i have three drop down lists. one with component(A,B,C,D). other dropdown with severity(Info,Warning) and colour dropdown list. If i select A,Info - colour dropdownlsit should be shown if i select B,Info - colour dropdownlist should not be shown. how can i achieve this? ... View more

If attr.error exist then Error will be attr.error. If attr.error not exist and attr.error.errmsg exist then Error would be attr.error.errmsg.  i have tried the below code. only one case works other case fails. please advise eval Error=case(NOT attr.error =="*", 'attr.error',NOT attr.error.errmsg =="*", 'attr.error.errmsg')   ... View more

the below are two different drop down list as we have different host and index. Based on the index selection i do set/unset -show/hide - can we make as single query with single drop down list  based on the value of the dropdownlist which is visible?     1) index=aaa (source="/log/test.log" $host1$ ) | rex field=name "(?<DB>[^\.]*)" | rename DB AS "Database" | table Database | dedup Database 2) index=bbb (source="/log/test.log" $host2$ ) | rex field=name "(?<DB>[^\.]*)" | rename DB AS "Database" | table Database | dedup Database      if ddl1 is visible fetch the value and pass to $host1$ to the  query if ddl2 is visible fetch the value and pass $host2$ to the query or based on the drop down list value selected can we set value and pass to query to avoid multiple queries for only differnt host/index? ... View more

Please help me on the below items: #1) | chart count(WriteType) over Collection by WriteType | sort Collection for above query  can we add conditon as below:  (i am facing issue here) | chart count(WriteType) over Collection by WriteType |where c in("test","qa") | sort Collection  #2): can we add one more field after WriteType as below: | chart count(WriteType) over Collection by WriteType, c |where c in("test","qa") ... View more

  <input type="dropdown" token="envtoken"> <label>env</label> <fieldForLabel>label</fieldForLabel> <fieldForValue>host</fieldForValue> <search> <query> index=aaa (source="/var/log/testd.log") |stats count by host | eval label=case(match(host, ".*tv*."), "Test", match(host, ".*qv*."), "QA", match(host, ".*pv*."), "Prod")| dedup label</query> <earliest>-15m</earliest> <latest>now</latest> </search> </input>   dropdownlist binding with TEST, QA and PROD In QA and prod have 3 host. If i select QA from dropdown list , will the search includes from all the three hosts? could you plase confirm ... View more

what is the error in the below query which i am using to populate in drop down list index=aaa(source="/var/log/testd.log") |stats count by host | eval env=case(match(host, "*10qe*"), "Test", match(host, "*10qe*"), "QA", match(host, "*10qe*"), "Prod" )   ... View more

do we have splunk attribute to fetch index  we are passing index in splunk query. with only log file do we have any splunk attribute to fetch index??? index = aaa index = bbb like we have for host index=aaa(source="/var/log/tes1.log" |stats count by host   ... View more

i am reading teh host from log file and have query to return all the host.    index=aaa source="/var/log/test1.log"|stats count by host    can we include teh step to categories test/qa/prod in the drop down list  from the list of host returned in the query itself?(using wildcard if host has t then test /if host has q -qa server, etc? but for now i am using static options  test - testhost qa - qahost prod - prodhost ... View more

i am using below to load colur in drop downlist . Data loading propertly. but it always shows - Could not create search - No Search query provided   <input type="dropdown" token="color" depends="$color_dropdown_token$" searchWhenChanged="false"> <label>Color</label> <choice value="*">All</choice> <choice value="Green">Green</choice> <choice value="Orange">Orange</choice> <choice value="Red">Red</choice> <initialValue>*</initialValue> <search> <query/> <earliest>$Time.earliest$</earliest> <latest>$Time.latest$</latest> </search> </input>       ... View more

Based on drop down list value how to change search string in each panel eg  for panel to load the search string will vary as below: index=test (source="/test/log/path/test1.log" $param1$ c="$param2$" $dropdownlistvalue1$ $dropdownlistvalue1$) As log path is different all my params vary. so how can i change index based of drop down list value? ... View more

I am showing index info(the following info) from mongodb log to splunk. namespace : tmp.agg_out.a35455454-f452-343434-b3eb-32630f67312b msg : Index build: done building   What does it mean( namespace and msg) ?    ... View more