@niketn  Thank you. The below works <drilldown> <set token="token1">$click.name2$</set> <set token="token2">$click.value$</set> <eval token="tokEarliest">$row._time$</eval> <eval token="tokEarliestString">strftime($tokEarliest$,"%Y-%m-%d %H:%M:%S")</eval> </drilldown> </chart> </panel> </row> <row depends="$token1$,$tokEarliestString$" > <panel> <table> ... View more

@niketn  Now I am getting the alertstatus. But I need to get the _time in the x axis also. I tried adding the below code, but not working. Could you please suggest the modifications required. Thanks in advance <dashboard> <label>Test_Security_PARC_Roles_Drilldown</label> <row> <panel> <chart> <search> <query>index="index1" sourcetype=table1 source=table1-DH1 | spath | rename message.JOBNAME as JOBNAME, message.JOBSPOOL{}.* as * | mvexpand LINE | search LINE="*Role*" | search LINE="*|*" | eval USERNAME=trim(mvindex(split(LINE,"|"),1)), DATE=mvindex(split(LINE,"|"),2), TIME=mvindex(split(LINE,"|"),3), PERFORMEDBY=mvindex(split(LINE,"|"),4), ACTION=mvindex(split(LINE,"|"),5), ROLE=trim(mvindex(split(LINE,"|"),6)), ROLENAME=trim(mvindex(split(LINE,"|"),7)) | dedup LINE | fields USERNAME DATE TIME PERFORMEDBY ACTION ROLE ROLENAME | table DATE USERNAME ROLE ACTION PERFORMEDBY ROLENAME | join USERNAME [search index="index1" sourcetype=*table2* message.SID = "DH1" | rename message.SID as SID, message.VALUE as table2_DATA | eval mvf1 = split(table2_DATA, ";") | eval USERNAME=trim(mvindex(mvf1,0)) | eval GROUP=mvindex(mvf1,1) | eval VALIDTO=mvindex(mvf1,2) | eval VALIDFROM=mvindex(mvf1,3) | eval LASTLOGONTIME=mvindex(mvf1,4) | eval CLIENT=mvindex(mvf1,5) | eval LASTLOGONDATE=mvindex(mvf1,6) | eval LOCKSTATUS=mvindex(mvf1,7) | eval LDATE=strftime(strptime(LASTLOGONDATE, "%Y%m%d"),"%d.%m.%Y")| eval LDATE2=strptime(LASTLOGONDATE, "%Y%m%d") | eval today=strftime(now(),"%d.%m.%Y") | eval lastMo = relative_time(now(),"-90d@d") | fields DATE USERNAME SID CLIENT GROUP VALIDTO LASTLOGONTIME LASTLOGONDATE LOCKSTATUS LDATE today 90days lastMo LDATE2 | dedup USERNAME | fields USERNAME GROUP ] | join type=outer [search index="index1" sourcetype=table3 source=table3-DH1 | rename message.SID as SID, message.VALUE as ROLE_DATA | eval mvf1 = split(ROLE_DATA, ";") | eval ROLE=trim(mvindex(mvf1,0)), MODIFIED=trim(mvindex(mvf1,1)) | fields ROLE MODIFIED ] |eval AlertStatus=if( MODIFIED = 'X', "RISK", "NO_RISK") | eval _time=strftime(strptime(DATE,"%d.%m.%Y"),"%Y-%m-%d %H:%M:%S")|chart count over _time by AlertStatus</query> <earliest>0</earliest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <drilldown> <set token="token1">$click.name2$</set> <set token="token2">$click.value$</set> </drilldown> </chart> </panel> </row> <row depends="$token1$,$token2$" > <panel> <table> <title>User Roles</title> <search> <query>index="index1" sourcetype=table1 source=table1-DH1 | spath | rename message.JOBNAME as JOBNAME, message.JOBSPOOL{}.* as * | mvexpand LINE | search LINE="*Role*" | search LINE="*|*" | eval USERNAME=trim(mvindex(split(LINE,"|"),1)), DATE=mvindex(split(LINE,"|"),2), TIME=mvindex(split(LINE,"|"),3), PERFORMEDBY=mvindex(split(LINE,"|"),4), ACTION=mvindex(split(LINE,"|"),5), ROLE=trim(mvindex(split(LINE,"|"),6)), ROLENAME=trim(mvindex(split(LINE,"|"),7)) | dedup LINE | fields USERNAME DATE TIME PERFORMEDBY ACTION ROLE ROLENAME | table DATE USERNAME ROLE ACTION PERFORMEDBY ROLENAME | join type=outer [search index="index1" sourcetype=table3 source=table3-DH1 | rename message.SID as SID, message.VALUE as ROLE_DATA | eval mvf1 = split(ROLE_DATA, ";") | eval ROLE=trim(mvindex(mvf1,0)), MODIFIED=trim(mvindex(mvf1,1)) | fields ROLE MODIFIED ] |eval AlertStatus=if( MODIFIED = 'X', "RISK", "NO_RISK") | eval date2=strftime(strptime(DATE,"%d.%m.%Y"),"%Y-%m-%d %H:%M:%S")| where AlertStatus="$token1$" AND date2="$token2$" </query> <earliest>0</earliest> <latest></latest> </search> </table> </panel> </row> </dashboard> ... View more

@thambisetty Apologies, I am new to Splunk drill down. Could you please help how will the encoded code helps in the query ... View more

any@niketn  Thank you for the reply. Please find the below XML code . The values need to be populated based on the date.  Any suggestions would be appreciated . Thanks in advance   <form> <label>Security Roles</label> <fieldset submitButton="false"></fieldset> <row> <panel> <chart> <search> <query>index="indexPro" sourcetype=RSUSR100N source=RSUSR100N-DH1 | spath | rename message.JOBNAME as JOBNAME, message.JOBSPOOL{}.* as * | mvexpand LINE | search LINE="*Role*" | search LINE="*|*" | eval USERNAME=trim(mvindex(split(LINE,"|"),1)), DATE=mvindex(split(LINE,"|"),2), TIME=mvindex(split(LINE,"|"),3), PERFORMEDBY=mvindex(split(LINE,"|"),4), ACTION=mvindex(split(LINE,"|"),5), ROLE=trim(mvindex(split(LINE,"|"),6)), ROLENAME=trim(mvindex(split(LINE,"|"),7)) | dedup LINE | fields USERNAME DATE TIME PERFORMEDBY ACTION ROLE ROLENAME | table DATE USERNAME ROLE ACTION PERFORMEDBY ROLENAME | join USERNAME [search index="index_heineken-uk" sourcetype=*USR02* message.SID = "DH1" | rename message.SID as SID, message.VALUE as USR02_DATA | eval mvf1 = split(USR02_DATA, ";") | eval USERNAME=trim(mvindex(mvf1,0)) | eval GROUP=mvindex(mvf1,1) | eval VALIDTO=mvindex(mvf1,2) | eval VALIDFROM=mvindex(mvf1,3) | eval LASTLOGONTIME=mvindex(mvf1,4) | eval CLIENT=mvindex(mvf1,5) | eval LASTLOGONDATE=mvindex(mvf1,6) | eval LOCKSTATUS=mvindex(mvf1,7) | eval LDATE=strftime(strptime(LASTLOGONDATE, "%Y%m%d"),"%d.%m.%Y")| eval LDATE2=strptime(LASTLOGONDATE, "%Y%m%d") | eval today=strftime(now(),"%d.%m.%Y") | eval lastMo = relative_time(now(),"-90d@d") | fields DATE USERNAME SID CLIENT GROUP VALIDTO LASTLOGONTIME LASTLOGONDATE LOCKSTATUS LDATE today 90days lastMo LDATE2 | dedup USERNAME | fields USERNAME GROUP ] | join type=outer [search index="index_heineken-uk" sourcetype=AGR_USERS source=AGR_USERS-DH1 | rename message.SID as SID, message.VALUE as ROLE_DATA | eval mvf1 = split(ROLE_DATA, ";") | eval ROLE=trim(mvindex(mvf1,0)), MODIFIED=trim(mvindex(mvf1,1)) | fields ROLE MODIFIED ] |eval AlertStatus=if( MODIFIED = 'X', "RISK", "NO_RISK") | eval _time=strftime(strptime(DATE,"%d.%m.%Y"),"%Y-%m-%d %H:%M:%S") |chart count over _time by AlertStatus</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> <refresh>5m</refresh> <refreshType>delay</refreshType> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">ROLE</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">DATE</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <drilldown> <set token="tokComponent">$row._time$</set> </drilldown> </chart> </panel> </row> <row depends="$tokComponent$"> <panel> <title>User Roles</title> <table> <search> <query>index="indexPro" sourcetype=RSUSR100N source=RSUSR100N-DH1 | spath | rename message.JOBNAME as JOBNAME, message.JOBSPOOL{}.* as * | mvexpand LINE | search LINE="*Role*" | search LINE="*|*" | eval USERNAME=trim(mvindex(split(LINE,"|"),1)), DATE=mvindex(split(LINE,"|"),2), TIME=mvindex(split(LINE,"|"),3), PERFORMEDBY=mvindex(split(LINE,"|"),4), ACTION=mvindex(split(LINE,"|"),5), ROLE=trim(mvindex(split(LINE,"|"),6)), ROLENAME=trim(mvindex(split(LINE,"|"),7)) | dedup LINE | fields USERNAME DATE TIME PERFORMEDBY ACTION ROLE ROLENAME | table DATE USERNAME ROLE ACTION PERFORMEDBY ROLENAME | where DATE="$tokComponent$" </query> <earliest>0</earliest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> ... View more

@thambisetty  Could you please help how to do that . Please do share some working example Thanks in advance ... View more

@rnowitzki  Thank you this works. If I have multiple countries how should I give the if condition for the eval statement | eval country= if(atomName == "APAC", "India", "United States") like I also need to add if atomName="EUR", it should be Netherlands , similarly multiple conditions for country Thanks in advance ... View more

@Nisha18789  Thank  you This works. Could you please suggest if I need to add a static image inside each panel, what is the code to be added. We are using splunk cloud not the enterprise .  <panel depends="$alwaysHideHTMLStyle$"> <html> <style> body{margin-bottom: 150px;background: #F08080!important;} .dashboard-body{background-color:#F08080!important; font-weight:bold!important} </style> <p> <center><a href="http://abc.com" style="color:black;" alignment="central">BLOCK</a></center> </p> </html> </panel> <panel> ... View more

@Nisha18789  thank you. I need only back ground color , the panels need not be in the same color ... View more

@ITWhisperer  Only the background color .The panels need to be not the same color. When I added your below code, the complete dashboard is becoming that color. Could you please suggest how can i exclude panels from that <row depends="$STYLES$"> <panel> <html> <style> .main-section-body { background:red !important; } </style> <p> <center><a href="http://abc.com" style="color:black;" alignment="central">BLOCK</a></center> </p> </html> </panel> <panel> <html> <p> <center><a href="http://abc.com" style="color:black;">High Disk %</a></center> </p> </html> </panel> ... View more

@thambisetty  is it not possible to place this image in some location where splunk cloud is installed and then import that file ? ... View more

 @ITWhisperer Thank you , the expression is working fine in search. When I am trying to give the same expression while extracting fields, so that the field user will be permanent, Its not working. I had chosen 'I prefer to write the regular expression myself '   and had added the expression. But I am not able to view the field.Could you please suggest whats causing the issue, but the same is working in search. Attaching screenshot for reference. Please suggest if its the same way we have to give regular expression while extracting fields                 ... View more

@Richfez  Thank you for the response. But I tried with the same query which you have shared but certain single process only its showing above 100 which is not correct. If you could help with the correct formula to calculate the cpu of each process it would be great Thanks in advance ... View more

@richgalloway  Below is one of the example i saw in the document for splunk cloud. If the splunk cloud is accessible with the DNS shared by the client, should we add the port 8088 also ? Also are we executing these from command prompt ? or what other way we can pass the data using hec. since i am a beginner in using hec, any help would be appreciated curl -k "https://mysplunkserver.example.com:8088/services/collector" \ -H "Authorization: Splunk CF179AE4-3C99-45F5-A7CC-3284AA91CF67" \ -d '{"event": "Hello, world!", "sourcetype": "manual"}'     ... View more

@richgalloway  Could you please share a sample request which can be sent to test the connectivity from the machine with Splunk Cloud provided the hec token= abcdefghijklmnop I see a lot of examples, but giving different errors. It would be great if you can help with an example ... View more

@to4kawa  Thank you for the help. Also there is a requirement to find the high cpu consumption process not the total cpu % , how the query should be and what should be the wql query/  configuration file changes. Thanks in advance ... View more