Hi @weidertc  You'll have to write a <change> block and set the tokens that needs an update to the desired value or its default value as per your use case. ... View more

Hi @Marco_Develops  Try the following. Update your search this way.. your base search |chart count over SEVCAT   And configure the dashboard panel drilldown to the following. If it helps, karma points are appreciated! ... View more

Hi @uagraw01  In your search terms for the services, replace that with "ERROR"  Update your extractions for Error Code this way    | rex "errorCode=(?P<EC1>[\d]+)" | rex "Error Code :: (?P<EC2>[\d]+)" | eval ErrorCode=coalesce(EC1,EC2) | where ErrorCode>499   And continue to extract service and other fields as required and check the results. If the result yields services that need not be included in your result, try to add them using the NOT keyword as part of your search like   NOT("xyz-service" OR "abc-service")   ... View more

Hi @amitru  Try something like this and then do a stats command to get insights.   |rex field=_raw "URI\s\:\s(?P<URL>[\w\:\/\.]+)" |rex field=_raw "loginId\"\:\s\"(?P<UserID>[\w]+)\"" |stats count by UserID URL   ... View more

Hi @ilanaKarten0333  You'll have to first identify the key field/entity to get your statistics of events. For example, your key fields could be "trigger name" or " IsEntityInBlackList: Entity" as seen from the above logs. Once you identify the field you are interested to view the events for, use the "stats" command to  get insights. Example: | stats count by trigger_name ... View more

Hi @ychoo  I think you'll need to update the sourcetype for the log from text to json to correctly parse the logs looking at a good long term solution. If not you can proceed with using spath or regex for field extractions.   source="D:\\Learn Splunk\\test.txt" sourcetype="text" | rex field=_raw "date\"\:\"(?P<SourceTimestamp>[\d\-\:\.T]+)\"\},\"s\"\:\"(?P<Severity>[\w]+)\",\s\"c\"\:\"(?P<Component>[\w]+)" | rex field=_raw "ctx\"\:\"(?P<Context>[\w]+)\",\"msg\"\:\"(?P<Message>[\w\s]+)" | table _time SourceTimestamp Severity Component Context Message         ... View more

Hi @Borntowin  Can you please elaborate a bit more, maybe with a screenshot/wireframe on what you want to achieve? ... View more

Hi @Mrig342 , This will do the trick. | inputlookup Test1.csv | chart sum(count) by Transaction Status | fillnull value=0 | addtotals   ... View more

Hi @Borntowin  You can increase the Canvas dimensions and setting it to your needs. Note: You'll need to use the Absolute mode of Dashboard creation in Dashboard studio. If it helps,  Karma points will be appreciated. ... View more

Hi @hieuba6868 , Write your first part of search to fetch from WinHostMon sourcetype and later on using a common denominator field write a stats command to correlate the information from lookup/wineventlog. Or you can write a join query to fetch data from the 2 sourcetypes, whichever one is feasible and not resource taxing. ... View more

Hi @lalitha , Check for field values with leading/trailing spaces and try something like this to get your result.   | makeresults count=8 | streamstats count | eval dv_number = case(count=1, 1023, count=2, 39, count=3, 31, count=4, 234,count=5,112,count=6,462,count=7,627,count=8, 998 ) | eval dv_assigned = case(count=1 OR count=3, "James", count=2 OR count=4, "Sam",count=5 OR count=7, "Morkel",count=6 ,null(), count=8, "Stacy") |fillnull value="--Unassigned--" dv_assigned | eval dv_state = case(count=1, "Closed Complete", count=3, "Pending", count=2 OR count=4, "Closed Incomplete",count=5 OR count=7, "Closed Skipped",count=6, "Work in Progress", count=8, "Open") | eval status = if(like(trim(dv_state),"Closed%"),"Closed", trim(dv_state)) | where status!="Closed"       ... View more

hi @jking81  In addition to creating a lookup table by uploading the file, you'll also need to create a definition. Under lookups, check for lookup definition option, select and configure it with the uploaded file and other field details as necessary. Once configured you should be able to search the content from the lookup file. ... View more

hi @thatsabhijeet  Resize the panel width using css in your dashboard to do so. ... View more

Hi @robertlynch2020  sid is the search id of the query being used in the panel. Check if the search used in the panel is executed and completed successfully. Try to run query separately and use the Inspect job option to see its execution details, it may give you some idea why its failing. Also, check if the query used is using loadjob function if so then verify the actual saved search. ... View more

Hi @ccloutralex  If you know the fields that have non-ascii characters, try to replace them using sed command. | rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g" ... View more

Try something like this.... curl -k -u user:password https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=_internal | head 3" -d output_mode=csv/xml/json This will store the results in the user path as shown below.     ... View more

From the looks of it, you want to suppress alerts during a planned/known outage time window and also at the same time want to have alerts during the normal operational window if the system fails/reboots. Unfortunately Splunk doesn't provide alert suppression windows, your only best bet is to disable alerts during the planned outage window and re-enable them once the activity is completed successfully. ... View more