I have few Dashboards in splunk I want to play them on TV. Expectation is dashboard 1 will be shown then after 1 sec gap dashboard 2 will appear on screen then again pause for few seconds and dashboard 3 will come.   if not possible through splunk then how can I achieve this?   ... View more

I am getting result like this.   query: index="webmethods_prd" host="USPGH-WMA2AISP*" source="/apps/WebMethods/IntegrationServer/instances/default/logs/SmartIST.log" |stats count by SmartISTINTERFACE instead of above I want a report like this:     ... View more

this is the log data   i want a report like this:     my current query is : index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" |eval timestamp=strftime(_time, "%F") | stats values(B2BUnknownTrxCount) by timestamp it giving report like this: I need to add date time in hh:mm in a chart.  Please help to update my query ... View more

this is my splunk query:   this is output: how can I freeze this 1st column where interface names are showing. problem is when dragging to right then can not see the interface name below is source code:   ... View more

i have log like this : 2024-02-22 12:49:38:344 EST| INFO |InterfaceName=USCUSTOMERINV INVCanonicalProcess Sender_ID=ThermoFisher Scientific Receiver_ID =Marshall University-Unimarket TxnType=Invoice TotalAmount=-1916.83 Status=Success 2024-02-22 11:51:12:992 EST| INFO |InterfaceName=USCUSTOMERINV INVCanonicalProcess Sender_ID=ThermoFisher Scientific Receiver_ID =Mammoth Bio via Coupa TxnType=Invoice TotalAmount=4190.67 Status=Success below query giving monthly total index="webmethods_qa" source="/apps/webmethods/integrationserver/instances/default/logs/USCustomerEDI.log" Status=success OR STATUS=Success OR Status=Failure USCUSTOMERINV | timechart sum(TotalAmount) span=1mon   but I need for each Receiver_ID how much invoice total for 1 months span like this :   how to do that? ... View more

I am using Splunk Enterprise Version: 9.1.0.1. my search query is : index="webmethods_prd" source="/apps/webmethods/integrationserver/instances/default/logs/USCustomerEDI.log" InterfaceName=USCUSTOMERPO Status=Success OR Status=Failure | eval timestamp=strftime(_time, "%F")|chart limit=30 dc(TxID) over Sender_ID by timestamp in result I am getting incomplete Sender_ID, splunk removed space from Sender_ID but actually it should be full name , like this : How can I preserve the full Sender_ID here?   Avik ... View more

how should I merge this 2 query into 1: query 1) index="XXXX" source="XXXX"|search "SupplierRTI_AlphaAesar" |stats count AS "Total",count(eval(STATUS=="fail")) AS Failure|eval Faliurerate=(Failure/Total)*100|eval SuccessRate=100-Faliurerate|table Total,SuccessRate query 2) index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/SupplierRTI.log"|search "SupplierRTI_AlphaAesar" | timechart span=1w count I want a report like this how should I form the query?     ... View more

this query showing date &time haphazardly, how to sort it like 1/4/2024, 1/3/2024, 1/2/2024.... index="*" source="*" |eval timestamp=strftime(_time, "%m/%d/%Y") | chart limit=30 count as count over DFOINTERFACE by timestamp     ... View more