I have a splunk query which returns these 2 set of events. 1) domain_name="abc" microservice_name="test" message=[WEB] ERROR RESPONSE : NO_DOCUMENTS_FOUND -> 2) domain_name="abc" microservice_name="test" message=[WEB] ERROR RESPONSE : GUID_EXPIRED my vtest.csv lookup looks like below: domain_name; microservice_name; message abc; test;  NO_DOCUMENTS_FOUND I am using the below query to exclude 1st set of events. I have created WILDCARD(message) match_type  | lookup vtest message OUTPUT message as exclude_message | search NOT (exclude_message="*") But it is not working, and I don't get any fields in "exclude_message" as well. kindly help.    ... View more

I want to customize the Splunk studio dashboard in such a way that it shows last 7 days (each day) separately.  The requirement is only one dashboard. not globally.  Today's date is 2nd May 2024. Now I want to showcase historical day here for last 7 days separately. I want options like below in the presets so that if they select that day then users would see that day's data. The historical dates should change dynamically. 1st May 31st April 30th April 29th April 28th April 27th April 26th April ... View more

I have a field called environment which has values like dev,prod,uat,sit. Now I want to create a new_field which all the field values of environment field. Example: (4 field values) environment  dev prod uat sit After query: ( 1 field value, separated by any string) merge_environment= dev | prod | uat | sit How to achieve this? ... View more