Hi, I got a splunk search that monitors, how many different hosts there were in the chosen timespan.  | stats dc(host) as hostcount Now I would like to generate a pie chart, that compares succesful hosts with the unseccesful ones. Therefore I got a field "errors". All hosts with error > 50 should be counted as unseccesful. The others should be counted as succesful. The pie chart should show the succesful/unsuccesful ratio.  ... View more

Hi, is there a possibility to create a chart by these two fields? If possible I would like to create a heatmap out of this chart. | eval error= if(count>50, 1, 0) | chart sum(error) by cpwd_nr | chart sum(error) by host   ... View more

Hi, I got a timechart that shows the number of critical package losses per day. Additionally I calculate the average of critical package losses within the chosen timespan and show it as a straight line in the timechart. Now I would like to add a line, that tells me, how many different hosts were used on every single day. (E.g Monday 36, Tuesday 64, Wednesday 55, ...) Thats the code that calculates the number of critical package losses per day and the average within the chosen timespan. | eval Amount= numberLostPackages | timechart span=24h count(Amount) as Count sum(Amount) as Total aligntime=@d | eventstats sum(Count) as TotalCount | addinfo | eval Duration=(info_max_time-info_min_time)/86400 | eval Average=TotalCount/Duration   ... View more

Hi, My events contain a field  named "fruit" that distinguishes, what kind of fruit the event is about. I would like to sum up, how many different fruits have been in the events of the last 15 minutes. Imagine those are the field values of 5 different events:   1. Banana, 2. Apple, 3.Banana, 4. Banana, 5. Strawberry   My aim is now to display the Number "3 " in a Panel, because the events contained 3 different kinds of fruits. Can anybody help me, how I could do that? ... View more

Hi, can somebody explain, why I dont get any results? index=... | eval Timestamp=strftime(_time,"%d-%m-%Y %H:%M:%S") | eval CurrentTime=strftime(now(),"%d-%m-%Y %H:%M:%S") | eval NotUsedFor=(CurrentTime-Timestamp) | chart max(NotUsedFor) by host I want a chart that shows the difference of the CurrentTime and the Timestamp   ... View more

Hi, I would like to filter a dashboard by using a Dropdown Input at the top of my dashboard. By selecting one of the dropdown values (Total, Data A, Data B) the charts and tables should only show values of the chosen dataset. Data A and Data B can be distinguished by field12, that consists of numbers. For Data A field12 always starts with 1 or 2. For  Data B field12 always starts with a 7. For Total it doesnt matter, because total should contain all data. Can somebody tell me what I need to add to the Search of my tables and charts and what I need to do with the tokens? ... View more

Hi,  I am pretty new to splunk and need help with a timechart. I have a timechart, that shows the count of packagelosses >50 per day. Now I want to add an average line to the chart, that matches to the chosen space of time.     index= ... |eval Amount=lost_packages |where 2500 > Amount and Amount > 50 |timechart span=24h count(Amount) aligntime=@d     Can somebody tell me how i can calculate the average of Amount in the chosen space of time and how I can add the average to the timechart?   ... View more