISUP_EVENT_ACCESS_VW OPC=* | table A B C D E F K N O OPC DPC CIC ADNUM ADMININF NETNAME ROUTESET TRKGRSIZ ... View more

All saved/scheduled searches run as Smart Mode . Always. ... View more

When we run the query in fast mode for different time ranges(say Last 24 hours, All Time), it returns different results everytime. Is it some bug? ... View more

Hi, from a data point of view, join is one of the most expensive operations you can do. If you want to optimise your query without using join, you will have to restructure your data in such a way that it can be avoided. For enriching the events with data that is available and valid at index time, you could consider to include lookups at index time or automatic lookups at search time. If .csv files are too slow for like 1M+ rows of lookup data, check out the kvstore as an alternative or use filtering or advanced lookup features like time lookups. IMHO join was never meant to be a replacement for lookups as it is a totally different operation and unless you actually need the product of two sets of data, should be avoided due to the high complexity of the operation - Oliver ... View more