for anyone that would like to see this work better, please consider voting for my idea here to support long query urls: https://ideas.splunk.com/ideas/EID-I-2569 to me, this is not uncommon at all.  it's a daily problem that I have to work around.   (I'm aware of the current solutions and already use them.) ... View more

Hi @livehybrid  I have tested and it seems working fine, although I got few issues like getting "Invalid array length" (I had to refresh browser to fix this), and table displaying all rows, instead of the number of row I specified (rows displayed = 10). The invalid array length is intermittent I have some follow-up questions just to make sure I understand. Thank you for your help. 1. a. Is there a limitation on the number of data source?      b. In my case,  I need to change like the following, correct?         "ds_index1" : "ds_index1"    (not "search1" : "ds_index1")          Can you explain what this mean: ds_index1" : "ds_index1"?     b. ds_xxxx is a random character created by Splunk, do you usually change it to readable format, or you just leave it?   (which one is best practice)     c. I also need to change $mysearch$ to $datasource_token$, correct? "viz_gE0iilm3": { "dataSources": { "primary": "ds_index1", "ds_index1": "ds_index1", "ds_index2": "ds_index2" }, "options": { "table": "> $datasource_token$" }, "type": "splunk.table" }  I was trying to choose the token when clicking single value. Please let me know if this is correct { "type": "splunk.singlevalue", "dataSources": { "primary": "ds_singlevalue1" }, "title": "Single Value 1", "eventHandlers": [ { "type": "drilldown.setToken", "options": { "tokens": [ { "token": "datasource_token", "value": "ds_index1" } ] } } ] } { "type": "splunk.singlevalue", "dataSources": { "primary": "ds_singlevalue2" }, "title": "Single Value 2", "eventHandlers": [ { "type": "drilldown.setToken", "options": { "tokens": [ { "token": "datasource_token", "value": "ds_index2" } ] } } ], }   Also, it doesn't load at the beginning, so I need to put the default token. Is this correct? "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "-24h@h", "earliest": "now" } } } }, "tokens": { "default": { "datasource_token": { "value": "ds_index1" } } }   ... View more

Hi @LearningGuy  If you are wanting to collect the data into a "summary" index then you do not have to use the method which appends the "summaryindex" command if this doesnt do what you need it to do. Instead just create your search as you did with the collect command (with output mode to HEC) and then schedule the report to run at the relevant interval.  Check out Manually configure a report to populate a summary index in the summary indexing docs. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @livehybrid  The windbag command worked just fine, but the collect command did not work. How do I use collect command in the Splunk report that appended |summaryindex automatically? Perhaps screenshot below will explain better. Thank you for your help I have a Splunk report that generates summary index daily The search query will be index=summary report=json_test When the report run daily, the search will be appended with "| summary index" command below: | windbag | head 1 | eval _raw="{\"name\":\"John Doe\",\"age\":30,\"address\":{\"street\":\"123 Main St\",\"city\":\"Anytown\",\"state\":\"CA\",\"zip\":\"12345\"},\"interests\":[\"reading\",\"hiking\",\"coding\"]}" | summaryindex spool=t uselb=t addtime=t index="summary" file="RMD[random characters].stash_new" name="json_test" marker="hostname=\"https://aa.test.com/\",report=\"json_test\"     ... View more

When you change the "Wrap results" option, it switches between this CSS .results-table .wrapped-results td, .results-table .wrapped-results th { white-space:pre-wrap; } and the "nowrap" value. Instead of "nowrap" it probably should use "preserve-spaces" one to be consistent. (or collapse in both cases). The mystery of collapsing spaces in the source view which I showed is still present however. ... View more

@yuanliu  Good to know.   If I may ask again, how did you know the cost associated for each SPL command? Thanks!! ... View more

Hi @inventsekar , If I uncheck open in new tab, it will not open a new tab and use the current tab. My goal is to open a new tab, but only one, not two.   Thank you   ... View more

I can make it wider by reducing the time frame, but last 7 days is usually the default. Are you sure we can't do it on the CSS part? Thanks ... View more

All them commands have some limitations. Some more explicitly configured, some implicitly derived from operating system limits. Anyway. Simply replacing eventstats with streamstats obviously won't do. With streamstats you'd need some copying over values and I don't have a ready solution. I have a hunch it's possible but will be ugly and possibly even less efficient than eventstats based one. ... View more

Yep you are right, I wasn't thinking about that. We can still use the following, | streamstats count as Rank | delta Score as Diff | eval Rank=if(Diff=0,null,Rank) | filldown | fields - Diff ... View more

1) You can easily test out using emulation that the right-side values override left-side value. 2) I do not usually use keepempty.  If you have reproducible evidence that dedup does not behave as documented, maybe engage support. ... View more

It doesn't have to be current search time. It might be the time from summarized values. A relatively good example would be tracing emails from some email systems. They tend to send multiple events during a single message pass and you have to combine all those message to have a full picture of the message sender, recipients, action taken, scan results and so on. With an ad-hoc search you'd probably have to use transaction command which doesn't play nice with bigger data sets. But you can run a summarizing search every 10 or 30 minutes that will correlate all emails processed during given time window and write that summarized info into an index. I  such case you'd probably want one of the message's times (most probably an initial submission time) as a summary event's _time. ... View more

Hello @yuanliu  Can you please help on my other question? This is more closer to the real data and it has complexity since it's involving multiple fields https://community.splunk.com/t5/Splunk-Search/How-do-I-quot-Left-join-quot-by-appending-CSV-to-an-index-in/m-p/696908#M236826 I think I solved this, but I wonder if there is a way to do it without merging the string and mvexpand I appreciate your help.  Thank you so much ... View more

It's a bit older but it seems to be some confusion around: Your second example is completely different from the first one as you use double quotes, i.e.   | eval var_type = typeof("num")   "num" is a literal string which has nothing to do with your variable! Take care about using double quotes (for strings), single quotes (for field names, e.g. containing spaces (for whatever reason... 😉 )) or no quotes at all (also for field names). Besides that to me it seems that this `tostring` function is buggy. If I convert any number using `tostring(number)` that should(!) become a string, regardless of any "format"-argument. And the "typeof()" function should then return "String" for this string. ... View more

Hi @LearningGuy , does the query return any results when you run it on the DB directly? select * from host_ip   Also noticed you have "os_type" in your query vs "ostype" in your lookup. Could be the issue 🙂    ... View more

Something like index=your_index earliest=-1d@d latest=now | eval day=if(_time>=relative_time(now(), "@d"), "today", "yesterday") | eval fieldcount = 0 | foreach * [ eval fieldcount=fieldcount+1 ] | stats count max(fieldcount) as fieldcount by day will give you event count and field count per day, but not totally sure if the foreach will count correctly for fieldcount and it will very much depend on your data whether this is suitable or not. This assumes you ingest the data both yesterday and today. But there are many open area  - what's the relevance of field order - there's not concept of field order in Splunk - what if new rows are added or removed 'today', what do you want to see     ... View more

Yes, you can just say  | eval behindfirewall=max(behindfirewall) however, I am not sure if that will totally work, because if something in my example is attached to LoadBalancer-B, then it will assume it's behind the firewall, so not totally sure if my suggestion is valid ... View more

Correct, the match statement will break things because all events will all match the match key ... View more

You are right, partialcode is the second field - mvfilter has a few use cases, but I've generally found I'm always wanting to relate it to some other field, so when mvmap came along in Splunk 8, I almost never use mvfilter now - even when I could. ... View more

This requires some discovery work from your organisation or network engineer, Splunk can't magically work out a network's connections unless you have data that states so.  An option might be to ingest the data from these components and ensure the source_ip and destination_ip data is ingested and that may help you see the traffic flow  and you can use a Splunk app with the discovery work.  like https://splunkbase.splunk.com/app/6876    Or you might want to look at, other third-party tools for that and perhaps then create a look up file that contains this information, so its then presented to Splunk and to help you with your use case.       ... View more

Hi @LearningGuy, I understand that you're not an admin, but roles is the only way to restrict accesses in Splunk. So, ask to your administrators to creare different roles to enable your dashboards and knowledhe objects ony to selected (by roles) users. Ciao. Giuseppe ... View more

Hi @LearningGuy , you can save your static data: in a csv lookup, in a kv-store lookup, in an Index, if you need time updates on your data. The more frequent approach is to use a csv lookup. Ciao. Giuseppe ... View more

Hi @bowesmana  Thanks a lot!!  You rock!!   I did make attempt on using evenstats, but then It didn't work because of  if condition didn't work.  It turns out I had to use a match command.    I appreciate your help. ... View more