Hi All, using below query but not getting complete output. If there is no data present  for Response time for particular days but values present for Fordresponsetime for same days  it is not showing up in the table   |tstats avg(TotalResponseTime) as ResponseTime avg(FordResponseTime) as Fordresponsetime where index=app-index NOT TERM(timeout) by _time   QueryOutput: _time ResponseTime Fordresponsetime 2024-01-01 12.67 34.00 2024-01-02 34.94 56.89 2024-01-03 24.78 52.70 2024-01-04 34.70 42.87 ExpectedOutput: _time ResponseTime Fordresponsetime 2024-01-01 12.67 34.00 2024-01-02 34.94 56.89 2024-01-03 24.78 52.70 2024-01-04 34.70 42.87 2024-01-05 0 33.56 2024-01-06 0 23.77 2024-01-07 0 34.78   ... View more

We are seeing a very different issue, 1.As shown  in a table when there are no logs for any one of the List rows are returning null values. eg: App2 and App3 column. used |fillnull value=0 its not working. 2. If we have data for any one of the Service(eg: service=fast, App4 column), it showing the count and rest of the rows are filling up with zero. how to fill the null values as zero even when there are no single count for the columns?? Query:  index=testindex source=sourcelogs |rex field= _raw "service :\s(?<Service>\w+)" | rex field= _raw "(?<List>Received main message|Application published to service|List status are in process|Application process running successfully)" |chart count over Service by List |rename "Received main message" as App1 "Application published to service" as App2 "List status are in process" as App3 "Application process running successfully" as App4 |table App1 App2 App3 App4 Result of the query: Service App1 App2 App3 App4 Token 10     0 Modern 40     0 Surb 3     0 Fast 12     4 Normal 4     0 Forward 6     0 Medium 7     0 ... View more

|tstats count where index=app-idx host="*abfd*" sourcetype=app-source-logs by host This is my alert query, i want to modify the query so that i wont receive alert at certain times. For example: Every month like on 10 , 18, 25 and during 8am to 11am i don't want to get the alerts. Rest all for other days its should work as normal. how can i do it??? ... View more

|mstats avg(os.mem.utilized) as Memory_Used where index=metricsidx host=host1 OR host=host2 span=1d |table Memory_Used |foreach avg* [|eval <<FIELD>>=round('<<FIELD>>',2)] We have a dashboard where we are calculating memory for different hosts.   For example, is the above query. So, we don't want to repeat this query for all panels. instead, i want to create a base search with all host like below query. But it's not working. Can anyone help on this: Base Search: |mstats avg(os.mem.utilized) as Memory_Used where index=metricsidx host IN(host1, host2, host3,host4, host5, host6, host7, host8, host9, host10) by host span=1d |foreach avg* [|eval <<FIELD>>=round('<<FIELD>>',2)] Sub search: |table Memory_Used ... View more

index=abc sourcetype=app_logs |stats count as events by host, host_ip |where events >0  When i schedule this as alert  i am receiving alert only when there is no data in all the hosts, but  i need to get an alert if there is no data from any ONE host as well how can i do this??? ... View more

I have  splunk base app called jira issue collector, inputs has been configured, and we are receiving data from jira into splunk. But i want to know from where it is taking data, like any rest api is mentioned for it, if so how can i check what api they used for this data to come into splunk.  how can i check that in splunk. ... View more