I am not sure it is possible with Dashboard Studio (which I assume you are using since you mentioned JSON). With Classic / SimpleXML dashboards, you can use a change handler on the dropdown to set additional tokens based on the choice made. ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

The green lines make for a good regular expression, once special characters are escaped and wildcards applied. \<ORDER CANCEL="." ORDER_NAME="[^"]+" TYPE="[12]">|Creating order cancellation transaction for order [^,]+,|JSON received for product import: {"records":\[{"lgnum":"407","entitled":"[^"]+","owner":"[^"]+","product":"[^"]+" There are two ways to filter events.  The first uses a transform to find events that match a regex and send them either to an index or to nullQueue (equivalent to /dev/null).  Add the following stanzas to transforms.conf: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = \<ORDER CANCEL="." ORDER_NAME="[^"]+" TYPE="[12]">|Creating order cancellation transaction for order [^,]+,|JSON received for product import: {"records":\[{"lgnum":"407","entitled":"[^"]+","owner":"[^"]+","product":"[^"]+" DEST_KEY = queue FORMAT = indexQueue Then reference them in props.conf: [mysourcetype] TRANSFORMS-set= setnull,setparsing See https://docs.splunk.com/Documentation/Splunk/9.1.0/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest for the docs. The other method uses the newer INGEST_EVAL feature, also in transforms.conf. INGEST_EVAL = queue=if(match(_raw, "\<ORDER CANCEL=\".\" ORDER_NAME=\"[^\"]+\" TYPE=\"[12]\">|Creating order cancellation transaction for order [^,]+,|JSON received for product import: {\"records\":\[{\"lgnum\":\"407\",\"entitled\":\"[^\"]+\",\"owner\":\"[^\"]+\",\"product\":\"[^\"]+\""), "nullQueue", "indexQueue") See https://docs.splunk.com/Documentation/ITSI/4.17.0/Configure/transforms.conf for more. ... View more

I'm not sure these people would appreciate you posting their details (name/email) on the internet. Next time please anonymize the screenshot. I did remove your screenshot. And the question was because it could have been interpreted twofold. Either: - you wanted a list of each 24-hour period during which the count was more than 5 or - you wanted a list of those people for which there was a count over 5 for every 24-hour long period. These are two different requirements. Anyway, your search will be easiest done with | bin _time span=1d in the middle (before stats) and adding _time as another field in the BY clause. So instead of | stats count by Name Email Country Department BusinessUnit EmployeeType you do | bin _time span=1d | stats count by Name Email Country Department BusinessUnit EmployeeType _time  And of course you run the search over your whole 30 days back. Depending on which of the options I mentioned at the beginning you want, you might do with either your "where" command or you'd have to do some additional magic to find only those which have more than 5 over the whole month. ... View more

Hi When you are attaching SPL code or other configurations, please use </> token from edit options! That way it's much easier to read and we can sure that that it what you have paste! You should also use Ctrl/Cmd+F to get it formatted. See above. Unfortunately you lost colors when you use code block 😞   index=lsc_db2_qa_index sourcetype=lsc_db2_ewm_qa_outbound | dedup EDIDCDOCNUM | rex field=_raw "(?<dateTime>[\d\-\s:]+).\d{3}, TIME.*" | rename EDIDCDOCNUM as ewmIdoc EDIDCSTATUS as ewmIdocStatus MESTYP as ewmmesType dateTime as ewmCreateTime | table ewmIdoc ewmIdocStatus ewmmesType ewmCreateTime | join type=outer ewmIdoc [ search index=webmethods_qa5555_index sourcetype=transactions_qa5555_src | search sender="AMAT_SAP_EWM" AND receiver="EXACTA" | rex field=_raw "(?<wmDateTime>[\d\-:\s]+) .*" | rex field=messageId "(?<docNum>\d+)\|\|(?<whoNum>.*)" | rex field=messageId "(?<docNum>\d+)" | eval wmcreateDateTime= if( like( message, "%request from EWM%" ), wmDateTime,"") | eval wmconfirmDateTime=if( like( message, "%request sent to Exacta successfully%" ), wmDateTime,"") | eval wmsentDateTime=if( like( message, "%ready to send to Exacta%" ), wmDateTime,"") | lookup wminterface_mapping.csv wmInterface as interface OUTPUT Interface | stats values(Interface) as Interface values(whoNum) as whoNum values(wmcreateDateTime) AS wmcreateDateTime values(wmconfirmDateTime) AS wmconfirmDateTime values(wmsentDateTime) AS wmsentDateTime by docNum | rename docNum as ewmIdoc] | eval ewmIdoc=ltrim(tostring(ewmIdoc),"0") | fields ewmIdoc ewmIdocStatus ewmmesType ewmCreateTime whoNum,Interface,wmcreateDateTime,wmconfirmDateTime,wmsentDateTime | join type=outer whoNum [ search index=lsc_exacta_qa_index source="D:\\ProgramData\\Bastian Software\\Logs\\ExactaImportAdapter\\ExactaImportAdapter*" | rex field=_raw ".* ORDER_NAME=\"(?<imaWho>[\d-]+)\" .*" | rex field=_raw ".*JSON received for product import:.*\"product\":\"(?<imaWho>[\d-]+)\",.*" | rex field=_raw ".*JSON received for putaway import:.*\"who\":\"(?<imaWho>[\d-]+)\",.*" | eval exactaRecTime = strftime(_time,"%Y-%m-%d %H:%M:%S") | dedup imaWho sortby +exactaRecTime | eval exactaInfStatus = if(exactaRecTime != "","Success",NA) | table imaWho exactaRecTime exactaInfStatus | join type=outer imaWho [ search index=lsc_exacta_qa_index source="D:\\ProgramData\\Bastian Software\\Logs\\ExactaImport\\ExactaImport.txt" | rex field=_raw ".* Order \[(?<imWho>[\d-]+) - .*\] successfully assigned.*" | rex field=_raw "\.* Bastian\.Exacta\.Interface\.Processes\.ExactaProductTranslatorBase - Validation of Message Successfull, Prepare to Insert\n.*ROWS ONLY;\@p0 = \'(?<imWho>[\d-]+)\'.*\[.*" | rex field=_raw ".*\/line id \[(?<imWho>[\d-]+) -.* was cancelled successfully.\n.*" | rex field=_raw ".*\[Import Pick Orders\].*ROWS ONLY;@p0 = \'(?<imWho>[\d-]+)\' \[[\S\s]*- Messages processed successfully.*" | eval exactaDocTime = strftime(_time, "%Y-%m-%d %H:%M:%S") | search imWho !="" | eval exactaDocStatus = if(exactaDocTime != "","Created",NA) | table imWho exactaDocTime exactaDocStatus | rename imWho as imaWho] | table imaWho exactaRecTime exactaDocTime exactaInfStatus exactaDocStatus | rename imaWho as whoNum] | search Interface = "*" | rename whoNum as "WHO/PRODUCT" | table ewmIdoc ewmIdocStatus ewmmesType ewmCreateTime "WHO/PRODUCT",Interface,wmcreateDateTime, wmsentDateTime, wmconfirmDateTime, exactaRecTime exactaDocTime exactaInfStatus exactaDocStatus    If I look that correctly you have wrong field name (imaWho) on you red block. On join you mast have same column on join (whoNum) and sub search! Probably you will have the same situation on the next join after you have fixed this first issue! Anyhow join is not a preferred method to join events on Splunk. You should read the next articles and conf presentation to do better / more powerful joins. https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-join-and-the/m-p/391288/thread-id/113948 https://conf.splunk.com/files/2020/slides/TRU1761C.pdf (several versions) r. Ismo ... View more

Hi @Abhineet, good for you, see next time! let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @Abhineet, please try this: index=webmethods_dev5555_index 0000000001515185 | rex field=_raw "(?<wmDateTime>[\d\-:\s]+) .*" | rex field=messageId "(?<docNum>\d+)\|\|(?<whoNum>.*)" | eval wmcreateDateTime= if( like( message, "%request from EWM%" ), wmDateTime,"") | eval wmconfirmDateTime=if( like( message, "%request sent to Exacta successfully%" ), wmDateTime,"") | eval wmsentDateTime=if( like( message, "%ready to send to Exacta%" ), wmDateTime,"") | lookup wminterface_mapping.csv wmInterface as interface OUTPUT Interface | stats values(wmcreateDateTime) AS wmcreateDateTime values(wmconfirmDateTime) AS wmconfirmDateTime values(wmsentDateTime) AS wmsentDateTime BY whoNum nterface Ciao. Giuseppe ... View more

Hi @Abhineet , as @inventsekar said, it isn't possible to insert a regex in an if statement, the only approach is the one I described, or the solution from @inventsekar . Ciao. Giuseppe ... View more

@ITWhisperer makes an acute observation! The data is not formatted for machine consumption no matter which language you use. (Kind of intuitive for humans, I admit.) So, we'll give it some transformation if you cannot persuade the developer to change. (Or if this is from an outside vendor.)     | rex "detailedSwitchData *(?<detailedSwitchData>{.*})" | rex field=detailedSwitchData mode=sed "s/'/\"/g" | spath input=detailedSwitchData | rename *.* AS *_* | foreach cnxiandcm1_* [eval interface = mvappend(interface, "<<MATCHSTR>>" . "::" . '<<FIELD>>')] | mvexpand interface | eval interface = split(interface, "::") | eval status = mvindex(interface, 1), interface = mvindex(interface, 0)       With your sample data, I get interface status Ethernet1 MAC ACL Enabled Ethernet10 Dot1x Enabled Ethernet100/1 Uplink Port Ethernet101/1 Uplink Port Ethernet11 Dot1x Enabled Ethernet12 Dot1x Enabled Ethernet13 Dot1x Enabled Ethernet14 Dot1x Enabled Ethernet15 Dot1x Enabled Ethernet16 Dot1x Enabled Ethernet17 Dot1x Enabled Ethernet18 Dot1x Enabled Ethernet19 Dot1x Enabled Ethernet2 MAC ACL Enabled Ethernet20 Dot1x Enabled Ethernet21 Dot1x Enabled Ethernet22 Dot1x Enabled Ethernet23 Dot1x Enabled Ethernet24 Dot1x Enabled Ethernet25 Dot1x Enabled Ethernet26 Dot1x Enabled Ethernet27 Dot1x Enabled Ethernet28 Dot1x Enabled Ethernet29 Dot1x Enabled Ethernet3 MAC ACL Enabled Ethernet30 Dot1x Enabled Ethernet53 Dot1x Enabled Ethernet54 Dot1x Enabled Ethernet55 Dot1x Enabled Ethernet82 Dot1x Enabled Ethernet83 Dot1x Enabled Ethernet84 Dot1x Enabled Ethernet85 Dot1x Enabled Ethernet86 Dot1x Enabled Ethernet87 Dot1x Enabled Ethernet93 Dot1x Enabled Ethernet94 MAC ACL Enabled Ethernet95 MAC ACL Enabled Ethernet96 Dot1x Enabled Ethernet97/1 Uplink Port Ethernet98/1 Uplink Port Ethernet99/1 Uplink Port Management1 Uplink Port Here's an emulation that you can play with and compare with real data       | makeresults | eval _raw = "<158>May 09 04:33:46 detailedSwitchData {'cnxiandcm1': {'Ethernet1': 'MAC ACL Enabled', 'Ethernet2': 'MAC ACL Enabled', 'Ethernet3': 'MAC ACL Enabled', 'Ethernet4': 'MAC ACL Enabled', 'Ethernet5': 'Dot1x Enabled', 'Ethernet6': 'Dot1x Enabled', 'Ethernet7': 'Dot1x Enabled', 'Ethernet8': 'Dot1x Enabled', 'Ethernet9': 'Dot1x Enabled', 'Ethernet10': 'Dot1x Enabled', 'Ethernet11': 'Dot1x Enabled', 'Ethernet12': 'Dot1x Enabled', 'Ethernet13': 'Dot1x Enabled', 'Ethernet14': 'Dot1x Enabled', 'Ethernet15': 'Dot1x Enabled', 'Ethernet16': 'Dot1x Enabled', 'Ethernet17': 'Dot1x Enabled', 'Ethernet18': 'Dot1x Enabled', 'Ethernet19': 'Dot1x Enabled', 'Ethernet20': 'Dot1x Enabled', 'Ethernet21': 'Dot1x Enabled', 'Ethernet22': 'Dot1x Enabled', 'Ethernet23': 'Dot1x Enabled', 'Ethernet24': 'Dot1x Enabled', 'Ethernet25': 'Dot1x Enabled', 'Ethernet26': 'Dot1x Enabled', 'Ethernet27': 'Dot1x Enabled', 'Ethernet28': 'Dot1x Enabled', 'Ethernet29': 'Dot1x Enabled', 'Ethernet30': 'Dot1x Enabled', 'Ethernet31': 'Dot1x Enabled', 'Ethernet32': 'Dot1x Enabled', 'Ethernet33': 'Dot1x Enabled', 'Ethernet34': 'Dot1x Enabled', 'Ethernet35': 'Dot1x Enabled', 'Ethernet36': 'Dot1x Enabled', 'Ethernet37': 'Dot1x Enabled', 'Ethernet38': 'Dot1x Enabled', 'Ethernet39': 'Dot1x Enabled', 'Ethernet40': 'Dot1x Enabled', 'Ethernet41': 'Dot1x Enabled', 'Ethernet42': 'Dot1x Enabled', 'Ethernet43': 'Dot1x Enabled', 'Ethernet44': 'Dot1x Enabled', 'Ethernet45': 'Dot1x Enabled', 'Ethernet46': 'Dot1x Enabled', 'Ethernet47': 'Dot1x Enabled', 'Ethernet48': 'Dot1x Enabled', 'Ethernet49': 'Dot1x Enabled', 'Ethernet50': 'Dot1x Enabled', 'Ethernet51': 'Dot1x Enabled', 'Ethernet52': 'Dot1x Enabled', 'Ethernet53': 'Dot1x Enabled', 'Ethernet54': 'Dot1x Enabled', 'Ethernet55': 'Dot1x Enabled', 'Ethernet56': 'Dot1x Enabled', 'Ethernet57': 'Dot1x Enabled', 'Ethernet58': 'Dot1x Enabled', 'Ethernet59': 'Dot1x Enabled', 'Ethernet60': 'Dot1x Enabled', 'Ethernet61': 'Dot1x Enabled', 'Ethernet62': 'Dot1x Enabled', 'Ethernet63': 'Dot1x Enabled', 'Ethernet64': 'Dot1x Enabled', 'Ethernet65': 'Dot1x Enabled', 'Ethernet66': 'Dot1x Enabled', 'Ethernet67': 'Dot1x Enabled', 'Ethernet68': 'Dot1x Enabled', 'Ethernet69': 'Dot1x Enabled', 'Ethernet70': 'Dot1x Enabled', 'Ethernet71': 'Dot1x Enabled', 'Ethernet72': 'Dot1x Enabled', 'Ethernet73': 'Dot1x Enabled', 'Ethernet74': 'Dot1x Enabled', 'Ethernet75': 'Dot1x Enabled', 'Ethernet76': 'Dot1x Enabled', 'Ethernet77': 'Dot1x Enabled', 'Ethernet78': 'Dot1x Enabled', 'Ethernet79': 'Dot1x Enabled', 'Ethernet80': 'Dot1x Enabled', 'Ethernet81': 'Dot1x Enabled', 'Ethernet82': 'Dot1x Enabled', 'Ethernet83': 'Dot1x Enabled', 'Ethernet84': 'Dot1x Enabled', 'Ethernet85': 'Dot1x Enabled', 'Ethernet86': 'Dot1x Enabled', 'Ethernet87': 'Dot1x Enabled', 'Ethernet88': 'Dot1x Enabled', 'Ethernet89': 'MAC ACL Enabled', 'Ethernet90': 'MAC ACL Enabled', 'Ethernet91': 'MAC ACL Enabled', 'Ethernet92': 'Dot1x Enabled', 'Ethernet93': 'Dot1x Enabled', 'Ethernet94': 'MAC ACL Enabled', 'Ethernet95': 'MAC ACL Enabled', 'Ethernet96': 'Dot1x Enabled', 'Ethernet97/1': 'Uplink Port', 'Ethernet98/1': 'Uplink Port', 'Ethernet99/1': 'Uplink Port', 'Ethernet100/1': 'Uplink Port', 'Ethernet101/1': 'Uplink Port', 'Management1': 'Uplink Port'}}"         ... View more

| eval duration=now()-strptime(eventdateTime,"%F %T,%3N") | fieldformat duration=tostring(duration ,"duration") ... View more

Thanks.... It's working as expected. ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

is there any way to changes in xml source file and can show text field value as current IST and PST   date time? ... View more

Thanks for help... ... View more

Hi Kamlesh! It's working for me after making few changes. Thanks for your help. definitely will upvote you ... View more

Hi @Abhineet, please use OUTPUTNEW instead OUTPUT <your_search> | lookup workdayData.csv employeeNumber AS machineUserName OUTPUTNEW <lookup_columns> | lookup workdayData.csv Email-ID AS machineUserName OUTPUTNEW <lookup_columns> | ... Ciao. Giuseppe ... View more

Hi @gcusello  That's correct, how we can format the value of "Duration" field in "HH:MM:SS" format? ... View more

The _time field is stored as a unix timestamp (number of seconds since so-called "epoch") and is rendered in webui according to the timezone defined in user's preferences. There is no way to set another timezone within a search. If you want to parse another field from the event (which is most likely represented in some string form), you should use strptime() to convert from that string to timestamp and then use fieldformat (preferably) or eval with strftime to convert this timestamp to a string. And again - splunk always shows the timestamp in user's timezone but can parse and interpret a timezone if it's included in the date string. Otherwise it parses the datetime string as if it was in local time. For example - if I'm located in CEST, the string "5.04.2022 18:57:00", if I call strptime with proper format string will get interpreted as 18:57 CEST. But if the string says "5.04.2022 18:57:00PDT" and I tell splunk to use the timezone definition, it will get parsed as PDT time even though my local timezone is CEST. But if I call strftime on both timestamps, they will be both rendered in CEST, regardless of what timezone the initial string contained. ... View more

it's get resolved.. find solution.  lookup F5_IPS_Exclusion.csv F5_Exclusion_IPS AS ip_client OUTPUT F5_Exclusion_IPS| where isnull(F5_Exclusion_IPS) | table ip_client it gives all "ip_client" not present in lookup file "F5_IPS_Exclusion.csv"   ... View more

Thanks for solution.. will try and check whether it works or not. ... View more

yes we have to hardcode that. AUSTDPVPN1 and AUSTDPVPN2 is one cluster AUSTMPVPN1 and AUSTMPVPN2 is another cluster AUSTPPVPN1 and AUSTPPVPN2 is another cluster ... View more

Make current users a multi-value field with the second value evaluated to the colour you want (dependent on the conditions you mentioned). Then format the field colour based on the colour, and add CSS to hide the second multi-value in the current users column. See my solution to this post https://community.splunk.com/t5/Splunk-Search/How-to-color-the-columns-based-on-previous-column-value/m-p/538849#M152374  ... View more