please suggest some splunk data optimization techniques that can be implemented in splunk cloud platform ... View more

Hi, I have 2 saved searches that fetch data from datamodel (pivot table) and the result of these savedsearch is storing to a summary index. But 2 days before I found that my saved search query got partially deleted from UI , but it is present in the backend. Is there anyone can help to understand how it is happening. What is the rootcause for this ... View more

Hi, I have same field that value has to compared between 2 search queries. So, Kindly help on below.   index=xyz |search component=gateway appid=12345 message="*|osv|*" |rex "trace-id.(?<RequestID>\d+)" |fillnull value=NULL RequestID |search RequestID!=NULL |table _time,Country,Environment,appID,LogMessage |append [search index=xyz |search appid=12345 message="*|osv|*"  level="error" |search `mymacrocompo`  |rex "trace-id.(?<RequestID1>\d+)" |fillnull value=NULL RequestID1 |search RequestID1!=NULL |table LogMessage1] |eval Errorlogs=if(RequestID=RequestID1,"LogMessage1", "NULL") In the above query, we have RequestID in the main query and the sub query as well. we have to find out the error logs based on RequestID which means if RequestID matches with RequestID1, need to dispaly the LogMessage1.   ... View more

Hi, Kindly help on sorting the values from append query as below: index=* source=* |stats sum(Tot) sum(in_prog) sum(submitted) sum(without_info) by Month |append [search index=* source=*  chart count by Month,with_info, |addtotals with_info] |append [search index=* source=*  chart count by Month,without_info, ] |untable Month,Category,Total |eval sort_field=case(Category="Tot",1,Category="in_prog",2,Category="Submitted",3,Category="without_info",4, Category="with_info",5) |sort sortfield |stats list(Category) as Category list(Total as Total by Month Result: Month            Category                     Total Feb-23            Tot                                  1000                            in_prog                           400                            Submitted                      600                             without_info                100                              with info                          500                              Occupation                   xxx                              Business                          xxx                               Null                                   xxx                                Others                             xxx From the above table, Occupation, Business are reasons derived from first append query and Null, Others are reasons derived from second append query and getting the append query results in the last. So, requirement is to display the without_info reasons next to that field and with_info reasons next to that field like below. Kindly help on sorting. Month            Category                     Total Feb-23            Tot                                  1000                            in_prog                           400                            Submitted                      600                             without_info                100                              Null                                  xxx                              Others                            xxx                              with info                          500                              Occupation                   xxx                              Business                          xxx                                 ... View more

Hi, I have a requirement to show the data based on period . Period is a dropdown having Today,Last Month & Last Quarter. Based on this filter panel should refresh .  My query is   <input type="dropdown" token="period_tkn"> <label>Period</label> <choice value="Today">Today</choice> <choice value="Last Month">Last Month</choice> <choice value="Last Quarter">Last Quarter</choice> <change> <condition value="Today"> <set token="er">"@d"</set> <set token="lt">now()</set> </condition> <condition value="Last Month"> <set token="er">"-1mon@mon"</set> <set token="lt">"@mon"</set> </condition> <condition value="Last Quarter"> <set token="er">"-3mon@mon"</set> <set token="lt">"@mon"</set> </condition> </change> <default>Today</default> <initialValue>Today</initialValue> </input> <table> <search> <query> index="index name" earliest=$er$  | where _time&lt;$lt$ AND _time&gt;relative_time(now(),$er$) | table infra_on_prem app_name platform_name _time | timechart limit=0 span=1h min(infra_on_prem) by platform_name | eval hour=strftime(_time,"%H"),hour=_time."#".hour.":00" | fields - _time | transpose 0 header_field=hour column_name=Platform | search Platform!="_span" | addtotals | eval Health=case(Total&gt;20,"100:::",Total&lt;1,"500:::",1=1,"300:::") | fields Platform Health * | `icon_indicator_stack` | fields - Total | transpose header_field=Platform | rex field=column "#(?&lt;hour&gt;.*)" | fields - column | transpose 0 header_field=hour column_name=Platform | rename "row "1 as Health   above query is for period="Today",  bolded query condition should change based on period filter . How can I do that . please help ... View more

Hi,  I want to hide label values from color cells. Based on some condition I given colors to the cells. Could someone please suggest how can I hide.  My current dashboard looks like this.   Expected result should be below   ... View more