Hi All <form> <label>demo</label> <fieldset submitButton="false"> <input type="time" token="field1"> <label>time</label> <default> <earliest>0</earliest> <latest></latest> </default> </input> </fieldset> <row> <panel> <title>demo1</title> <table> <search> <query>index=ihs host=losat sourcetype=ihs_acc ( URLRedefined="/wcs/resource/store/101" ) | eval URL= case ( match(URLRedefined,"\/wcs\/resource\/store\/101"),"/wcs/resources/store/101" ) | lookup sla1.csv url as URL OUTPUT SLA | eval RespTime=round(ResponseTime/1000,3) | eval sla_status = if(RespTime>SLA, "Alert !! SLA Breached", "Happy !! Under SLA") | stats count as "Total Hits" perc95(RespTime) as "95th Percentile Response Time" by URL sla_status Method | rename sla_status as "SLA Status" | sort "SLA Status"</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="SLA Status"> <colorPalette type="map">{"Abey !! SLA Breach Ho Gaya":#D93F3C,"Happy !! Under SLA":#65A637}</colorPalette> </format> <drilldown> <link>/en-US/app/search/demo?</link> </drilldown> </table> </panel> </row> <row> <panel> <chart> <title>graph</title> <search> <query>index=ihs host=losat sourcetype=ihs_acc URLRedefined=$click.value$ | eval RespTime=round(ResponseTime/1000,3) | timechart perc95(RespTime)</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="charting.chart">line</option> </chart> </panel> </row> </form> In the above source code ..there are 2 panels ...one is demo and other is graph My condition is : when the results for first panel are displayed and when i click on URL column value a timechart should display in the second panel named graph Problem is i am not able to drilldown link the URL and then use it in second panel query using token. I have gone through the splunk tutorial but that doesn't seems to be explaining in layman terms . ... View more

Hi All, Suppose there are 2 stats panels in a dashboard like below 1st Panel URL Method Total its ResponseTime / get 12 1200 2nd panel URL Method TotalHits ResponseTime /d post 5 1234 so if u see 2 panels have same columns but spacing between columns in both panels is not in a arranged way 1st panel spacing is less as compared to 2nd panel spacing between columns HOW to adjust this spacing so that values comes in proper way and presentable way . ... View more

Hi All, I have this scenario where i have couple of diff types of URL's like /webapp/wcs/services/Key /webapp/wcs/services/Address /wcs/resources/v1?* /webapp/orderId=* I want to write a query to list down the response time for each url by url wise like this URL Response time /webapp/wcs/services/Key 50 /webapp/wcs/services/Address 30 /wcs/resources/v1?* 25 /webapp/orderId=* 10 I know we can use like command but like only matches the exact url which are starightforward , if wildcard is there its not able to match and hence not showing the stats , how to manipulate the query to get the required result .....i have lot of url's but only listing 4 here . i wrote the below query but its not returning the data for the url's containing the wildcards index=ih host=los sourcetype=ihD (URLRedefined="/webapp/wcs/services/Key" OR URLRedefined="/webapp/wcs/services/Address" OR URLRedefined="/wcs/resources/v1?*" OR URLRedefined="/webapp/orderId=*" ) | eval URL=case(like(URLRedefined,"/webapp/wcs/services/Key"),"/webapp/wcs/services/Key", like(URLRedefined,"/webapp/wcs/services/Address"),"/webapp/wcs/services/Address", like(URLRedefined,"/wcs/resources/v1?*"),"/wcs/resources/v1?*", like(URLRedefined,"/webapp/orderId=*"),"/webapp/orderId=*") | stats perc95(ResponseTime) by URL ... View more

Hi All , I have this query : index=no host=los* sourcetype= plp ( path=/desktop /pl/* ) OR ( path=/mobile/pl/* ) | stats perc95(responseTime) as "95th Perc Response Time" by path I Want the result to come like this as shown below( coagulated response time for the desktop and mobile separately ) : Path 95th Perc Response Time /desktop/pl/* 234 /mobile/pl/* 2344 But the result is showing all the url's in path section just because i have used a wildcard in that place . how to modify this query to get the expected the result. ?? ... View more

I have this below query . After the summation of values is calculated , i have to find the ratio of read versus write and have to modify this query only for that . How to do it? index=nmon host=* type=DISKWRITE OR type=DISKREAD | stats sum(value) by type ... View more