Sure ! Thanks. Let me know how we can do this ... View more

So I have a schedule search running on DS to summery index which pulls all the info from two DS. Index=summery source=sc. which has the serveclass, forwarder, deplyment server, deployementappname info.    ... View more

This is what i have so far..     <form version="1.1" theme="light"> <label>AutoSelectMulti</label> <init> <set token="pre_indexes"></set> </init> <fieldset submitButton="true" autoRun="false"> <input type="multiselect" token="server" searchWhenChanged="true"> <label>Server</label> <fieldForLabel>dns</fieldForLabel> <fieldForValue>dns</fieldForValue> <search> <query>index=summary source=sc dns=eaz* | dedup dns | table dns</query> </search> <delimiter> ,</delimiter> </input> <input type="multiselect" token="ds1"> <label>DS1</label> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> <search> <query>index=summary source=sc dns=eaz* | search dns IN ($server$) | dedup host | table host</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <delimiter> ,</delimiter> </input> </fieldset> <row> <panel> <table> <title>EAST DS</title> <search> <query>| makeresults | eval ServerclassInfo="[serverClass:serverclass] whitelist.0 = server1 whitelist.1 = server2 Server List which needs to add under whitelist = $server$ EAST Deployment Server : $ds$" | fields ServerclassInfo | fields - _time</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <table> <title>West DS</title> <search> <query>| makeresults | eval ServerclassInfo="[serverClass:serverclass] whitelist.0 = server1 whitelist.1 = server2 Server List which needs to add under whitelist = $server$ WEST Deployment Server : $ds$" | fields ServerclassInfo | fields - _time</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>       What Ultimately I'm looking is if i select 5 servers which are belongs to 3 goes to US and 2 go to UK, I want it to have two panels. The US panel shows the 3 servers with what DS. Whereas other panel shows the identical thing, but only the 2 servers . That's okay if we don't have that Deployment Server input too.     ... View more

Basically what I'm looking for is, I have a Multi Select Server input, if i select 5 servers which are belongs to 3 goes to US and 2 go to UK, I want it to have two panels. The US panel shows the clients (3 total). Whereas UK panel shows the identical thing, but only the 2 clients  ... View more

Basically what I'm looking for is, I have a Multi Select Server input, if i select 5 servers which are belongs to 3 goes to US and 2 go to UK, I want it to have two panels. The US panel shows the clients (3 total). Whereas UK panel shows the identical thing, but only the 2 clients  How do I achieve this ? ... View more

I tried those but if i select multiple index the sourcetype multi select is not working.  ... View more

<form version="1.1" theme="light"> <label>two DS panels</label> <fieldset submitButton="false"> <input type="multiselect" token="server"> <label>Server</label> <choice value="a">A</choice> <choice value="b">B</choice> <choice value="c">C</choice> <choice value="d">D</choice> </input> </fieldset> <row> <panel> <table> <title>US DS</title> <search> <query>| makeresults format=csv data="Host, DS A, US-DS B, US-DS" | table Host DS</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <table> <title>UK DS</title> <search> <query>| makeresults format=csv data="Host, DS C, UK-DS D, UK-DS" | table Host DS</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> ... View more

Hello @gcusello  Can you please share the same ? I have a similar use case. ... View more

@gcusello   @PickleRick Thank you for the reply. We are sending data from application console to splunk through syslog and they define to send only error logs from their console. So If I schedule to run at 15 mins frequency and 15 time range. Will there be any chance of missing events to be triggered. Our intention to get alert when ever there is new event and shouldn't repeat the same event in the alert.      ... View more

Hello @Sukisen1981 , Your Query helped me !! Thank you.  But I had a small question. I have a similar Query which I wanted to show By Month  CLIENT Fails Passes Total MonthClientA 10 1 11 jan ClientB 0 1 1  mar CliectC     11    9 20 feb So I had tried your query and i got the below results...  I used this for month | eval Month=strftime(_time, "%B") But I wanted to get the latest month first so on like mar feb jan  CLIENT Fails Passes Total MAR    JAN   FEBClientA 10 1 11 0 5 0 ClientB 0 1 1  2 11 0 CliectC     11    9 20 0       0    19   ... View more

Apologies, didn't realized it got posted in "Getting Data in". Well, I have a data already in Splunk and trying to create a custom alert to trigger an email to DL, when the condition met. But I don't have an env field in either DEV & PROD data. When I create alert with subject DEV $name$. the admin team deploying the same code to PROD saying that they wanted to keep the same code across all env.  I'm getting the alert as "DEV myAlert" in PROD. So checking if there is a way to implement this just by including the token ??  ... View more

I had tried the way you told but I got the same error as above. These are the last two values of my csv file in notepad + +    Does every line should have CRLF ?     ... View more

Basically we export from Airtable as a csv.  I changed in notepad++,  view->show symbols-> show all characters, and  edit->EOL Conversion->Windows Format. but that doesn't work. ... View more

@bowesmana  Thank you !!! I had modified the query and and achieved what I'm looking for..... | foreach *_spend_limit [ eval type=if(match("<<MATCHSEG1>>","old"), "Pre", "Post"), MV=mvappend(mvzip(mvzip('<<MATCHSEG1>>_limit', '<<FIELD>>', ";"), type, ";"), MV) ] | fields market MV | mvexpand MV | rex field=MV "(?<limit>[^\;]*);(?<spend>[^\;]*);(?<type>.*)" | eval market=market." ".type | fields market limit spend   ... View more

@ITWhisperer @bowesmana  Thanks for the code, It didn't worked with my case.  Sorry if it's confusing... I have a dashboard table with below.  If i click value in "Organization" or URL, it has to go specific url  example: when i click google it has to direct to the url "  https://air222.com/recxGlfW9picLnjwj" in new tab.  or if that doesn't work at least if i click url it has to go that url in new tab Name     Organization                      URL                                                                                                              Bob            splunk                         https://air222.com/6FBPUQ3Di0FC3T                                            Matt           google                        https://air222.com/recxGlfW9picLnjwj                                     smith          facebook                  https://air222.com/recRRoUIFOMxSmjRf                                           ... View more