Hi Everyone, I have requirement like this: I have one multi select drop-down which consists of 20+ values.Below is the code for the multi-select drop down <input type="multiselect" token="name" searchWhenChanged="true"> <label> Name</label> <choice value="*">All Name</choice> <search> <query>|inputlookup abc.csv|table FolderName</query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <fieldForLabel>FolderName</fieldForLabel> <fieldForValue>FolderName</fieldForValue> <prefix>(</prefix> <valuePrefix>FolderName ="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <suffix>)</suffix> <initialValue>*</initialValue> <default>*</default> </input> I have one dashboard which consists of 20 panels in a form of rows. I want when I select value from multi select drop down say "Force" then "Force" panel should show and rest  panels should hide. If I select "Merchant" from multi select drop-down then "Merchant" panel should show  and rest panels should hide. I have already pass the multi select drop down token "name" in each panel. How can I achieve hide/show of panels. Below is my xml: <form theme="dark"> <label>Report</label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="name" searchWhenChanged="true"> <label> Name</label> <choice value="*">All Name</choice> <search> <query>|inputlookup abc.csv|table FolderName</query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <fieldForLabel>FolderName</fieldForLabel> <fieldForValue>FolderName</fieldForValue> <prefix>(</prefix> <valuePrefix>FolderName ="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <suffix>)</suffix> <initialValue>*</initialValue> <default>*</default> </input> </fieldset> <row> <panel> <title> Report for Force</title> <chart> <search> <query>index=abc sourcetype="xyz" FolderName=force $name$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="trellis.splitBy">FolderName</option> </chart> </panel> </row> <row> <panel> <title> Report for Merchant</title> <chart> <search> <query>index=abc sourcetype="xyz" FolderName=merchant $name$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="trellis.splitBy">FolderName</option> </chart> </panel> </row> <row> <panel> <title> Report for One</title> <chart> <search> <query>index=abc sourcetype="xyz" FolderName=one $name$</query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="trellis.splitBy">FolderName</option> </chart> </panel> </row> <row> <panel> <title> Report for CP</title> <chart> <search> <query>index=abc sourcetype="xyz" FolderName=cp $name$</query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="trellis.splitBy">FolderName</option> </chart> </panel> </row> .......... .......... .......... .......... .......... .......... .......... ............ ............. ............. ................... ..................... </form> Can someone guide me on this. Thanks in advance.   ... View more

Hi Everyone, I have a requirement like this. This is my search query. index=xyz sourcetype=yui source="user.log" process (Type ="*") (Name_Id ="*") (Request_URL ="*")| convert timeformat="%Y-%m-%d" ctime(_time) AS Date| rex field=Request_URL "(?<id>[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|fillnull value="" id| eval ClickHere= "https://cvb/api/?processGroupId=".id|stats count by Date Name_Id Type Request_URL id ClickHere So I am getting data for Date Name_Id Type Request_URL id ClickHere. Where ClickHere column is a hyperlink. My Dashboard script: <dashboard theme="dark"> <label>Process</label> <row> <panel> <table> <search> <query>index=xyz sourcetype=yui source="user.log" process (Type ="*") (Name_Id ="*") (Request_URL ="*")| convert timeformat="%Y-%m-%d" ctime(_time) AS Date| rex field=Request_URL "(?<id>[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|fillnull value="" id| eval ClickHere= "https://cvb/api/?processGroupId=".id|stats count by Date Name_Id Type Request_URL id ClickHere</query> <earliest>-1d@d</earliest> <latest>@d</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <condition field="ClickHere"> <link target="_blank">$row.ClickHere|n$</link> </condition> </drilldown> </table> </panel> </row> </dashboard> Sample of Request_URL's(Multiple URL' are there) https://cgy/api/flow/groups/ef451556-016d-1000-0000-00005025535d https://jkl/api/groups/1b6877ea-0174-1000-0000-00003d8351cd/variable-registry Sample of ClickHere column Hyperlink https://abc/api/?processGroupId=ef451556-016d-1000-0000-00005025535d https://abc/api/?processGroupId=1b6877ea-0174-1000-0000-00003d8351cd I want when I click on Request_URL https://cgy/api/flow/groups/ef451556-016d-1000-0000-00005025535d It should open this ClickHere column hyperlink(https://abc/api/?processGroupId=ef451556-016d-1000-0000-00005025535d. When I click on Request_URL https://jkl/api/groups/1b6877ea-0174-1000-0000-00003d8351cd/variable-registry  It should open this ClickHere column hyperlink https://abc/api/?processGroupId=1b6877ea-0174-1000-0000-00003d8351cd.   In short I want to remove ClickHere column and when I click on Request_URL it should take me to the link that Clickhere column was taken to. Can someone guide me how to do this in splunk. Thanks in advance. ... View more

Hi Everyone, I have a search query as below: index=xyz sourcetype=uio source="user.log" process (Type ="*") (Name_Id ="*") (Request_URL ="*")| convert timeformat="%Y-%m-%d" ctime(_time) AS Date|stats count by Date Name_Id Type Request_URL I am getting the data for Date Name_Id Type Request_URL  There are multiple Request_URL's .Some of the samples are https://xyz/api/flow/process-groups/0a4ffa54-c204-3e9e-a16d-83a4845f83a7 https://uio/api/flow/process-groups/1b6877ea-0174-1000-0000-00003d8351cd I want one more column (Any name) in my search query.Which will Replace Request_URL string like this.  This new column should be hyperlink. https://abc.com/api/?processGroupId=0a4ffa54-c204-3e9e-a16d-83a4845f83a7 https://abc.com/api/?processGroupId=1b6877ea-0174-1000-0000-00003d8351cd I want to display both Request_URL and this new column in my search data Its like whenever Request_URL https://xyz/api/flow/process-groups/0a4ffa54-c204-3e9e-a16d-83a4845f83a7 will come . The new column which will be hyperlink should be this https://abc.com/api/?processGroupId=0a4ffa54-c204-3e9e-a16d-83a4845f83a7. I want both to get displayed. Can someone guide me on that. Thanks in advance. ... View more

Hi Team, I have one requirement : I have multiple URL'S some contain id and some dont contain id's URL'S Example https://opu/api/processs/3fe13d52-d326-15a1-acef-ed3395edd973/registry(with ID) https://POI/api/processors/022adcc6-8001-3d7a-b291-3d0831458357(with ID) https://uyt/api/flow/config (WITHOUT ID) Like this there are more multiple URL's MY id pattern is this in URL's: 05ee3b30-d5e1-1977-9aa9-61c458568edb So I have made regex like this: ^.*([A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})$ Can someone help me out with complete regex . How can I put this (^.*([A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})$) in one column which only contain id's using regex. ... View more