Hi @splunksumman  - I’m a Community Moderator in the Splunk Community.  This question was posted 1 year ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you! ... View more

Hi ITWhisperer, thanks for the solution !! It works perfectly. Thank you so much ... View more

Hi IT Whisperer, you are the best !!! Great was just what I needed and I couldn't do. Thank you so much for your great help. ... View more

Yes I tried with fillnull but despite the zero values, the field names are wrong. Maybe I solved it by editing the | command stats sum Thank you ... View more

I had tried something like this but without mvappend .... 🙂 Tks for your solution so it works great !!! ... View more

I think I have solved 🙂 In the Static Options the Fiscal Year and Solar Year values have FY and Y respectively. In the query instead I set month = "Fiscal Year" instead of "FY" and so also in the Solar year. Now it returns me the correct values Thanks anyway to ITWhisperer for your interest ... View more

I had initialized TOTAL but a few lines higher. While now it works. I also inserted these lines:      | eval CURRENT MONTH = strftime (relative_time (now (), "-0d @ d"), "% m")      | eval YEARLY = CURRENT MONTH + 1-4 and changed the foreach: | foreach * _PREVIOUS_MONTH [| eval TOTAL = if (<<MATCHSTR>> <ANNOFISCALE, TOTAL + '<<FIELD>>', TOTAL)] You are a Great !!! Thank you so much ... View more

IT Whisperer, you are great !!!! Thank you so much, in 2 minutes you solved a problem that I had not been able to overcome for days. You're great !!! Tks   ... View more

I believe that after the stats command the CST variable no longer exists ... View more

Hi @antonio147, yes, you can have an in-page drilldown: it depends on the data to display: if the data to display from differtent buttons are more or less the same you can do it. In my app I had very different informations for each kind of system, so I had to create a dashboard for each kind of system, but it was easy because in any way I had to create a dashboard for each kind of system. Ciao. Giuseppe ... View more

Removing it and inserting it into the map worked Tks ... View more

Great !!! it was enough just to put the space between: and NULL 🙂 🙂 🙂 I never would have thought that 🙂 Tks You are the best !!!! Bye Antonio ... View more

Hi, the solutions are equally valid. I mixed the two using the map and eval ifnotnull to get what I wanted. My indications have not been very precise, so I believe that both are still satisfactory. Thanks everyone for the help and the solution. ... View more

    <input type="dropdown" token="field1"> <label>Mese</label> <fieldForLabel>A_data</fieldForLabel> <fieldForValue>AMBITO</fieldForValue> <search> <query>index=idx sourcetype=source |search ZONA ="Totale" |eval anno=mvindex(split(AMBITO,"-"),1) |eval mese=mvindex(split(AMBITO,"-"),0) | eval mesi=case( mese="Gennaio","01", mese="Febbraio","02", mese="Marzo","03", mese="Aprile","04", mese="Maggio","05", mese="Giugno","06", mese="Luglio","07", mese="Agosto","08", mese="Settembre","09", mese="Ottobre","10", mese="Novembre","11", mese="Dicembre","12", 1=1, "INV") |eval OrdineAmbito = anno.mesi |sort - OrdineAmbito |eval A_data= mese."-".anno | append [| makeresults | eval A_data="MESE_PRECEDENTE"] | streamstats count as row | eventstats values(eval(if(row=2,AMBITO,null))) as second | eval AMBIIO=if(A_data="MESE_PRECEDENTE",second." ",AMBITO) | table AMBITO A_data second</query> <done> <set token="default">$result.second$</set> </done> <earliest>@d</earliest> <latest>now</latest> </search> <default>$default$</default> </input>     When the field1 token is used, it should be trimmed due to the extra space added to avoid duplication of values. ... View more

Ah OK, thanks for the explanation 🙂 But if two strings are concatenated, I expected search to work the same. I expected search to work with string1.string2 I understand better the dynamics of splunk and how it works. Thank you again. ... View more

Hi Rich, now it's clear !!! Eval generates a new field with the elements 0 and 1 depending on the true or false condition. The SUM after, sums all the elements of the created field. I had confused "sum" in the variable name, The -3mon @ mon in my query took dates from 2020-08-18, for this I had to add: | eval threemonthsago = strftime (relative_time (oldest, "@mon"), "% Y-% m-% d") But now a strange thing happens to me (surely I'm wrong :)) if I put -9mon @ mon it takes into account the dates of February (ok, correct) but it goes until August and not until November as I expected. IMPORTANT: at the top right I chose "latest 3 months. If instead I write -3mon @ mon always with latest 3 months, it returns me from August to November Why?? Does the latest 3 m3si have anything to do with it? This behavior is not clear to me. Anyway, I don't want to address all my doubts in this post, otherwise I will have to pay you for the lessons you are providing 🙂 I like to understand why things, but I certainly don't want to take advantage of your kindness and patience. I still have to study a lot ....... You have already helped me a lot in understanding and making my query work. I thank you for this See you soon Antonio ... View more

yes and just that Thank you so much ... View more