Yes, you can use the rex command again with the mode=sed to remove the comma. Assuming your field name is "value" it would be something like: | rex field=value mode=sed "s/\,//g"   If that worked for you please don't forget to upvote the answer so that others can benefit from it. Regards, J ... View more

Hi @vinod0313  sorry for the late reply. I think you set the count field with the same name, try to modify the count name for each search. example index="cx_aws" host="aw-lx0244.deltadev.ent" source ="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode|bucket _time span=1h | stats count as search1_count by _time |append [search index="cx_aws" host="aw-lx0244.deltadev.ent" source="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode | eval TimeTaken3 = trim(replace(TimeTaken, ",","")) | eval REQUESTED_URL2 = trim(replace(REQUESTED_URL, "/contracts/",""))| eval REQUESTED_URL3 = trim(replace(REQUESTED_URL2, "/enrollees","")) | sort -num(TimeTaken3) | WHERE TimeTaken3>10000|bucket _time span=1h | stats count as search2_count by _time] ... View more

HI @gcusello The second one didn't worked actually and i tried the options in the chart with first solution and it worked. Thanks a lot. ... View more

append command may help..  Query1 | eval Name="first"  | append [|search query2| eval Name="second"]  index=_internal | stats avg(kbps) as avg, max(kbps) as max,sum(kbps) as total | eval Name="_internal"| append [search index=_audit| stats avg(kbps) as avg, max(kbps) as max,sum(kbps) as total | eval Name="_audit"] | table Name avg max total ... View more

| rex "template:(?<template>\S+)" ... View more

index=_internal | head 1 | fields _raw | eval _raw="05789549ec5f environment=AWS-DEV 2020-08-25 09:33:52 [scheduling-1] [INFO ] [{spanId=e055c0a22de08485, traceId=e055c0a22de08485}] [com.deltadental.platform.common.config.AppConfig:refreshCommonServicesFeatures:93] - FEATURES_USING=[TOKEN_VALIDATION=false, REQUETS_VALIDATION=false, REQUEST_PAYLOAD_VALIDATION=false, RESPONSE_PAYLOAD_VALIDATION=false, AOP=false, TIBCO_COMMUNICATOR=false, SECRETS_SECURE=false]" | kv and search with smart mode ... View more

Try limiting the number of events with head index="cx_aws" source="notification-service" | head 1 | spath ... I am not sure if this is the right query but it seems to be the one from your image. The point is that head will reduce the number of events from the base search, in this case to 1 i.e. the latest event ... View more

Hi @vinod0313  An additional requirement to your previous question! here  and not a great leap to this: | rex field=_raw "FEATURES_USING=\[(?<feature>.*)\]" | makemv delim=", " feature | mvexpand feature | rex field=feature "(?<Column1>[^=]*)=(?<column2>.*)" | fields Column1,column2     ... View more

@vinod0313 Can your primary table for drilldown have more than one row? If so do you want to hide the drilldown detail table only if same table row is clicked for the second time? Please add how you are setting depends token right now and how is the depends token being set right now. ... View more

spath is the way to go: | makeresults | eval FEATURES="{ \"featureDetails\":[ { \"featureName\":\"TOKEN_VALIDATION\", \"addedIn\":\"1.0.7\", \"description\":\"This feature is used to Validate the JWT token\" }, { \"featureName\":\"REQUETS_VALIDATION\", \"addedIn\":\"1.0.7\", \"description\":\"This feature is used to Validate request URL\" }, { \"featureName\":\"REQUEST_PAYLOAD_VALIDATION\", \"addedIn\":\"1.0.7\", \"description\":\"This feature is used to Validate request body\" }, { \"featureName\":\"RESPONSE_PAYLOAD_VALIDATION\", \"addedIn\":\"1.0.7\", \"description\":\"This feature is used to Validate response body\" }, { \"featureName\":\"AOP\", \"addedIn\":\"1.0.6\", \"description\":\"This feature is used to check method execution time\" }, { \"featureName\":\"TIBCO_COMMUNICATOR\", \"addedIn\":\"1.0.8\", \"description\":\"This feature is used to connect Benefits service \" }, { \"featureName\":\"SECRETS_SECURE\", \"addedIn\":\"1.0.7\", \"description\":\"This feature is used to Validate SECRETS\" } ], \"versionHistory\":[ { \"versionNumber\":\"1.0.0\", \"featuresAdded\":\"Common Exception Handling Capability\"}, { \"versionNumber\":\"1.0.0\", \"featuresAdded\":\"Common Exception Handling Capability\"} ] }" | spath input=FEATURES output=versionHistory path=versionHistory{} | mvexpand versionHistory | spath input=versionHistory output=versionNumber path=versionNumber | spath input=versionHistory output=featuresAdded path=featuresAdded | fields versionNumber, featuresAdded ... View more

| stats count by raw → | mvexpand raw ... View more

The "Splunk Dev for All" app (https://splunkbase.splunk.com/app/4104/#/details) offers a way to do that.   Please STOP using "splunk" as the only work in your message subects. ... View more

Hi  @vinod0313, what result do you have if you run: Your_search | rex "tokenValidatorInfo\=(?<tokenValidatorInfo>[^,]*), requestValidationRequired\=(?<requestValidationRequired>[^,]*), requestPayloadValidationRequired\=(?<requestPayloadValidationRequired>[^,]*), responsePayloadValidationRequired\=(?<responsePayloadValidationRequire>[^,]*), aopUsed\=(?<aopUsed>[^,]*), tibcoCommunicatorUsed\=(?<tibcoCommunicatorUsed>[^,]*), secretsSecured\=(?<secretsSecured>[^\]]*)" ? are the fields extracted or not? if yes, using the other commands you can have the format you want. If not, this means that the logs are different so the rex command fails. In this case, could you share some other example of your logs? Ciao. Giuseppe ... View more

Please share the code that sets and clears the input tokens as well as the panels you wish to hide. ... View more

Use the mvexpand command to create separate rows. P.S.  This is the third (at least) posting with the same "splunk" topic.  Please use more descriptive topics so others can know the nature of the posting before opening it. ... View more

Hi @vinod0313  You can use |transpose function at the end of your query and it will transpose all the x-axis into the y-axis. ... View more

You can do that in 2 ways: 1: with something like this:   | eval new_string = case(old_string="ABC","XYZ",old_string="DEF","UVW")   2: You could store the mapping into a lookup and use the lookup command to find the new string that corresponds to the original string. ... View more

Hi @vinod0313 , @to4kawa's option is dynamic like that.  You only need the part starting with | kv The lines above were just to make up some sample data. You can change ABC to ACB or ACAB or whatever your data will have - only the ones with "true" as value will be listed. Give it a try 🙂 BR Ralph ... View more