Hi, I have an filter for selecting the country values, provided this as a drop down. we have options like singapore,malaysia,china,vietnam and also have an option of ALL. Based on the above selection I have an panel that shows the success / failure counts graphs will appear. The issue I am facing is I am getting the values like(Null,Value,Other,18,38) in countryCode column if I run the dashboard. But I don't see any event with the countryCode parameter having this values. So, can you help on fixing this issue?? Thanks, Sahana    ... View more

Hi, I have a parent panel which has below table panel Function Name Success Failure SLA greet 34 5 13.5 NGA 43 0 67.5 Customer 54 1 45 this has two drilldown panel the 1st drilldown panel should appear if we click the column value failure. the 2nd drilldown panel should appear if we click the column value SLA. Thanks in advance,   ... View more

Hi  I have a requirement like on like on the certain appName in below table the drilldown panel should show some message like "as it is lite application it is not applicable" instead of "No results" lite apps are: FGS,CMS,abd Onclick of success/failure count for the lite app the drilldown panel should show the above message appName success failure abd 1 12 profile 5 13 FGS 7 14 DSM 9 15 CMS 3 12   Thanks in advance ... View more

Hi  I have a panel with query below index=int_166167 env = SIT appName="GCR" message="Post Login*"| bucket _time span= 15m| stats count(userId) as loginUsers ,min(timeTaken) as minSLA,max(timeTaken) as maxSLAcount by _time | sort -_time|table  _time,loginUsers,minSLA,maxSLA the panel appears as like below time loginUsers minSLA maxSLA 28-02-2022 11:00 45 12 67 28-02-2022 11:15 60 13 74 28-02-2022 11:30 35 25 82 28-02-2022 11:45 46 34 45 28-02-2022 11:00 70 57 90 28-02-2022 12:00 35 24 57 My requirement is like on click of the maxSLA value (for ex:90) it should link to search which shows the result of particular one max SLA event with 90 from those 70 users Kindly help on this.    ... View more

Hi, i have an requirement as like below. TimeStamp LoginUsers Avg SLA Min SLA  Max SLA 20-02-2022 11:30 35 1 1 3.4 20-02-2022 11:45 40 1.3 1 5.3 20-02-2022 12:00 32 2.4 1 7.6 20-02-2022 12:15 53 1.2 1 4.2 20-02-2022 12:30 44 2.3 1 3.5   I have an above dashboard panel which was showing up on 15minutes span. Onclick of max SLA we are suppose to get the particular splunk log event in new tab. may  i know how we can work on this. ... View more

Hi, I have requirement like the drilldown panel query should be changed based on the token value passed from the parent panel right now the condition is I have a parent panel token which may pass either SUCCESS or FAILURE as value If it FAILURE the drilldown panel should execute different query and for SUCCESS it should execute different one ... View more

Hi , I have requirement like there two panels, in which the 1st one has success and failure as a column name and on click of these success or failure count a drill down panel should show the result. these success and failure was categorized by below values in logs like statusCode = 200 , then its is success statusCode = 400 or 500, then it is failure   as said above the drilldown panel should show result on selection of the success/ failure count. it tried with below query it is not working  having token as $col$ which gets selection of that column name(Success/Failure) query is message.flow="individual" | eval status=$col$| eval source= case(status=="Success",200,status=="Failure",400 OR 500) | message. statusCode= source| table time,details, message. statusCode kindly help on fixing it. the parameter value of source should be passed to the message.statusCode ... View more

Hi I have requirement to fetch the some value like asf55-hsgf-56bj4b-rdhh-5b4f, this values are sent from the applications in two different ways like  1)message: dhgfsjd{endbjjdfg, country=hongkong, server=gvfhsd, idVal=asf55-hsgf-56bj4b-rdhh-5b4f, error=gvrf hdfhdsf, errorCode=47574} The another format is 2)message: dhgfsjd{endbjjdfg, country=[hongkong], server=[gvfhsd], idVal=[asf55-hsgf-56bj4b-rdhh-5b4f], error=[gvrf hdfhdsf], errorCode=[47574]} I was suppose to extract the idval value which should satisfy the above case.   I have tried with below rex command,   |rex field = message "(idVal={1}(?P<ppid>.+?,))" | eval value =split(ppid,",") output :asf55-hsgf-56bj4b-rdhh-5b4f   the above command is working fine for first case alone but we have the logs with second case it returns output as [asf55-hsgf-56bj4b-rdhh-5b4f] ... View more

Hi  I get a log in below format of JSON obj message{              Dashboard{                              status: SUCCESS                               operationName:gettingResult } In the above logs i get a value of SUCCESS/FAILURE for status. Now my requirement is to calculate a total,totalSuccess and totalFailure based on operationName. Tried the below query but it is not working out    ......messgae.Dashboard.status=*| stats count as total,count(eval(messgae.Dashboard.status=SUCCESS)) as totalSuccess, count(eval(messgae.Dashboard.status=FAILURE)) as totalFailure by messgae.Dashboard.operationName   getting value for total but not for totaSuccess /totalFailure ... View more

Hi, I have a requirement like i need to extract a some card value which was present inside the message body of the log. In this value would come to logs in two different names. Can you please how can i fetch these value and display it in  table.   thanks ... View more

Hi, I have a requirement like we have a csv file which has the values of functionid and functiondesc, this file was added in lookup also. I get a value eventid from the logs which is same as functionid. Now,  we need to fetch  the functiondesc of the corresponding eventid. and display it in table. ... View more

I have a JSON object value as timetaken= 63542 in milliseconds, I  need to convert the stats max(timetaken) value which is in ms to seconds tried as like below  but it is not working out.  search envId = *  message=PostLogin* | stats min(timetaken),max(timetaken), Avg(timetaken) | eval max_time=round((max(timetaken)/1000),2) , min_time = round((min(timetaken)/1000),2) | table max_time,min_time,Avg(timetaken)   But the above is producing the values in same ms even we convert it to seconds     ... View more