Yes, it is possible.  Start with the REST command that provides all dashboard data then filter for those that contain the desired field.  Something like this should get you started: | rest /servicesNS/-/-/data/ui/views splunk_server=local | search data="*sec_field*" | table title eai:acl.app author data ... View more

The Monitoring Console should have something close.  Look at Resource Usage: Instance.  If it doesn't fill the need exactly then copy it from $SPLUNK_HOME/etc/apps/splunk_monitoring_console/default/data/ui/views/resource_usage_instance.xml (using the CLI) and modify it to suit. ... View more

The query i gave above bring the result which is check for last 30 days of data ... View more

| rex mode=sed "s/\s/\n/g" ... View more

You asked a very similar question (which I answered) here - the main difference being not adding the colour value to the first date column. As I hinted at in the other post, it might be easier to solve from the original query used to generate the table. Are you able to share this? Did you try the technique shown in the other post? ... View more

index=_internal | head 1 | fields _raw | eval _raw="{\"logs_id\": \"4890d36f-5ee3-11eb-b3a5-852911ef9cd4\", \"securityContext\": { \"alternateId\": \"****@gmail.com\", \"id\": \"ramxghl092\", \"displayName\": \"****System\"}," | rex mode=sed "s/((alternateId|displayName)\":\s*)\".*?\"/\1\"*****\"/g" ... View more

Hi, I am not sure how this will help you. But you can try with the below syntax which will assign all of your lookup values to a single field. eval newfield = fieldname1 + fieldname2 + fieldname3 + fieldname4 + fieldname5 ... View more

I think part of the problem is the regex is looking for 3 digits followed by a hyphen and there's only one instance of that in the sample data so only one substitution. Try a different regex that matches the entire string (assuming all events follow the same pattern): | rex mode=sed "s/(\"login\"\:\s+\")\w{5}(\d\d\d)-\d{9}(\w+)/\1xxxxx\2-xxxxxxxxx\3/" ... View more

Thanks Renjith_Nair, But i am getting the results like below, Rows Mar20 Apr20 Apr20-Mar20 Mar20-Rows Feb20-col1 Row1 0 8 3 decreased Increased Row2 9 9 7 decreased Nothing Changed Row3 8 1 7 Increased decreased   ... View more