I have a .csv with this format (this is a mock, just to give you an idea of the pattern) code, message, 1, "Not found", 2, "Internal error", 3, "Success",   My search allow to do a stats count by code, but not by message. What I need to do is return a table with the message and their count.   What I have so far is this query, but it returns a table of code by count, but I need message by count (and all category must be return, even those with count of zero):   the search | append [input lookup the csv file] |stats count by message I tried to play with fields and table, but I don't get the desired result. ... View more

I created a report, chose the accelerated report option and selected a 7 day time range. One of the panel is referring to the accelerated reports in the source code this way:       <row> <panel> <title>Accelerated report - test</title> <chart> <search id="BaseSearch" ref="NbOfEventsByEventType"> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> </chart> </panel> </row>         I made a panel below this one (an another one in a different dashboard to make sure there was no overlapping at all), with the search being the original query instead of a ref to the accelerated report. I then choose with a dropdown a time range of the last 7 days, which starts the update of both panels. Their searches are done at the same time (and thus display the chart at the same time).  Why does the ref to the accelerated reports has no effect on the performance of the panel? ... View more

I know with Splunk Dashboard Studio, conditional dashboard on dropdown choice aren't a possibility anymore, but is it possible to make the data source used by the dashboard conditional on the dropdown choice? That way, the dashboard could update dynamically. ... View more

I'm using Splunk to collect data about a collection of logs. A log returned from Splunk might look like: type: user creation transaction_id:1234 message=process started   Now, I want to count how many time an error has been linked to a transaction for user_creation, without knowing the transaction in advance. For example, this error might be a log:   type: error transaction_id:1234 message=process abord   I'm trying to use the rex command to isolate the transaction_id from the first log, then pipe it to find an error with the same transaction_id (to get a count of how many time an error has been associated with the process user creation), but my request seems to considered the first part of my request instead of just using the return to pipe to the second request. Here is what I have to far:         type = "user creation" | rex field= (?<transaction_id>[^-]+)"| search transaction_id=field message="process abord" | stats count as total_error_user_creation         Anyone could suggest some improvements to get the desired result?       ... View more

I'm asking this question because the only solutions I find for this problem are with the XML config file, while I only have access the JSON source code. I've looked at the recent Splunk documentation and there doesn't seem to exist a depends field for the visualisation configuration in the JSON source file. I'm trying to achieve the hiding of a specific panel if a dropdown choice isn't selected. Any help would be appreciated. Thanks. ... View more