Hi , I have OS field which has many rows .In that i need to filter only the below values and create a field , Windows Server 2012 R2 Standard Windows 7 Windows Server 2012 Windows 7 Enterprise Windows 10 Microsoft Windows Server 2008 R2 Standard Microsoft Windows Server 2008 R2 Enterprise Microsoft Windows 2008 Server Standard Windows 8 Windows 10 Enterprise When i use match function like , eval OS=mvfilter(match(OS,"Windows Server 2012 R2 Standard") OR match(OS,"Windows Server 2012") OR match(OS,"Windows 7")) |stats count by OS I am getting other values "Windows 7 embedded " also which i dont need in the list of values. Please help to filter the exact values which i needed above. Thanks . ... View more

HI, My data is like , Sno Name URL Column2 1 A Null Null 2 Null https:/ Null 3 Null Null fast Here I need to fill values in null values using our Splunk search query. Please help with this query. How do I insert values in the Null value fields? Regards. ... View more

Hi , My requirement is to keep a link in a dashboard , which should open another dashboard or report .The linked dashboard will have a statistical table of data .The data should be based on the filter selection from parent dashboard. Please help me out to sort this out. ... View more

HI , CAn anyone tell me , which chart can replace pie chart .I need this bcoz for me pie chart to be replaced with other better visualising chart ... View more

Hi , I have values like Failure Ignored Partial Success 0 803 23 0 24 0 0 0 192 1 0 0 23 6 21 45 3 2 4 31 5 89 4 85 My requirement is to create a pie chart with the above values ( i mean with each column total count).These total columns should be Show breakdown by Success/ Failure / Partial Success / Ignored. Show a pie chart for the week with above data , i need to create a drill down for the above piechart When i select anyone of the above values like (Success,Failure,Ignored,Partial) ,I have the row value as Name which has machine name as its values. My search is , index=macqw2|fillnull|search name="Saqpedc102" |eventstats sum(Current_Failure) as Failure,sum(Current_Ignored) as Ignored,sum(Current_Partial) as Partial,sum(Current_Success) as Success |transpose|Rename "column" as Delta|search Delta="Ignored"|table Site Partial Success Failure Ignored I am getting error for this when i click th pie chart .Please help me with the search ... View more

Hi , I am facing a strange issue like missing 2 starting characters in a field.My data is coming as a view from datawarehouse and its a a sql server .I am getting proper name in warehouse but not in splunk dashboard or search.Iam creating index using splunk db connect using the view . I have "Name" field which has a value like "LL3CCCZM2" in warehouse , But is showing as 3CCCZM2 in splunk dashboard. Can anyone help me to find the reason and rectify this in splunk please . ... View more

I have the below values in a field , Sadf123.dfd.com er-md-kt-mgmt.com feb-fe345@tbm.com I need to extract the values like below , Sadf123 er-md-kt feb-fe345 Can anyone help me to extract this ... View more

HI , My search is , index=demo |eval name=lower(name)|fillnull value=Null|replace True with Compliant False with "Non_Compliant" in Compliance |search eligibility=* Appliance="*" |stats count by Compliance This gives me output like , Complaint 85 Non-Compliant 40 Missing 10 Here i need to create a cutom alert(email to be sent) whenever compliant is < 95%.I was not able to do this. Regards, Sundar ... View more

Hi , can anyone please help me with answer for "how Ad groups are tied to the groups within splunk 6.3". Please help me with the settings where it is done (i mean the path) ... View more