Hello - I'd like to start with thanking the community for reviewing and helping!  Problem Statement: I have appt data from multiple clinical locations in Splunk with different types statues. I am trying to create a dashboard that would show trends in appts requests to see if we're gaining pts or losing them, what days are the busiest, what days are the slowest.  Query: index="index" cluster_id="*" dump_info:98 | spath output=log path=log | rex field=log ".*\{\'name\'\:\s\'(?<name>.*)\'\,\s\'service_type\'\:\s\'(?<service_type>.*)\'\,\s\'status\'\:\s\'(?<status>.*)\'\,\s\'start\'\:\s\'(?<start>.*)\'\,\s\'lastUpdated\'\:\s\'(?<lastUpdated>.*)\'\,\s\'date\'\:\s\'(?<date>.*)\'\}" | search name="*" AND status="*" AND start="*" | dedup name service_type status start lastUpdated date | eval startdate=strftime(strptime(start,"%Y-%m-%dT%H:%M:%SZ"),"%Y-%m-%d"), today=strftime(now(),"%Y-%m-%d") | where startdate=today | table name, status | stats count(status) as status_count, values(*) as * by name, status ... View more

Hello - Thank you in advance for the help. I am getting following raw data in Splunk events which I'd like to pull into a table format. I would like to pull the following: Host, Success, and Error field as columns for my table.   I tried this query but no success: | makeresults | eval _raw="{\"host\"},{\"success\",{\"error\"}" | spath path=host{} output=temp | mvexpand temp | spath input=temp | fillnull value="None" | table host,success,error ... View more

I am trying to create a table which shows 3 column error msg, errorcode, and count. my current query is pulling the errorcode/msg in one column and error count  individually instead of whole. Please assist. my Current Query My current query           Current Output Expected Output ... View more

I have added a dropdown in my panel as shown below. My issue is that regardless of which option I chose it shows red in the pie chart and 100%. I would like to know how I can change colors by the selection and also for the percentage to update based on the selection from the drop down. ... View more

I am trying to create a pie chart that would show difference error codes by category.  Here is my current query: index= my_index | stats last(_time) as _time last(Message) as Message by Type | stats count by Type | eval ErrorCode=443 | eval ErrorrCode=503   I'd like to pull in all errors without specifying the ErrorCodes as I have in my query. ... View more