I have a saved search which is scheduled for every 17mins with time range of last 7 days. instead of getting results with last 7 days of data, can i get only last 15 or 20mins data and i should not change the time range in saved search from last 7 days .  ... View more

I have list of region in one input.dropdown based on the region selection need to populate the servers in another input.dropdown in the same glass table using search based inputs on both input.dropdown. ... View more

I have a alert which is running to find few values and i need to write the result of the alert to new index which has created. I have used alert action as log event and mentioned the new index which has created to write the output of the alert. but the output is getting ingested to new index but when i tried with main (default index) the output of the alert is getting ingested. the newly created index is working, i tried checking ingesting other data manually with files. so, what could be the issue , the alert results are not getting ingested to newly created index. ... View more

  I have created a dashboard with  incident count and some other details count in different single value visualization. so i need to text - align the title of single value left or center. could anyone can help me here. ... View more

   i have two searches in different indexes index itsi_grp* and Index B, and these two searches will have common fieldvalues in hostname and problemdesc fields name index itsi_grp* using these two fields i have to get a "id" field from  index B   For example Index itsi_grp* Hostname   Problemdesc   name AAA                CPU issue          abc Index B Host  Problem ID AAA   CPU          555   My result should like below Host            problem               ID           incindetnumber     name AAA              CPU                       555       *******                       abc   Am using the join command to get the results but its not returning any values , even the data is available in both indexes, used below query, index=itsi_grp*  |search name="abc"|rename Hostname as Host, Problemdesc as Problem |join Hostname Problem [search index=B sourcetype=abc] |table Host, Problem, incindetnumber,ID, name   For fetching incindet, i will be using the lookup. The only problem is while using the join command am not getting the results, its returning 0 statistics.  Could you please help me if am using the join command properly ... View more

Hi all, We are creating episodes and incidents are getting created in SNOW , the incident number is available in Activity tab of the episode review but not in the Impact tab. could you please help us how to resolve this issue? Thanks, Nivetha S ... View more

I have a field called Identifier which has values of server names.  I need to check the server names first character is number or not. Could you please let help me, used regex but not able to achieve it. thanks eg ., server names 01234server1 01256server2 2345server3 Abcserver bcdserver       ... View more

  I am having correlation search running for every 5mins to get last 15mins data. The requirement is if the event comes at first time and created the episode but it should not create a incident at the time. it should wait for 15mins and then if the issue is still there then create a incident. How we will know issue is still there, we are having auto-closure as well, for the same event if the auto-closure event comes correlate the event into the same episode and close the episode , this should happen if the auto-closure event come within 15mins. If auto-closure comes after 15mins then close the incident. Action for raising the incident will be based on status= ACTION and for auto-closure , the status is OK.   Now, to implement this we have created the action rules in NEAP policy,  1. to stop episode creating incident for 15mins -                  if the event in the episode is >=1 and status as active and if the episodes existed for 900sec--> SNOW configure 2. To close the episode  after receiving status as OK within 15mins                 if the event in the episode is >=2 and status in OK --> Close the episode 3. To close the episode after receiving status as OK after 15mins                  if the event in the episode is >=2 and status in OK and incident_status for that episode is not resolved or closed --> Close incident in SNOW But the tried use cases are not working, any one can help me with this how we can implement? ... View more

I have scheduled report which will give the result of hostname and some other details in the table format and now i need to use this schedule report to get the same output in my dashboard. The dashboard should not rerun everytime i open it.  For example: i have scheduled report which will run everyday at 00:00 and return the details in table format and the same details should be shown in dashboard untill the next schedule report runs. can anyone help how to work on this ... View more

  I have table visualization which contains the details of name, course and other details. when am clicking on the any value in the name column that value should pass through the url and it opens the other dashboard to get the entire details of that name.  We have tried the $row.name.value$,$value$ and other syntax as well but no luck. can any one help me here. Set token in source code, passed the values in url too but not taking the value. app/search/dashboarddetails?form.name=$value$ app/search/dashboarddetails?form.name=$row.name.value$ etc., And do we have any constraints that only 2 or 3 token will be passed in the url? ... View more