I have a single index which logs incoming request and completed request related details. There is a common indicator i.e. commandId . I want to fetch key parameters from each entry and then merge it into a single table for dashboarding. Incoming request details (which will not have the keyword : numDCs): index="log-3258-prod-c" NOT numDCs| | table _time,contextId,user_name,Flow Completed request details (which will have keyword: numDCs) index="log-3258-prod-c" numDCs| fields contextId,contextIdUser,numDCs,productCount, clientIP,laas_hostname,flowId I need table having all columns in both and contextId as merging column There are chances that incoming request has still not completed i.e. they might still be executing so its values for Completed request columns should be null ... View more

Getting error : "The lookup table 'Horizon_Feb_2022.csv' requires a .csv or KV store lookup definition." while running simple query "|inputlookup Horizon_Feb_2022.csv". Facing similar issue for other datasets as well. ... View more

Hello, so I have an input on my dashboard page of either month"01-2022,02-2022" and also quarter"Q1-2022". So depending on the search I want to have my timechart command. For example: query| timechart span="1mon" count(number) [For month] query| timechart span="qtr" count(number) [For quarter]. I want query like this: if [input_month="Q%"] then query| timechart span="qtr" count(number) else query| timechart span="1mon" count(number)   How can I do this  ? ... View more

Hello, I have 2 CSVs in my splunk: Alert.csv having below columns and data: Alert_Header   Alert_type   Date JNA/athena_VICTORIA_Load [FAILED]   Autosys   01/03/2022 JNA/athena_VICTORIA_Staging [MAXRUN]   Autosys   01/03/2022 JNA/athena_MAIN_Load [FAILED]   Autosys   01/03/2022 JNA/athena_OLTP_Staging [MAXRUN]   Autosys   01/03/2022 NYP02000 has high_cpu   DATABASE   01/03/2022   Mapping.csv having below columns and data: Alert_Type   Inclusion   Exclusion   Header Autosys   athena   VICTORIA   ATHENA-Jobs Autosys   VICTORIA   NONE   VICTORIA-Jobs Database   high_cpu   NONE   CPU alerts   Output required: Alert_Header   Alert_type   Date   Header JNA/athena_VICTORIA_Load [FAILED]   Autosys   01/03/2022   VICTORIA-Jobs JNA/athena_VICTORIA_Staging [MAXRUN]   Autosys   01/03/2022   VICTORIA-Jobs JNA/athena_MAIN_Load [FAILED]   Autosys   01/03/2022   ATHENA-Jobs JNA/athena_OLTP_Staging [MAXRUN]   Autosys   01/03/2022   ATHENA-Jobs NYP02000 has high_cpu   DATABASE   01/03/2022   CPU alerts   Logic: Mapping file is for looking up pattern in the Alert.csv. So if any Alert_Header which has "athena"(mentioned in Inclusion) but doesn't have "Victoria" (mentioned in Exclusion) keyword in it will be termed as "ATHENA-Jobs" . Similarly if any Alert_Header which has "Victoria"(mentioned in Inclusion) only will be termed as "VICTORIA-Jobs". None in Exclusion column would mean there is no exclusion pattern to be searched in Alert_Header.   Can you please help with this query ... View more

When I just display field "Writeup" from my Excel dataset which is like below: "This is the first line. This is the second line. This is the third line." While displaying the same in Dashboard Studio, it prints like below: "This is the first line.This is the second line.This is the third line." How can I resolve this issue ... View more