Hello @richgalloway  Yes, I appended that to my instance URL and got that bad request. ... View more

Hello @richgalloway  I created Splunk account to the user and gave URL en-US/account/login?loginType=splunk but getting Bad Request     ... View more

Hi @Chambito17  use can use the now() function to get the current timestamp as below. | search Last_Day_of_Work==strftime(now(),"%Y-%m-%d") used strftime to get the desired format. If this helps, an upvote would be appreciated. Thanks, Manasa ... View more

you can also use accum command as an alternate to streamstats |accum HourlyClients as total If this answer helps, an upvote would be appreciated. ... View more

Hi @Questioner  First using an eval create a day_type field with the conditions and next you can use where command to filter for the day_type you need. | eval day_type=case(time_type="ALL" AND year<=2020,"day",time_type = "ALL" AND year>2020,"day night",1=1,"morning") | where like(day_type,"%day%")  You can pass the token in where command   If this answer helps, an upvote would be appreciated. ... View more

To use this dropdown selected value in dashboard query, pass the token- $tok_name$ to the SPL. example: |where abc="$tok_name$" ... View more

Hello @splunkuser320  You have to give the lookup and table the required field you want to use as a dropdown. In below example code, sample is the name of lookup and abc is the output field I wanted to display. So, you will get the values from abc field in the dropdown list for selection <input type="multiselect" token="tok_name" searchWhenChanged="true"> <label>Dropdown</label> <fieldForLabel>abc</fieldForLabel> <fieldForValue>abc</fieldForValue> <search> <query>|inputlookup sample |table abc</query> <earliest>0</earliest> <latest></latest> </search> </input>   If this helps you, an upvote would be appreciated.     ... View more

Hello @Renunaren  try using | mvexpand name ... View more

Try again by disabling the usecolors option ... View more

Hello @smanojkumar  Are you fetching the range field in table output fields? If not, give both soc_check and range fields in table command. If this helps, karma would be appreciated. Thanks, Manasa ... View more

Hi @hughkelley  Did you find a way to attach CSV using sendresults? ... View more

Hello @scelikok  By default the sendresults command sends the results as inline CSS in email body. Is there a way to send the results as csv attachment? Thanks, Manasa   ... View more

Hello @splunkxorsplunk  you can search by using  |inputcsv mycsv.csv If you have saved data using outputlookup then use inputlookup to access that data in search. If this helps, karma would be appreciated. Thanks, Manasa ... View more

Hello @chandankr  Try using sort after stats. |sort orden Thanks Manasa ... View more

Hello @chandankr  The efficient way is to create a new field to get the month number from _time field as below |strftime month_num=strftime(_time,"%m") | stats count by Month,month_num,Active_UEs,Idle_UEs |sort month_num If this helps, karma would be appreciated. Thanks, Manasa ... View more

Hi @Julia1231  What is the value you set for All in the dropdown? To get all data set the value as "*" <choice value="*">All</choice> Thanks, Manasa ... View more

Hello @jhilton90  You can also try using stats command. index=keycloak | sort time | stats first(_time) as first_login by username | eval time=strftime(first_login,"%Y-%m-%d %H:%M:%S") If this helps, karma would be appreciated. Thanks, Manasa  ... View more

Hi @sasank  According to the documentation, it is possible. Have a look at the below link. https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Transaction#Filter_string_options  If this helps, karma would be appreciated. Thanks, Manasa ... View more

Hello @jmagaling  you can hide top right corner export button from a Dashboard with this option hideEdit="true" If this helps, karma would be appreciated. Thanks, Manasa ... View more

Hello @ethanxu1130  I suggest you to first calculate the percentage fields you need in the result. Next you can sort the results in descending order and then use |head 50 to get the top 50 results. Thanks, Manasa ... View more

Hello @villnooB  After rename, add the below logic | eventstats count as multiple by DateStamp Name | eval valid=if(multiple>1 AND Location="Home","NO","YES") | search valid="YES" |fields - count multiple valid If this helps, karma would be appreciated. Thanks, Manasa ... View more