Hello, I'm having a hard time creating a download button. I have a scheduled report every day. I would like to create a button in the dashbard that downloads that report. I cannot use js. Can you help me? I found a way to download the query created but so I also view the table and I don't want to show it, just download the result. Tks Bye Antonio ... View more

Hello everybody, I have a question for the community: Is there a reverse split command? I'll explain my problem: I have a: | eval Holidays = "01 / 01.01 / 06.08 / 15.11 / 01.12 / 08.12 / 25.12 / 26.05 / 01.04 / 25.06 / 02" with the holidays that I want to remove from the day count (I create it, it can be a single value or a multivalue) now I have to add the current year: | eval year = strftime (now (), "% Y") and have this day excluded from the final count: | eval dates = mvrange (C3, now (), 86400) | eval dates = mvfilter (NOT match (dates, "(Excluded)")) | convert ctime (dates) timeformat = "% A" | eval dates = mvfilter (NOT match (dates, "(Saturday | Sunday)")) | eval noOfDays = mvcount (dates) I want to create an Excluded field that has holidays with the current year as value for example: Excluded = "1640991600.000000 | 1641423600.00000 | 1660514400.000000 | ........" It's possible? Is there a reverse split command? Tks Br ... View more

Hi, I have an event display problem when no events matching the conditions are found. I want to filter only those events that have the "DATA_LAVORAZIONE" (STC) field greater than "OGGI" up to 7 days ahead. In the AMPLIAMENTI sourcetype there are some events for which it returns the sum, while in the DIRETTA sourcetype there are no events, and it does not show me anything. I would like the row with all 0s to be displayed anyway. I tried with fillnull value = 0 field, field, field .... but it doesn't work. Also tried fulldown, but nothing. Do you have any suggestions? Thank you   CODE: index =DATI sourcetype = AMPLIAMENTI |fields - _* |eval OGGI=strftime(relative_time(now(),"-0d@d"), "%Y-%m-%d") |eval OGGI_1=strftime(relative_time(now(),"+1d@d"), "%Y-%m-%d") |eval OGGI_2=strftime(relative_time(now(),"+2d@d"), "%Y-%m-%d") |eval OGGI_3=strftime(relative_time(now(),"+3d@d"), "%Y-%m-%d") |eval OGGI_4=strftime(relative_time(now(),"+4d@d"), "%Y-%m-%d") |eval OGGI_5=strftime(relative_time(now(),"+5d@d"), "%Y-%m-%d") |eval OGGI_6=strftime(relative_time(now(),"+6d@d"), "%Y-%m-%d") |eval OGGI_7=strftime(relative_time(now(),"+7d@d"), "%Y-%m-%d") |eval STC=strftime(strptime(DATA_LAVORAZIONE, "%Y-%m-%d"), "%Y-%m-%d") |where STC > OGGI |eval X = if(STC=OGGI,1,0) |eval X+1 = if(STC=OGGI_1,1,0) |eval X+2 = if(STC=OGGI_2,1,0) |eval X+3 = if(STC=OGGI_3,1,0) |eval X+4 = if(STC=OGGI_4,1,0) |eval X+5 = if(STC=OGGI_5,1,0) |eval X+6 = if(STC=OGGI_6,1,0) |eval X+7 = if(STC=OGGI_7,1,0) |eval TOTALE=if(STC > OGGI AND STC <= OGGI_7,1,0) |eval TUTTI=if(STC > OGGI ,1,0) |sort - DATE_UPD, LINK |dedup LINK |where STATO IN("LAVORAZIONE", "CONFERMA DATA") |stats sum(X) as X, sum(X+1) as X+1,sum(X+2) as X+2, sum(X+3) as X+3,sum(X+4) as X+4,sum(X+5) as X+5, sum(X+6) as X+6,sum(X+7) as X+7, sum(TOTALE) as TOTALE,sum(TUTTI) as OVER |eval TIPOL ="AMPLIAMENTI" |table TIPOL X X+1 X+2 X+3 X+4 X+5 X+6 X+7 TOTALE OVER |append [ search index =DATI sourcetype = diretta |fields - _* |where TIPOLOGIA IN("SUBNET","VOCE") |eval OGGI=strftime(relative_time(now(),"-0d@d"), "%Y-%m-%d") |eval OGGI_1=strftime(relative_time(now(),"+1d@d"), "%Y-%m-%d") |eval OGGI_2=strftime(relative_time(now(),"+2d@d"), "%Y-%m-%d") |eval OGGI_3=strftime(relative_time(now(),"+3d@d"), "%Y-%m-%d") |eval OGGI_4=strftime(relative_time(now(),"+4d@d"), "%Y-%m-%d") |eval OGGI_5=strftime(relative_time(now(),"+5d@d"), "%Y-%m-%d") |eval OGGI_6=strftime(relative_time(now(),"+6d@d"), "%Y-%m-%d") |eval OGGI_7=strftime(relative_time(now(),"+7d@d"), "%Y-%m-%d") |eval STC=strftime(strptime(DATA_LAVORAZIONE, "%Y-%m-%d"), "%Y-%m-%d") |where STC > OGGI |eval X = if(STC=OGGI,1,0) |eval X+1 = if(STC=OGGI_1,1,0) |eval X+2 = if(STC=OGGI_2,1,0) |eval X+3 = if(STC=OGGI_3,1,0) |eval X+4 = if(STC=OGGI_4,1,0) |eval X+5 = if(STC=OGGI_5,1,0) |eval X+6 = if(STC=OGGI_6,1,0) |eval X+7 = if(STC=OGGI_7,1,0) |eval TOTALE=if(STC > OGGI AND STC <= OGGI_7,1,0) |eval TUTTI=if(STC > OGGI ,1,0) |sort - DATE_UPD, LINK |dedup LINK |where STATO IN("CONFERMA DATA") |stats sum(X) as X, sum(X+1) as X+1,sum(X+2) as X+2, sum(X+3) as X+3,sum(X+4) as X+4,sum(X+5) as X+5, sum(X+6) as X+6,sum(X+7) as X+7, sum(TOTALE) as TOTALE,sum(TUTTI) as OVER |eval TIPOL ="SUBNET - VOCE" | fillnull value=0 TIPOL X X+1 X+2 X+3 X+4 X+5 X+6 X+7 TOTALE OVER |table TIPOL X X+1 X+2 X+3 X+4 X+5 X+6 X+7 TOTALE OVER] . (others APPEND) . . |table TIPOL X X+1 X+2 X+3 X+4 X+5 X+6 X+7 TOTALE OVER   RESULT: TIPOL                                  X    X+1   X+2    X+3 ........ TOTAL   OVER AMPLIAMENTI                0       2       1          0     .......       3            3   DESIRED:  TIPOL                                  X    X+1   X+2    X+3 ........ TOTAL   OVER AMPLIAMENTI                0       2       1          0     .......       3            3 SUBNET - VOCE             0      0        0          0  .........       0            0 TKS ... View more

hi, I have a question to ask: can you assign values to multiple variables in Splunk with the case command? I need that based on a filter chosen in the dashboard, it performs a different search based on what has been selected. I have a filter with options: red, green, yellow, blue, black If you choose red, the search must be: search field1 = A AND field2 = B if you choose green: search field1 = C AND field2 = D AND field3 = E if you choose yellow: search field1 = X AND field2 = Y ..... I wanted to use a case like: eval KK, HH, JJ = case ( color = "red", KK = A, HH = B, JJ = "", color = "green", KK = C, HH = D, JJ = E, color = "yellow", KK = X, HH = Y, JJ = "", 1 = 1, "INV") It can be done? Or do I have to use as many cases as there are variables I need in the search? Tks Bye Antonio ... View more

Hi, I can't understand why this query works in search while if I insert it in the dashboard it doesn't work. I assign the option chosen in the filter to the month variable, then I verify the choice and, based on what has been chosen, I have the sum of the X_MESE_PREVIOUS columns or the chosen month returned. The options are "Solar Year", "Fiscal Year" and the months. Where am I wrong? Why it does not work ? Tks Antonio --------------------------------------------------------- | loadjob savedsearch="antonio:enterprise:20211025_PASSAGGIO_AGGREGATO_DATE" |where (sourcetype="fs_ampliamenti_ip" AND OFFERTA="DIRETTA" AND STATO="OK") OR (sourcetype= "fs_diretta" AND TIPOLOGIA="SUBNETIP" AND OFFERTA="DIRETTA" AND STATO="OK") |eval MESEATTUALE=strftime(relative_time(now(), "-0d@d"), "%m") |eval MESEATTUALE= 11 |eval mese="Anno Fiscale" (manual setting of the chosen filter) |eval ANNOFISCALE=if(MESEATTUALE -3 <= 0,MESEATTUALE-3+12,MESEATTUALE-3) |rename PROGRESSIVO_MESE as "0_MESE_PRECEDENTE" |eval SOLARE = mvappend($0_MESE_PRECEDENTE$,$1_MESE_PRECEDENTE$,$2_MESE_PRECEDENTE$,$3_MESE_PRECEDENTE$,$4_MESE_PRECEDENTE$,$5_MESE_PRECEDENTE$,$6_MESE_PRECEDENTE$,$7_MESE_PRECEDENTE$, $8_MESE_PRECEDENTE$,$9_MESE_PRECEDENTE$,$10_MESE_PRECEDENTE$,$11_MESE_PRECEDENTE$,$12_MESE_PRECEDENTE$) | eval FISCALE=0 | foreach *_MESE_PRECEDENTE [|eval FISCALE = if (<<MATCHSTR>> < ANNOFISCALE, FISCALE + '<<FIELD>>', FISCALE)] | eval CHI=case( mese="0_MESE_PRECEDENTE", $0_MESE_PRECEDENTE$ , mese="1_MESE_PRECEDENTE", $1_MESE_PRECEDENTE$ , mese="2_MESE_PRECEDENTE",$2_MESE_PRECEDENTE$ , mese="3_MESE_PRECEDENTE",$3_MESE_PRECEDENTE$ , mese="4_MESE_PRECEDENTE",$4_MESE_PRECEDENTE$ , mese="5_MESE_PRECEDENTE",$5_MESE_PRECEDENTE$ , mese="6_MESE_PRECEDENTE",$6_MESE_PRECEDENTE$ , mese="7_MESE_PRECEDENTE",$7_MESE_PRECEDENTE$ , mese="8_MESE_PRECEDENTE",$8_MESE_PRECEDENTE$ , mese="9_MESE_PRECEDENTE",$9_MESE_PRECEDENTE$ , mese="10_MESE_PRECEDENTE",$10_MESE_PRECEDENTE$ , mese="11_MESE_PRECEDENTE",$11_MESE_PRECEDENTE$ , mese="12_MESE_PRECEDENTE",$12_MESE_PRECEDENTE$ , mese="Anno Solare",$SOLARE$ , mese="Anno Fiscale",$FISCALE$ , 1=1, "INV") |eval RIS = case( mese = "Anno Fiscale", FISCALE, mese = "Anno Solare", SOLARE, 1=1, CHI) | stats sum(RIS) as RISULTATO |table RISULTATO ------------------------------------------------ <query>| loadjob savedsearch="antonio:enterprise:20211025_PASSAGGIO_AGGREGATO_DATE" |where (sourcetype="fs_ampliamenti_ip" AND OFFERTA="DIRETTA" AND STATO="OK") OR (sourcetype= "fs_diretta" AND TIPOLOGIA="SUBNETIP" AND OFFERTA="DIRETTA" AND STATO="OK") |eval MESEATTUALE=strftime(relative_time(now(), "-0d@d"), "%m") |eval mese="$previousmonth$" (this is the token, chosen filter) |eval ANNOFISCALE=if(MESEATTUALE -3 &lt;= 0,MESEATTUALE-3+12,MESEATTUALE-3) |rename PROGRESSIVO_MESE as "0_MESE_PRECEDENTE" |eval SOLARE = mvappend($$0_MESE_PRECEDENTE$$,$$1_MESE_PRECEDENTE$$,$$2_MESE_PRECEDENTE$$,$$3_MESE_PRECEDENTE$$,$$4_MESE_PRECEDENTE$$,$$5_MESE_PRECEDENTE$$,$$6_MESE_PRECEDENTE$$,$$7_MESE_PRECEDENTE$$, $$8_MESE_PRECEDENTE$$,$$9_MESE_PRECEDENTE$$,$$10_MESE_PRECEDENTE$$,$$11_MESE_PRECEDENTE$$,$$12_MESE_PRECEDENTE$$) | eval FISCALE=0 | foreach *_MESE_PRECEDENTE [|eval FISCALE = if (&lt;&lt;MATCHSTR&gt;&gt; &lt; ANNOFISCALE, FISCALE + '&lt;&lt;FIELD&gt;&gt;', FISCALE)] | eval CHI=case( mese="0_MESE_PRECEDENTE", $$0_MESE_PRECEDENTE$$ , mese="1_MESE_PRECEDENTE", $$1_MESE_PRECEDENTE$$ , mese="2_MESE_PRECEDENTE",$$2_MESE_PRECEDENTE$$ , mese="3_MESE_PRECEDENTE",$$3_MESE_PRECEDENTE$$ , mese="4_MESE_PRECEDENTE",$$4_MESE_PRECEDENTE$$ , mese="5_MESE_PRECEDENTE",$$5_MESE_PRECEDENTE$$ , mese="6_MESE_PRECEDENTE",$$6_MESE_PRECEDENTE$$ , mese="7_MESE_PRECEDENTE",$$7_MESE_PRECEDENTE$$ , mese="8_MESE_PRECEDENTE",$$8_MESE_PRECEDENTE$$ , mese="9_MESE_PRECEDENTE",$$9_MESE_PRECEDENTE$$ , mese="10_MESE_PRECEDENTE",$$10_MESE_PRECEDENTE$$ , mese="11_MESE_PRECEDENTE",$$11_MESE_PRECEDENTE$$ , mese="12_MESE_PRECEDENTE",$$12_MESE_PRECEDENTE$$ , mese="Anno Solare",$$SOLARE$$ , mese="Anno Fiscale",$$FISCALE$$ , 1=1, "INV") |eval RIS = case( mese = "Anno Fiscale", FISCALE, mese = "Anno Solare", SOLARE, 1=1, CHI) | stats sum(RIS) as RISULTATO |table RISULTATO</query> ... View more

Hi all, I have a problem that I cannot solve. I have data that is a result of a loadjob where the fields are named 0_PREVIOUS_MONTH, 1_PREVIOUS_MONTH, 2_PREVIOUS_MONTH, ..... 12_PREVIOUS_MONTH. I would like to add the values of the fields starting from 1/4 up to the current month .. Let me explain with an example: today we are in November, I need the sum of a line that starts from April 1st until today. So if I do the current month -4 + 1 = 8, I have to add: 4_PREVIOUS_MONTH + 5_PREVIOUS_MONTH + .... + 11_PREVIOUS_MONTH which is exactly 8 months. I thought of a foreach with this syntax: | foreach * _PREVIOUS_MONTH [eval TOTAL = TOTAL + if (* _ PREVIOUS_MONTH> = 4, <<FIELD>>, 0)] but it does not work. You can help me? I'm going crazy to find a solution 🙂 Tks Bye Antonio ... View more