Hello Splunkers I can use stats count and visualize the output as a single value so its nice and big in that panel in my dashboard. Is there a way to visualize the output from stats(sum) in a similar way.  Or just make the the single value in a field big and prominent in the dashboard? |fields total|fieldformat "total" = round(total, 2) | appendpipe [ stats sum(total) as Grand_Total ] |fields Grand_Total output ------------------------------------ Grand_Total 103 ... View more

Hello again splunk experts This is my current situation:- job_no                field4 131                      string1                                string2 132                      string3                               string4 |table job_no, field2, field4|dedup, job_no, field2 |stats count dc(field4) AS dc_field4 by job_no |eval calc=dc_field4 * count produces:- job_no                                       field2                                        dc_field4                              calc 131 6 2 12 132 6 2 12 This all works fine.  The problem is that I also want to include the strings (string1,string2,string3,string4) in my table.  Like this:- job_no                                                                   field4                                                               field2       dc_field4     calc 131 string1, string2 6 2 12 132 string3, string4 6 2 12   Any help would be greatly appreciated, ... View more

Hello Experts, I'm trying to work out how to strip down a field  field="blah_6chars_blah_blah" the 6chars is what I want to extract and the 6 chars are always prefixed with 999. the 6 chars prefixed with 999 might be in a different place in the field.  i.e.  blah_blah_6chars_blah 6chars example value=999aaa so the regex should find  all occurences of 999 in the field and extract the 999 and the next 3 chars and create an additional field with the result Thanks ... View more