Hello, Splunk query provided in correct responses. I have A query which filters the data on a specific day and provided the results. Here we index the CSV data every day by using CRCSALT= as we need the whole data set to be reindex even if there is no change in data set. in the Query I have used a Eval command to print a value CAP-M1 , M2, M3 etc for each query outcome as a unique identifier. but by query provided corrects unique values while executing. for Example I have a Query A with unique value CAP-M1 and Query B suppose to print unique value as CAP-M2 but in the query B it keeps providing Value M1 instead of M2. in the screen shot it suppose to print M4 for all days but its printing various values Similarly for other searched also. Is this due to some cache memory issue in splunk? Thanks ... View more

Hi, We have a custom template for PDF documents, And we wanted to print / download dashboard in the same internal template. is there any way that we can export the dashboard as PDF from Splunk in our PDF template / format thanks ... View more

i created an app for some reports,i export as spl format.how i can secure my source query from user's?any kind of source encryption method is there for source query? ... View more

Hello Is it possible to migrate indexed data from one Splunk instance to another splunk instance. I have a few indexes which have been holding data for a few years and now I need to move this to a different spunk instance. New Splunk instance completely new environment without any of the old indexes created in it Thanks, ... View more

I have a table output like Date Title Product Count 10 November 2019 PA Number of A 371 10 November 2019 PA Number of B 129 10 November 2019 PA Number of C 195 10 November 2019 PA Number of D 110 10 November 2019 PA Total 455 10 November 2019 PA Number of E 1 10 November 2019 PA Number of F 0 10 November 2019 PA Number of G 0 10 November 2019 PA Number of H 0 10 November 2019 PA) Number of I 129 Here i have to perform the ratio calculation part with respect to total value, for remaining field values in count field. I do not want to print the calculation as | eval ratio=(Count/455)*100. I want to pass this value of total as some static field, as my total values keeps changing dynamically. Is there a possible was ... View more