index=myindex NUM | where isnull(NXT) | dedup MC | eval lrm_time=[ search index=myindex2 | eventstats min(_time) as min_time | where _time=min_time | table min_time | dedup min_time | return $min_time ] | eval formatted_time = strptime(AVAIL_TS, "%Y%m%d%H%M%S") | eval lrm_frmt_time = strptime(strftime(lrm_time, "%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S") | eval final_time = if(formatted_time > lrm_frmt_time, formatted_time, null) | where isnotnull(final_time) | join NUM [search index=myindex3 NUM | eval ID = printf("%01d",ID) | rename ID as NUM | stats count by NUM | eval timestatus=case(count > 5, "Complete", count == 0, "Incomplete", count > 0 AND count >= 5, "In Progress") ] | search NUM = 1 | stats count AS Total Here is the query using output will come count and that value shows using single value. file runs 4 times daily. I will create 4 panels show the NUM =1, 2, 3, 4 count. how i can show the field timestatus output is complete, incomplete and inprogress for each panel color. Thanks in Advance! ... View more

How i can display the data sum of 2 fields like Last month same date data (example: 24 june and 24 may) I have tried the below query i was getting the data but how i can show in a manner. index=gc source=apps | eval AMT=if(IND="DR", BASE_AMT*-1, BASE_AMT) | eval GLBL1=if(FCR="DR", GLBL*-1, GLBL) | eval DATE="20".substr(REC_DATE,1,2).substr(REC_DATE,3,2).substr(REC_DATE,5,2) | eval current_pdate_4=strftime(relative_time(now(), "-30d@d"),"%Y%m%d") | where DATE = current_pdate_4 | stats sum(AMT) as w4AMT, sum(GLBL1) as w4FEE_AMT by DATE id |append [search index=gc source=apps | eval AMT=if(IND="DR", BASE_AMT*-1, BASE_AMT) | eval GLBL1=if(FCR="DR", GLBL*-1, GLBL) | eval DATE="20".substr(REC_DATE,1,2).substr(REC_DATE,3,2).substr(REC_DATE,5,2) | eval current_pdate_3=strftime(relative_time(now(), "-@d"),"%Y%m%d") | where DATE = current_pdate_3 | stats sum(AMT) as w3AMT, sum(GLBL1) as w3FEE_AMT by DATE id | table DATE, id w3AMT, w4AMT, w4FEE_AMT w3FEE_AMT | rename Date as currentDATE, w3AMT as currentdata, w3FEE_AMT as currentamt w4AMT as lastmonthdate w4FEE_AMT as lastmonthdateamt DATE, id currentdata lastmonthdate currentamt lastmonthdateamt 20240723 2 2323 2123 23 24 20240723 3 2423 2123 23 24 20240723 4 2223 2123 23 24 20240723 5 2323 2123 23 24 20240723 6 2329 2123 23 24 20240723 7 2323 2123 23 24 ... View more

  | makeresults format=csv data="QUE_NAM,FINAL,QUE_DEP S_FOO,MQ SUCCESS, S_FOO,CONN FAILED, S_FOO,MEND FAIL, S_FOO,,3" | stats sum(eval(if(FINAL=="MQ SUCCESS", 1, 0))) as good sum(eval(if(FINAL=="CONN FAILED", 1, 0))) as error sum(eval(if(FINAL=="MEND FAIL", 1, 0))) as warn avg(QUE_DEP) as label by QUE_NAM | rename QUE_NAM as to | eval from="internal", label="Avg: ".label." Good: ".good." Warn: ".warn." Error: ".error | append [| makeresults format=csv data="queue_name,current_depth BAR_Q,1 BAZ_R,2" | bin _time span=10m | stats avg(current_depth) as label by queue_name | rename queue_name as to | eval from="external", label="Avg: ".label | appendpipe [ stats values(to) as from | mvexpand from | eval to="internal" ]] How to add different icons for each one in the flow map viz. Please help me on that. Thanks in advance.  ... View more

How to show the avg and their status in Flow Map viz connections. index=gc source="log" QUE_NAM="S*" | stats sum(eval(FINAL="MQ SUCCESS")) as good sum(eval(FINAL="CONN FAILED")) as errors sum(eval(FINAL="MEND FAIL")) as warn avg(QUE_DEP) as queueAvgDept by QUE_NAM | eval to=QUE_NAM, from="internal" | append [search index=es sourcetype=queue_monitor queue_name IN ("*Q","*R") | bucket _time span=10m | stats max(current_depth) as max_Depth avg(current_depth) as avg_Depth by _time queue_name queue_manager | eval to=queue_name, from="external"] For this query, i got below visualization and i need to connect between internal and external one ( highlighted in red color and how to show the avg count through the flow in between  external and name) Please help me out on this Thanks in advance!   ... View more

How to add a dummy row to the table in the Splunk dashboard. We are receiving 2 files everyday 4 times in between 6-7:30AM, 11-12:30 PM, 6-7:30PM, 9-10:05PM. I need output like below if received one file means has to display like missing other file. Using | makeresults command we can create a row but it is applicable while calculating the timings. Input :  File  Date TI7L 03-06-2024 06:52 TI7L 03-06-2024 06:55 TI8L 03-06-2024 11:51 TI8L 03-06-2024 11:50 TI9L 03-06-2024 19:06 TI9L 03-06-2024 19:10 TI5L 03-06-2024 22:16 TI5L 03-06-2024 22:20     Output:  File  Date TI7L 03-06-2024 06:52 Missing file Missing file TI8L 03-06-2024 11:50 TI9L 03-06-2024 19:06 Missing file TI5L 03-06-2024 22:16 Missing file ... View more

Hi Team, Please let me know how to add a color to time format as below. Below one is not matching with the requirement. <colorPalette type="expression">if(strptime(value,"%H:%M:%S")>"25200", "#A2CC3E", "#F58F39")</colorPalette> Time expecting this color in Time field 25-05-2024 19:06 Red 25-05-2024 22:10 Red 25-05-2024 22:16 Red 26-05-2024 06:50 Green 26-05-2024 06:52 Green 26-05-2024 11:50 Green 26-05-2024 11:52 Green 27-05-2024 07:09 Red 27-05-2024 07:10 Red 27-05-2024 11:52 Green 27-05-2024 11:57 Green Thanks in Advance! ... View more

HI Team, when the status is H and it has to complete within the day itself. expected output for below sample data is count 2 completed overall within the day. Thanks in Advance! Sample output below: _time OVERAL DT NUM STAT FM WLM CS OB EM RC ER ST 2024-03-07T01:50:00.000-05:00 X 20240307 5 C C C H X X X X X 2024-03-07T03:30:10.000-05:00 X 20240307 5 C C C P X X X X X 2024-03-07T03:40:07.000-05:00 X 20240307 5 C C H H H H H H H 2024-03-07T06:10:14.000-05:00 X 20240307 5 C C C I X X X X X 2024-03-07T07:10:16.000-05:00 X 20240307 5 C C C H X X X X X 2024-03-07T07:30:17.000-05:00 X 20240307 5 C C C I X X X X X 2024-03-07T08:20:18.000-05:00 X 20240307 5 C C C C I C I C C 2024-03-07T08:30:22.000-05:00 C 20240307 5 C C C C C C C C C 2024-03-07T02:20:01.000-05:00 X 20240307 5 C C C X X X X X X 2024-03-07T03:30:10.000-05:00 X 20240307 5 C C C P X X X X X 2024-03-07T03:40:07.000-05:00 X 20240307 5 C C H H H H H H H 2024-03-07T07:10:16.000-05:00 X 20240307 5 C C C H X X X X X 2024-03-07T07:30:17.000-05:00 X 20240307 5 C C C I X X X X X 2024-03-07T08:20:18.000-05:00 X 20240307 5 C C C C I C I C C 2024-03-07T08:30:22.000-05:00 C 20240307 5 C C C C C C C C C 2024-03-07T010:30:10.000-05:00 X 20240307 5 C C C P X X X X X 2024-03-07T22:40:07.000-05:00 X 20240307 5 C C H H H H H H H 2024-03-07T22:10:16.000-05:00 X 20240307 5 C C C H X X X X X 2024-03-07T23:30:17.000-05:00 X 20240308 5 C C C I X X X X X 2024-03-07T00:20:18.000-05:00 X 20240308 5 C C C C I C I C C 2024-03-08T08:30:22.000-05:00 C 20240308 5 C C C C C C C C C ... View more