Hello Splunk Community,    I have a merged event which shows if a service is running or down. Here is an example of the event in splunk:   ******************************************************************************* All services are running 1092827|default|service1is running 37238191|default|service2 is running 16272373|default|service3 is running *******************************************************************************   How can I split the merged events so I can extract the service name, status (running/down) & host? 16272373|default|service3 is running Host |      | ServiceName is Status ... View more

Hello Splunk Community,  I have created a dashboard with 3 dropdowns; Select System, Select Environment, Select Period (time).  Note: each system has named their environments the same i.e. Production, UAT etc. I seem to be having a problem when i have already selected all dropdowns and metrics load, then i change the System dropdown, the Environment dropdown seems to update but there is 1 duplicate (i.e. in pervious search I selected 'Production' environment and now I have 2 Production environments assuming one is for each system).  Can someone assist me to figure out how to clear the environment dropdown when i change the system? I have tried to play around with the settings within the UI but no luck.  Is there something i need to change in my source code?  <fieldset submitButton="false" autoRun="false"> <input type="dropdown" token="CMDB_CI_Name" searchWhenChanged="true"> <label>Select IT Services</label> <fieldForLabel>CMDB_CI_Name</fieldForLabel> <fieldForValue>CMDB_CI_Name</fieldForValue> <search> <query>|inputlookup list.csv | fields CMDB_CI_Name | dedup CMDB_CI_Name</query> <earliest>-4h@m</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="env" searchWhenChanged="true"> <label>Select Environment</label> <change> <set token="tokEnvironment">$label$</set> </change> <fieldForLabel>Env_Purpose</fieldForLabel> <fieldForValue>Env_Infra</fieldForValue> <search> <query>|inputlookup list.csv | search CMDB_CI_Name=$CMDB_CI_Name$ | fields Env_Purpose, Env_Infra | dedup Env_Purpose, Env_Infra</query> </search> </input> <input type="time" token="time_token" searchWhenChanged="true"> <label>Time Period</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> ... View more