I am looking to calculate per second transactions but when doing so through either stats or a timechart I am hitting the limits of these functions. This is in a dashboard with a time selector so it can be variable. Is there any way to protect against running over the limits in a search? I was using the per_second function in timechart. Has anyone found a better way to handle getting average, min/max at a per second interval?     timechart span=5m per_second(count) as TPS      ... View more

I want to get a per second average over a period of time. I am running into an issue getting an average of these values. For example one item only occurs 4 or so times and when I calculate the average I get 1; it is not considering the seconds where there are no results. I am doing the following now:   | bin _time span=1s |stats count as Vol by foo | stats avg(vol) by foo   I would expect to get a very low decimal due to all of the 0 values but, I get 1. I have attempted multiple ways of doing this but it seems that it is only doing an average of the existing values, not the times where I do not have results. ... View more

I have an event list in a dashboard so I can use a workflow action. What I found is that it would be easier to have a drill down in the panel to get to the URL the workflow is using. Putting the data into a table is not ideal based on how everything gets formatted. I wanted to still use the Event panel type; is it possible to append a column between Time and the Event? ... View more

I have an event action I want users to be able to access in a dashboard. Right now I need to include an event panel, and then users need to go through there to access it. Is it possible to call the event action through a hyperlink? ... View more

I have a set of trellis items that I want to show in a dashboard. With the results though I want to set the height dynamically to show all the trellis structures correctly. Is there a way I can get the count returned from the job as to how many trellis' the job created? ... View more

I had annotations I wanted to control with a Yes or No dropdown. It mostly works, unsetting the token doesn't seem to clear the token correctly as the annotations remain.      <search depends=$showToken$ id="base"> <query>search.....</query> </search> ... <input type="dropdown" token="showToken" searchWhenChanged="true"> <label>...</label> <choice value="yes">Yes</choice> <choice value="no">No</choice> <change> <condition match="$value$ == &quot;yes&quot;"> <set token="showToken">true</set> </condition> <condition match="$value$ == &quot;no&quot;"> <unset token="showToken"></unset> </condition> </change>   is there a better way to accomplish this easily? I saw an older post that said using javascript could work but I need to do this through only XML at this time. ... View more

I was working on using | rest ....alerts/fired_alerts to create annotations for a dashboard. I thought I read somewhere that the way the fired_alerts are stored is that on a restart of Splunk this data will be lost. Is this true on Cloud? ... View more

I am working on using prediction for alerting. I want to track some data I have that has some business trends; it is fairly seasonal. Right now we manually calculate a baseline; which only works if our data is stable. So I have found as our traffic rises and falls through the seasonality of it; our calculated baseline is inaccurate most of the time. I have created a prediction based alert but it has not been received too well since it uses standard deviation. Is there an issue to base alerting from standard deviation? Just trying to under stand if there is some limitation or if it is error prone. The data I am getting seems to be accurate thresholds for the alerts. ... View more

I am using a bin of 10 minutes with stats for the past hour. What I am running into is that when doing so not all items in my stats command have a count for one of the buckets. For example one might show up for the 10, 20, 40 minute buckets but, I want to the 30 and 50 minute buckets to show blank values. What is the best way to accomplish this? Fillnull does not work for this since there is no null value, the value just is not showing at all. ... View more

I know through a workflow action I can add add a token value to a URL string. Is there any way to populate a value on the web page? For example I want to go to another application where I am unable to add the token value to the string but there is a filter within the application I want to use. Is this possible? ... View more