Hi All,  My Dashboard panel which calls a report search is showing "Search did not return any events." When i click on the magnifying glass icon and run the search manually, it displays the results without any issues.  Please advise what could be wrong in the XML form.  I am ensuring to use <form> </form>      <form version="1.1"> <label>SLA Metrics</label> <fieldset autoRun="true" submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <event> <title>MTTA - Mean Time to Acknowledge</title> <search ref="MHE - Mean Time to Acknowledge"> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="list.drilldown">none</option> </event> </panel> </row> </form>         I have referenced https://community.splunk.com/t5/Splunk-Search/Using-time-range-picker-does-not-work-in-dashboard-where-report/m-p/148254 and as far as i can tell,  my xml code is in line with what is the solution in the post.  Please assist. ... View more

Hi All, Need some guidance for calculating SLA  Achieved percentage column.  This is how my results look like after running base search Severity Count_of_Alerts Mean_Time_To_Close SLA Target SLA Achieved  in % S1 10 7 mins 8 secs  15 mins   S2 5 6 mins 25 secs 45 min   I have referenced solution provided by @ITWhisperer in https://community.splunk.com/t5/Splunk-Search/adding-percentage-of-SLA-breach/m-p/572942#M199687  but in my case we also have count column.   We are ok with considering only the minutes portion of the Time_to_Close and ignoring the secs if too complicated. How can i calculate my SLA achieved in % . Is it as simple as doing a  | eval SLA_Achieved = (Mean_Time_to_close*SLA_Target)/100 One further optimization would if the SLA % achieved is less than the Target, then perhaps color that cell green else Red in color (something on that lines). ... View more

Hi All, I have a very simple use case and that is to display the time difference between 2 fields that already have their values as time in epoch format.   But when i use ctime to display the difference, it shows weird results.  As shown below my events contains 2 fields ( tt0 & tt1). Their values are  timestamp in EPOCH. If we manually  convert these to Human Readable Time , the difference between the tt0 and tt1 is just 03 mins and xx seconds.   tto tt1 1675061542  1675061732 But when i do a      | eval ttc=tt1-tt0 | convert ctime(ttc)     Splunk displays ttc as follows:   12/31/1969 18:56:49.2304990  What am i doing wrong here?  How to make it display ttc correctly ? ... View more

Hi All,  When using stats  to display values() of  fields , how can we have the values to align between the field names ?  For example My Data set Severity Status Count P1 New 1 P1 Open 2 P1 Unassigned 3 P1 Closed 5 When using | stats values(status) as status, values(Count) as Count by severity this is what i get.  Notice the count values are not as per dataset. Severity Status Count P1 New Open Unassigned Closed 1 5 3 2 i did like the results of Count to align as per their Status field. Expected Result Severity Status Count P1 New Open Unassigned Closed 1 2 3 5 ... View more

Hello, When analyzing web traffic logs, at times the url field does not have a http_referrer field.  We are interested in finding out which URL did the original request came from ?  There is looping involved.  THis is similar to the post:  https://community.splunk.com/t5/Getting-Data-In/Loop-through-URL-and-http-referrer-to-find-original-request/m-p/138817#M28507 In the above post, user makes use of a script which I cannot use in my environment.  How to then use the MAP command or any other command to recursively/loop thru the URL field and find out which was the original domain ? For example: index=firewall url =malicious-domain.com Actual flow of traffic: abc.com  >>> bcd.com  >>  No Http_Referrer field  >> malicious-domain.com  ( http_referrer is <empty>)  Expected result: abc.com ... View more