I tried below code but it not working. can any one let me know what is wrong here: <form version="1.1" theme="light"> <label>HTMD Dashboard</label> <fieldset submitButton="false"> <input type="time" token="timepicker"> <label>TimeRange</label> <default> <earliest>-15m@m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="host"> <label>Env wise hosts</label> <choice value="appdev1host","logdev1host","cordev1host">DEV1</choice> <choice value="appdev2host","logdev2host","cordev2host">DEV2</choice> <choice value="appdev3host","logdev3host","cordev3host">DEV3</choice> <choice value="appdev4host","logdev4host","cordev4host">DEV4</choice> <choice value="appsit1host","logsit1host","corsit1host">SIT1</choice> <choice value="appsit2host","logsit2host","corsit2host">SIT2</choice> <choice value="appsit3host","logsit3host","corsit3host">SIT3</choice> <choice value="appsit4host","logsit4host","corsit4host">SIT4</choice> </fieldset> <row> <panel> <table> <title>Incoming Count &amp; Total Count</title> <search> <query>index=test-index source=application.logs $host$ "Incoming count" |stats count by "Incoming count" |appendcols index=test-index source=application.logs $host$ "Total count" |stats count by "Total count" |table "Incoming count" "Total count" </query> <earliest>timepicker.earliest</earliest> <latest>timepicker.latest</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentageRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> <form> ... View more

Can anyone help on this pls   ... View more

Can any one help on this ... View more

I am new to dashboards building Can I get the xml code pls ... View more

Hi @PickleRick , sorry it was a typo erro Are you sure you wanted old value of get as old_put? --- sorry it was a typo error   Also, you can just do your condition as | where command to find only those matching results. Then you'd trigger alert only if you had any results at all.-- soory I used where condition but it's not working |Where getperct>50 |Where putperct>10 |Where deleteperct>80 I want to receive error even if any one condition match, but I am not getting Can u pls help   ... View more

Hi @PickleRick , i tried the query u suggested its working as expected. please find the below query. but my concern is we want to use this query as an alert, where condition as getperct >50  , putperct >10 , deleteperct >80 trigger alert but when i give this 3 conditions its not working as expected, here alert should trigger even if one condition meets. |mstats sum(Transactions) as Transaction_count where index=metrics-logs application=login services IN(get, put, delete) span=1h by services |timechart span=1h values(Transaction_count) by services |autoregress get as old_get |autoregress get as old_put |autoregress get as old_delete |eval getperct=round(old_get/get*100,2) |eval putperct=round(old_put/put*100,2) |eval deleteperct=round(old_delete/delete*100,2) |table getperct putperct deleteperct   ... View more

Thank you all ... View more

application_codes 0 1206 18 1729   i want to see only the above application codes, that is from csv file only. ... View more

|mstats sum(faliure.count) as Failed where index=metric-logs by service application_codes |lookup app.csv application_codes when i run the above query i am getting application_codes from mstats query not from csv file ... View more

It’s not about security. We have option to create alerts in  splunk. So we have action items as alert trigger, email alert, auto cut etc auto cut means creating service now incidents from Splunk to service now  so for email alert we have schedule_search capability likewise what capability we need to give to create auto to create service now incident from Splunk to service now.     ... View more

Thank you @ITWhisperer  ... View more

Hi @ITWhisperer , Thank you it worked, but when there are no counts it's showing as empty values in table. I used fillnull value=0, but it's not working. How to do this??? ... View more

Hi @PickleRick , Thank you so much i got the query what i was expecting. But i have some changes here can you help me on that Standby Column i don't have any individual searches  like url and cleared_log i just need standby count as Toatal _Messages  - Errro_count  should be displyed on the table. Rest all will be the same. |tstats count as Total_Messages where index=app-logs TERM(Request) TERM(received) TERM(from) TERM(all) TERM(applications)   ... View more

Hi @PickleRick , i tried the below query but this is showing as normal table, i am not getting in the way i showed in the image. I just want to know whether that is doable in Splunk ??? if yes how can i tweak my query???? |tstats count  as Total_Messages where index=app-logs TERM(Request) TERM(received)  TERM(from) TERM(all) TERM(applications)  |appendcols [|tstats count  as App_logs where  index=app-logs TERM(Application) TERM(logs) TERM(received)] |appendcols [|tstats count  as Exception_logs where index=app-logs  TERM(Exception)  TERM(logs)  TERM(received) |appendcols [|tstats count  as Canceled_logs where  index=app-logs  TERM(unpassed) TERM( logs)  TERM(received)] |appendcols [|tstats count  as 401_mess_logs where  index=app-logs  TERM(401) TERM( error)  TERM(message)] |appendcols [|tstats count  as url where  index=app-logs TERM(url) TERM( info)  TERM(staged)] |appendcols [|tstats count  as cleared_log where  index=app-logs  TERM(Filtered)  TERM(logs)  TERM(arranged)] |table * ... View more

Hi @richgalloway  Thank you for the inputs I want to go with the modify my alert query by using look up file  Like I want to add the holidays dates in the Excel sheet and will upload to splunk But I am not understanding how to frame a query with that now, below is my query Index=error-logs  status=401 |Stats count    Can you please help  ... View more