Hi everyone, Newbie here again. Is it possible to have query similar to the LIKE function in SQL where MM/DD/YYYY in Splunk to set different MAX VALUE and INTERVAL for the Y-Axis? Would it also be possible just to use the Month and Year for the condition to take effect so that regardless what Date the user may enter, it would not effect the result?   ... View more

Hi everyone, Our team is currently looking for a way to make several dashboards be accessible to our business users who may not have a Splunk account. Specifically by giving them a Sharepoint link that will contain the links to each report. Upon checking with the our company's Splunk support team. They mentioned that it would not be possible and we would have to add those users manually via our ticketing system which would cause some delay that we would want to avoid. Just wanted to check if there is be a way to do this within the dashboard to bypass such ruling that they aren't familiar with? Let me know if there are anything you need to clarify. Please and thank you! ... View more

Hi everyone, My team is asking if it would be possible to have a single dashboard panel to link to different dashboards to the matching report similar to the "Navigation Menu" since it might make it more user friendly to give public access for that dashboard via a hyperlink. I uploaded the names of the report via a lookup CSV table. Was considering of placing it there but was unsure if that would work and would rather have it as a click on the report kind of option for the business users. See screenshot for reference. Is there a way to do it using XML or HTML? | inputlookup capcaity_report_titlte.csv       ... View more

Updated the post since the error changed into "Error in 'where' command. The expression is malformed. Expected)" My aim is to use two separate stings of tokens in my search to pass the following: 1) "Start of the Month" + "Year"   ($month1$ $year$) 2) "End of the Month" + "Year" ($month2$ $year$) I was trying to combine the strings using <eval> within the <change> step but had no luck on finding a guide to implement it properly. Would it be better just to add the <eval> within the search or would it be better to do it during the change to avoid any complications?       <form theme="dark"> <label>CSC/ERSC/PSI PAGING Report</label> <fieldset submitButton="true" autoRun="true"> <input type="dropdown" token="lpar"> <label>Select to View</label> <choice value="----">----</choice> <choice value="D7X0">D7X0</choice> <choice value="H7X0">H7X0</choice> <choice value="D1D0">D1D0</choice> <choice value="DAD0">DAD0</choice> <choice value="E1D0">E1D0</choice> <choice value="H1D0">H1D0</choice> <choice value="WSYS">WSYS</choice> <choice value="YSYS">YSYS</choice> <default>----</default> </input> <input type="dropdown" token="year"> <label>Select Year</label> <choice value="----">----</choice> <choice value="2022">2022</choice> <default>----</default> </input> <input type="dropdown" token="month1"> <label>Select Month</label> <choice value="****">****</choice> <choice value="01/01/">January</choice> <choice value="02/01/">February</choice> <choice value="03/01/">March</choice> <choice value="04/01/">April</choice> <choice value="05/01/">May</choice> <choice value="06/01/">June</choice> <choice value="07/01/">July</choice> <choice value="08/01/">August</choice> <choice value="09/01/">September</choice> <choice value="10/01/">Ocotber</choice> <choice value="11/01/">November</choice> <choice value="12/01/">December</choice> <default>****</default> <change> <condition label="****"> <set token="month2">----</set> </condition> <condition label="January"> <set token="month2">01/31/</set> </condition> <condition label="February"> <set token="month2">02/29/</set> </condition> <condition label="March"> <set token="month2">03/31/</set> </condition> <condition label="April"> <set token="month2">04/30/</set> </condition> <condition label="May"> <set token="month2">05/31/</set> </condition> <condition label="June"> <set token="month2">06/30/</set> </condition> <condition label="July"> <set token="month2">07/31/</set> </condition> <condition label="August"> <set token="month2">08/31/</set> </condition> <condition label="September"> <set token="month2">09/30/</set> </condition> <condition label="October"> <set token="month2">10/31/</set> </condition> <condition label="November"> <set token="month2">11/30/</set> </condition> <condition label="December"> <set token="month2">12/31/</set> </condition> </change> </input> </fieldset> <row> <panel> <chart> <search> <query>index=mainframe-platform sourcetype="mainframe:mpage" MVS_SYSTEM_ID=$lpar$ | eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d") | eval _time=strptime(DATE." ","%Y-%m-%d") | where _time &gt;= strptime("$month1$""$year$", "%m/%d/%Y") AND _time &lt;= strptime("$month2$""$year$", "%m/%d/%Y") | chart sum(VIO_PAGING_SEC) as "$lpar$ Sum of VIO_PAGING_SEC" sum(SYSTEM_PAGEFAULTS_SEC) as "$lpar$ SYSTEM_PAGEFAULTS_SEC" sum(SWAP_PAGIN_SEC) as "$lpar$ SWAP_PAGIN_SEC" sum(LOCAL_PAGEFAULTS_SEC) as "$lpar$ LOCAL_PAGEFAULTS_SEC" over _time</query> <earliest>0</earliest> <latest></latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> </form>     Would appreciate the help. ... View more

Splunk newbie here again, Currently search for a way to create a dependent drilldown where the Year would be the basis the independent and the Month would be the dependent since the reports that would be generated would need to look back from the previous, current, and possibly future reports. My temporary fix is using the Input Panel to pass it like in a string format. However the team I am  creating this for was searching for a way to avoid the users from typing in the input. Attaching a screenshot of the code along with the code at the moment.     <form theme="dark"> <label>CSC/ERSC/PSI PAGING Report</label> <fieldset submitButton="true" autoRun="true"> <input type="dropdown" token="lpar"> <label>Select to View</label> <choice value="----">----</choice> <choice value="D7X0">D7X0</choice> <choice value="H7X0">H7X0</choice> <choice value="D1D0">D1D0</choice> <choice value="DAD0">DAD0</choice> <choice value="E1D0">E1D0</choice> <choice value="H1D0">H1D0</choice> <choice value="WSYS">WSYS</choice> <choice value="YSYS">YSYS</choice> <default>----</default> </input> <input type="dropdown" token="&quot;y&quot;"> <label>Select Year</label> <choice value="2022">2022</choice> <default>2022</default> </input> <input type="dropdown" token="month"> <label>Select Month</label> <choice value="earliest=@y latest=@y+1mon">January</choice> <choice value="earliest=@y+1mon latest=@y+2mon">February</choice> <choice value="earliest=@y+2mon latest=@y+3mon">March</choice> <choice value="earliest=@y+3mon latest=@y+4mon">April</choice> <choice value="earliest=@y+4mon latest=@y+5mon">May</choice> <choice value="earliest=@y+5mon latest=@y+6mon">June</choice> <choice value="earliest=@y+6mon latest=@y+7mon">July</choice> <choice value="earliest=@y+7mon latest=@y+8mon">August</choice> <choice value="earliest=@y+8mon latest=@y+9mon">September</choice> <choice value="earliest=@y+9mon latest=@y+10mon">Ocotber</choice> <choice value="earliest=@y+10mon latest=@y+11mon">November</choice> <choice value="earliest=@y+11mon latest=@y+12mon">December</choice> </input> <input type="text" token="from"> <label>From MM/DD/YYYY</label> <default>01/01/2022</default> </input> <input type="text" token="to"> <label>To MM/DD/YYYY</label> <default>01/31/2022</default> </input> </fieldset> <row> <panel> <title>$lpar$ Date Panel</title> <chart> <title>From &amp; To Input: $from$ - $to$</title> <search> <query>index=mainframe-platform sourcetype="mainframe:mpage" MVS_SYSTEM_ID=$lpar$ | eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d") | eval _time=strptime(DATE." ","%Y-%m-%d") | where _time &gt;= strptime("$from$", "%m/%d/%Y") AND _time &lt;= strptime("$to$", "%m/%d/%Y") | eval epochtime=strptime(TIME, "%H:%M:%S")| eval desired_time=strftime(epochtime, "%H:%M:%S") | chart sum(VIO_PAGING_SEC) as "$lpar$ Sum of VIO_PAGING_SEC" sum(SYSTEM_PAGEFAULTS_SEC) as "$lpar$ SYSTEM_PAGEFAULTS_SEC" sum(SWAP_PAGIN_SEC) as "$lpar$ SWAP_PAGIN_SEC" sum(LOCAL_PAGEFAULTS_SEC) as "$lpar$ LOCAL_PAGEFAULTS_SEC" over _time</query> <earliest>0</earliest> <latest></latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option> <option name="charting.axisTitleX.text">Date of Occurrence</option> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="charting.legend.placement">bottom</option> <option name="height">789</option> <option name="refresh.display">progressbar</option> <drilldown> <link target="_blank">/app/mainframe-platform/csierscpsi_paging_individual_report?_time=$click.name2$</link> </drilldown> </chart> </panel> </row> <row> <panel> <chart> <title>Select a Month using $month$</title> <search> <query>index=mainframe-platform sourcetype="mainframe:mpage" MVS_SYSTEM_ID=$lpar$ | eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d") | eval _time=strptime(DATE." ","%Y-%m-%d") | where $month$ | chart sum(VIO_PAGING_SEC) as "$lpar$ Sum of VIO_PAGING_SEC" sum(SYSTEM_PAGEFAULTS_SEC) as "$lpar$ SYSTEM_PAGEFAULTS_SEC" sum(SWAP_PAGIN_SEC) as "$lpar$ SWAP_PAGIN_SEC" sum(LOCAL_PAGEFAULTS_SEC) as "$lpar$ LOCAL_PAGEFAULTS_SEC" over _time</query> <earliest>$range.earliest$</earliest> <latest>$range.latest$</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="height">789</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> </form>   ... View more

Hey everyone, Currently making a report for my team that requires to have two X-Axis values based on the excel sheet shared with me. Below are some screenshots of the desired output, my progress so far, and search query based on what I have learned so far. The goal: What I am familiar with using chart in the search: My search string   | eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d") | eval _time=strptime(DATE." ","%Y-%m-%d") | where _time >= strptime("$from$", "%m/%d/%Y") AND _time <= strptime("$to$", "%m/%d/%Y") | eval epochtime=strptime(TIME, "%H:%M:%S")| eval desired_time=strftime(epochtime, "%I:%M:%S %p") | chart sum(VIO_PAGING_SEC) as "$lpar$ Sum of VIO_PAGING_SEC" sum(SYSTEM_PAGEFAULTS_SEC) as "$lpar$ SYSTEM_PAGEFAULTS_SEC" sum(SWAP_PAGIN_SEC) as "$lpar$ SWAP_PAGIN_SEC" sum(LOCAL_PAGEFAULTS_SEC) as "$lpar$ LOCAL_PAGEFAULTS_SEC" over desired_time   ... View more