I have the raw data where i need to convert the time in raw data to particular time zone example:if the time contains emea in it i need to convert to CST time. his is the 3 conditions of time zone: when emea => CEST/CST time when apac => HKT time when us=>EDT 6/10/22 9:39:00.000 AM   2022-06-10 15:39:00 emea 6/10/22 9:41:56.000 AM   2022-06-10 15:41:56 apac 6/10/22 9:41:56.000 AM   2022-06-10 15:41:56  us   Please help me on the query Thank you in advance ... View more

I have the stores and I want to check the status of store whether it is up or down  i want to show the status with help of  processes   Processes.csv lookup  processes Services DeviceType ax Amazonx controller by buy register  I wrote a query but it is not showing the status up or down |mstats latest_time(value) as _time where (host="*" OR host="t*") index=a_store_metrics And metric_name="process.time" by host process |search process in ("ax","by") |eval host=lower(host) |rex field=host "(?<Device>["\.]+)" |rex field=Device "(?<store>\w{7})" |search [|inputlookup  store_device where store="a01" |field Device |format] |lookup store_device Device OUTPUT Store as storetype DeviceType |where (DeviceType="Controller" OR  DeviceType="Register") AND store="a01" |lookup process.csv  process OUTPUT Services |stats latest(_time) as time by instance store |eval status=if(time!="".,"UP","DOWN") |fields store instance service status  I am getting output store instance service status a01 ax amazon x UP a01 by buy UP   If i off the store it is not showing down it is showing only one instance suppose if I stop the services for by it should show status down in by column but it is not showing entire column as shown below. store instance service status a01 ax amazon x UP         Please help me  out Thank you                                                                           ... View more

Hello, Good Day! I having the values in the field Data As shown below 2022-05-31 10:18:09   emea   2022-05-31 2022-05-31 10:18:14    apac  2022-05-31 2022-05-31 10:18:20     us  I want to show the time zone as well like if emea comes after time it should show CST Output should be as follows: 2022-05-31 10:18:09 CST  emea   2022-05-31 2022-05-31 10:18:14 HKT   apac  2022-05-31 2022-05-31 10:18:20  EDT   us  Please help me on this Thank you in Advance Veeru ... View more

Hello, I have the dashboard panel  which gives latest time with respect to source and host, now I want to give a color to the rows where time exceeds more than one in last 7 days. Please help me out. index=A OR index=B | stats latest(_time) as latest_time by source,host | eval latest_time=strftime(latest_time,"%d/%m/%y %H:%M:%S:%Q") | table latest_time,source,host|sort -latest_time when the time range is more than 24 hours the column should be in red.as mentioned below Thnak you in advance, Veeru. latest_time source host 01/05/22 23:19:08:898 trace.log y 30/04/22 23:19:08:597 SystemOut.log y 30/04/22 23:19:08:388 SystemOut.log x 30/04/22 23:19:08:388 trace.log x 30/04/22 23:19:05:611 SystemOut.log y 30/04/22 23:19:05:611 trace.log x 30/04/22 23:09:40:000 SystemOut.log y 30/04/22 23:06:05:000 SystemOut.log x 30/04/22 22:57:14:000 SystemOut.log y ... View more

I want to build this type of dashboard  using internal data in splunk.but i couldn’t able interlink this structure using dashboard studio.please help in this thank you in advance veeru ... View more

 In above image i couldn’t able to access the date input,It’s actually a client server as user I couldn’t able access it.please let me know how to enable the input field that user can access   thank you veeru ... View more

index IN (A,B) sourcetype IN (A,B) earliest=-12h latest=@m | transaction UUID keepevicted=true | eval ReportKey="Today" | append [search index IN (A,B) sourcetype IN (A,B) earliest=-12h-1w latest=@m-1w | transaction UUID keepevicted=true | eval ReportKey="LastWeek" | eval _time=_time+60*60*24*7]  | timechart span=30m count(linecount) as Volume by ReportKey | fields _time,Today,LastWeek as this search taking more time to load so i am trying to modify the search can you please me with this. Thanks in advance Veerendra ... View more

I set up a alert for every 15min if the count > 0,but i want the alert to be triggered a mail  for 2nd consecutive time  example: I want a alert for every 15min but i want a triggered action mail for 2nd consecutive 15min. Is it possible? Please do help me out. Thanks Veeru ... View more