Hi @nithys  As @bowesmana mentioned - since you dont have many variances then you should specifically list them in an "IN" within your search. Then do any evals to align your different events, such as using COALESCE to map different field names into a common fieldname (e.g | eval responseTime=COALESCE(responseTime, response_time)) 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Thank you @yuanliu It worked ... View more

I tried the above dashboard code . At the first screenshot...no dropdown is selected     Second screenshot :test envis selected and the query started running query for "Unique User/Unique Client)  The "np-" value to index source="/aws/lambda/g-lambda-au-test"  "test" is substituted to the query already without selecting data Entity dropdown or time it autoran ... View more

Thank you for your feedback. I appreciate the time and expertise you and others volunteer here. My intention wasn’t to exclude anyone.I’ll keep your advice in mind for future posts to ensure all contributions are valued equally.  And will repost without tagging anyone ... View more

@ITWhisperer @catdadof3  yes want to set $entityTokenFirst$ to * when the user selects "ALL" in the dropdown,  observing that search queries are being executed automatically (auto-run) whenever you switch dropdown values or filters, without explicitly hitting the submit button.  looking for an alternative way to achieve this behavior without triggering auto-run searches. HOw to apply multiple condition only when they hit a submit <change> <condition value="ALL"> <set token="entityTokenFirst">*</set> </condition> <condition> <!-- Split the value and set tokens for both parts --> <set token="entityLabel">$label$</set> <eval token="searchName">mvindex(split($value$, ","),1)</eval> <eval token="entityTokenFirst">mvindex(split($value$, ","),0)</eval> </condition> </change> below dashboard is working only when i hit submit button,no condition is being used below <form> <label>stats Clone metrics</label> <fieldset submitButton="true"> <input type="dropdown" token="indexToken1" searchWhenChanged="false"> <label>Environment</label> <choice value="prod,prod">PROD</choice> <choice value="np,test">TEST</choice> <change> <eval token="stageToken">mvindex(split($value$,","),1)</eval> <eval token="indexToken">mvindex(split($value$,","),0)</eval> </change> <default>np,test</default> </input> <input type="dropdown" token="entityToken" searchWhenChanged="false"> <label>Data Entity</label> <choice value="target">Target </choice> <choice value="product">Product</choice> <choice value="*">ALL</choice> </input> <input type="time" token="timeToken" searchWhenChanged="false"> <label>Time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> </form>    ... View more

Hi @PickleRick  @gcusello  In below dashboard I want To fetch the DistinctAdminUserCount for a specific Name (e.g., "-target") DistinctAdminUserCount  Name -target 3 Name -product 2 Problem 1:with below query it is working if i manually add searchName either test or prod.But if want to work from dashboard the search is not substituting for entityTokennsp Problem2:search Name can be  test or prod based on env selection that also need to be fixed if it is test,search Name="*-test-target" if it is pro,search Name="*-prod-target" Appraoch: Use the entityToken token to store the dropdown value (e.g., target). Dynamically derive the required values (target or *-test-targetfob) directly in the queries using the eval and case commands. entityToken is correctly substituted in dashboard entityTokennsp is not substituted under below query Query used in Dashboard: <query>index="np" source="**" sourcetype="n" | spath path=test.nsp3s{} output=nsp3s | mvexpand nsp3s | spath input=nsp3s path=Name output=Name | spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount | search Name=$entityTokennsp$ | sort -_time | head 1 | fields DistinctAdminUserCount</query> splunk query working in search separately if i given name manually: index="np" source="**" sourcetype="n" | spath path=test.nsp3s{} output=nsp3s | mvexpand nsp3s | spath input=nsp3s path=Name output=Name | spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount | search Name="-test-target" | sort -_time | head 1 | fields DistinctAdminUserCount Das <form version="1.1" theme="dark"> <label>Stats </label> <fieldset submitButton="true"> <input type="dropdown" token="indexToken1" searchWhenChanged="false"> <label>Environment</label> <choice value="prod,prod">PROD</choice> <choice value="np,test">TEST</choice> <change> <eval token="stageToken">mvindex(split($value$,","),1)</eval> <eval token="indexToken">mvindex(split($value$,","),0)</eval> </change> <default>np,test</default> </input> <input type="dropdown" token="entityToken" searchWhenChanged="false"> <label>Data Entity</label> <choice value="targetFO">Target FO</choice> <choice value="productFO">Product FO</choice> <change> <eval token="entityToken">case( $value$=="targetFO", "Target", $value$=="productFO", "Product", true(), "" )</eval> <!-- Token for the second query --> <eval token="entityTokennsp">case( "entityToken"=="targetFO", "test-target", "entityToken"=="productFO", "test-product", true(), "" )</eval> </change> </input> </fieldset> <row> <panel> <single> <title>Distinct Consumer Coun</title> <search> <query>index="np" source="**" sourcetype="n" | spath path=test.nsp3s{} output=nsp3s | mvexpand nsp3s | spath input=nsp3s path=Name output=Name | spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount | search Name=$entityTokennsp$ | sort -_time | head 1 | fields DistinctAdminUserCount</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> <row> <panel> <title>Total Request :</title> <single> <search> <query>index=np source IN ("*-$stageToken$-$entityToken$") msg="data:invoke" | stats count</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> <refresh>60m</refresh> <refreshType>delay</refreshType> </search> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="height">317</option> <option name="rangeColors">["0xcba700","0xdc4e41"]</option> <option name="rangeValues">[200]</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.size">large</option> <option name="unitPosition">after</option> <option name="useColors">1</option> </single> </panel> </row> </form>   ... View more

Is it possible that your raw event is noncompliant?  This is what your illustrated event format suggests.  If that format is exact, Splunk cannot extract anything other than "name" field.  There are two elements that violates JSON syntax.  The mock event contains two bare strings that are not key-value pairs, as pointed out as "MISSING-KEY1" and "MISSING-KEY2" in the following pretty-print of a "corrected" conformant JSON object: { "name": "", "MISSING-KEY1": "", "pid": 8, "level": 50, "error": { "message": "Request failed with status code 500", "name": "AxiosError", "stack": "AxiosError: Request failed with status code 500\n )", "config": { "transitional": { "silentJSONParsing": true, "forcedJSONParsing": true, "clarifyTimeoutError": false }, "adapter": [ "xhr", "http" ], "transformRequest": [ null ], "transformResponse": [ null ], "timeout": 0, "xsrfCookieName": "X", "xsrfHeaderName": "X-", "maxContentLength": -1, "maxBodyLength": -1, "env": {}, "headers": { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json", "Authorization": "", "User-Agent": "", "Accept-Encoding": "gzip, compress, deflate, br" }, "method": "get", "MISSING-KEY2": "" }, "code": "ERR_BAD_RESPONSE", "status": 500 }, "eventAttributes": { "Identifier": 2025732, "VersionNumber": "A.43" }, "msg": "msg:data:error", "time": ":48:38.213Z", "v": 0 } If your actual events are non-compliant, Splunk will not have a value for error.status. By the way,  the command "eval status=case(like(error.status, "4%"), "4xx", like(error.status, "5%"), "5xx")" is wasted as your stats command does not use the field status. ... View more

I still am completely confused.  Why don't you forget XML and just describe the UI controls, and give some examles of what inputs you would use and how it would effect the searches produced. ... View more

Hi @nithys , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

yes it worked .Thanks ... View more

Add it outside the fieldset grouping. ... View more

Currently without hitting the submit button,when i load the dashboard it get result  of the below usage statistics of the selected test environment  Query used first checks  if  env is selected "test"  then use "index" as "np-ap" and set "stageToken" as "test"  I want  the submit button to work and get the result only after the env  ,data entity  and date is selected and hit the submit button index="np-ap" AND source="--a-test" <query>index=$indexToken$ AND source="-a-$stageToken$"   <form version="1.1" theme="dark"> <label> stats</label> <fieldset submitButton="true"> <input type="dropdown" token="indexToken1"> <label>Environment</label> <choice value="pd-ap,prod">PROD</choice> <choice value="np-ap,test">TEST</choice> <change> <eval token="stageToken">mvindex(split($value$,","),1)</eval> <eval token="indexToken">mvindex(split($value$,","),0)</eval> </change> </input> <input type="dropdown" token="entityToken"> <label>Data Entity</label> <choice value="aa">aa</choice> <choice value="bb">bb</choice> <choice value="cc">cc</choice> <choice value="dd">dd</choice> <choice value="ee">ee</choice> <choice value="ff">ff</choice> <default>aa</default> </input> <input type="time" token="timeToken" searchWhenChanged="false"> <label>Time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <html id="APIStats"> <style> #user{ text-align:center; color:#BFFF00; } </style> <h2 id="user">API</h2> </html> </panel> </row> <row> <panel> <table> <title>Unique</title> <search> <query>index=$indexToken$ AND source="-a-$stageToken$" | stats count </query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> ... View more

| spath test.nsps{} output=nsps | mvexpand nsps | spath input=nsps Name output=Name | spath input=nsps ReadOnlyConsumerNames{} output=ReadOnlyConsumerNames | table Name ReadOnlyConsumerNames ... View more

Hi @nithys, this is a different question even if on the same search and you can find many answers to this question in Community ans, as always I hint to open a new question in Community to have a faster and probably better answer. Anyway, you can assign fixed colours to you values by GUI or on the dashboard code: by GUI opening you dashboard in Edit mode and clicking on the pencil on the right top of the panel, then choosing colours. by code customizing for your requirements this code: <option name="charting.fieldColors">{"Total":"Total",0x333333,"400":0xd93f3c,"200Healthy":0x65a637}</option> Ciao. Giuseppe ... View more

Hi @gcusello  1.With below query  i am trying to fetch three fields from three different event logs which match all 3 condition CASE is used get the extact uppercase/lowercase match of "latest,material" from first log event "id,material" from second log event "dynamoDB data retrieved for ids,dataNotFoundIdsCount,material" from third log event  from third event log   CASE("latest") AND "id" AND "dynamoDB data retrieved for ids" AND "material"   Based on above condition                             PST_TIME4  objectType version republishType  publish nspConsumerList snsPublishedCount dataNotFoundIdsCount 2023-20-11 02:55:12 material latest id NSP ALL 3 1 2023-16-11 09:18:14 material latest id NSP ALL 3 1 2023-12-12 05:03:37 material latest id ALL ALL 1 2 2.CASE("latest") AND "id" AND "sns published count" AND "material" Appendcols is used to fetch sns published count,publish,version,republishInput along with other filter condition latest,id,material     ... View more

Thanks @gcusello  The inclusive condition also worked... ... View more

Hi @ITWhisperer  Added a log to all the event to that it can be picked up commonly,which resolved it   ... View more

Thanks much @ITWhisperer It really worked ... View more

thank you @ITWhisperer  Above solution worked ... View more

thank you ... View more

thank you  ... View more

Hi @nithys, it's the same thing, only one difference: you have to insert: * parenthesys in Token prefix and Token suffix, * field name, equal and quotes in Token valus prefix field=" * quotes in Token value suffix " * OR in delimiter, remember to add a space before and after the OR. Ciao. Giuseppe P.S.: Karma Points are appreciated 😉 ... View more