I have a dropdown list with manually specified choices - A, C, D and All, but somehow splunk will auto populate another option * as default in my dropdown list after saving it. The reason why I do not want * to be representing All in my dashboard is because Type might content B data that I want to exclude from being shown on my dashboard.   Anyone knows how to remove this * option?  Thank you     <input type="dropdown" token="contentType"> <label>Type</label> <choice value="A">A</choice> <choice value="C">C</choice> <choice value="D">D</choice> <choice value="ALL" OR content_type="C" OR content_type="D">All</choice> <prefix>(</prefix> <suffix>)</suffix> <default>"A" OR content_type="C" OR content_type="D"</default> <initialValue>""A" OR content_type="C" OR content_type="D"</initialValue> </input>         ... View more

this is similar to https://community.splunk.com/t5/Splunk-Search/Merging-with-similar-strings-without-eval/m-p/484972 It works perfect if the difference is at the end of the strings. But I do have some additional strings that are slightly different in the middle. My Current Query Base search | eval Error=message | rex mode=sed "s/(?m)^\s+//g" | rex field=Error mode=sed "s/^((?<Msg>.+)\s)\S+/\1*/" | top 25 Error,file_line,level by build | table build level count file_line Error Error String Example 1:  No exception occurred when displaying value for task=inspect entity.name=software propertyKey=keyNameForSomething. Please write a rule * No exception occurred when displaying value for task=inspect entity.name=software propertyKey=keyNameForSomethingElse. Please write a rule * No exception occurred when displaying value for task=inspect entity.name=software propertyKey=keyNameForSomethingElseElse. Please write a rule *   Error String Example 2 Locale is null for the language, es with ec, com.EditingContext@1y3y1u3e. Skip this * Locale is null for the language, en with ec, com.ITEditingContext@2y5f3u3e. Skip this *   ---  I would hope my output to be the following or similar:  Count,  Error 3, No exception occurred when displaying value for task=inspect entity.name=software propertyKey=*. Please write a rule * 2, Locale is null for the language, *   ... View more

I was given a base search to manipulate and create Timechart accordingly. base search | eval file_line = file.":".line | eval errorList = message . ":" . file_line . ":" . level | top 25 message,file_line,level by applicationBuild | table applicationBuild level count file_line message The result was formatted as such build2021 ERROR 8 file1.java:111 ErrorMessage123 build2021 ERROR 4 file2.java:123 ErrorMessage456 build2021 ERROR 3 file3.java:456 ErrorMessage789   I want to plot a Timechart from the above result. Output should be Top 25 Error message above against time. I came out with base search | eval file_line = file.":".line | eval errorList = message.";".file_line.";".level | where errorList!="null" | timechart useother=f usenull=f count max(message,file_line,level,applicationBuild) by errorList limit=25   The legend of the result will append "count: " in front of the errorList that I cannot remove. Any idea how can I remove this from the legend? OR are there better ways to achieve the same result?     ... View more