Dear All, We have splunk index with data like pattern and the pattern was recently changed. {"Feild1":"DATA1","Feild2":"DATA2","Feild3":"DATA3","Feild4":"DATA4"} We have several dashboards using previous data pattern like below. DATA1,DATA2,DATA3,DATA4 Looking for a way to filter out or suppress {"Feild1": "Feild2":.....} using splunk query's and feed output to dashboards.   Kindly suggest how this can be done.   Thanks   ... View more

Hello All,   I want to build a splunk query using stats to get count of messages for last 5 min, last 10min and last 15min.Something like below. Kindly let me know how below can be achieved?    Transaction       Last 5min Vol        Last 10min Vol       Last 15min Vol A B C ... View more

Hello All,   I have an Index = Application123 and it contains an Unique ID known as TraceNumber. For each Trace number we have Error's, Exceptions and return codes.   We have a requirements to summarize in a table  Like below, If error is found in index need table value as YES if not found it should be No. Same for Exception if Exception is found then table should be Yes or else no. Note Error's, exceptions and retuncodes are in content of Index with field - Message log. TraceNumber   Error     Exception    ReturnCode 11111                  YES          NO                   YES 1234                     YES          NO                    YES Any help would be appreciated ... View more

Hello, I have below code for a dropdown menu and the problem is the moment i select any of the value from drop down dependent panels load without waiting for Submit button. How can this be fixed. Submit Button code: <fieldset submitButton="true" autoRun="false"> <input token="field1" type="time" searchWhenChanged="false"> <label>Time Picker</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> Dropdown and Token <input type="dropdown" token="subsummary" depends="$loadsummary$" searchWhenChanged="false"> <label>Summary Selection</label> <choice value="FUNC">Function Summary</choice> <choice value="MQ">MQ Summary</choice> <change> <condition value="FUNC"> <set token="funcsummary">true</set> <unset token="funcsummaryMQ"></unset> </condition> <condition value="MQ"> <set token="funcsummaryMQ">true</set> <unset token="funcsummary"></unset> </condition> </change>   Sample Panel: <row depends="$funcsummaryMQ$"> <panel depends="$funcsummaryMQ$"> <title>ABC</title> <table> <search > <query>index="SAMPLE" </query> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> </table> </panel> </row> ... View more

Hello team, I have a requirement to add a single Refresh button to refresh all the panels that are loaded with current token. Is there a way to add refresh button at top of the panel ?   Thanks ... View more

Hello, I have below code for a dropdown menu and the problem is the moment i select any of the value from drop down dependent panels load without waiting for Submit button. How can this be fixed. Submit Button code: <fieldset submitButton="true" autoRun="false"> <input token="field1" type="time" searchWhenChanged="false"> <label>Time Picker</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> Dropdown and Token <input type="dropdown" token="subsummary" depends="$loadsummary$" searchWhenChanged="false"> <label>Summary Selection</label> <choice value="FUNC">Function Summary</choice> <choice value="MQ">MQ Summary</choice> <change> <condition value="FUNC"> <set token="funcsummary">true</set> <unset token="funcsummaryMQ"></unset> </condition> <condition value="MQ"> <set token="funcsummaryMQ">true</set> <unset token="funcsummary"></unset> </condition> </change>   Sample Panel: <row depends="$funcsummaryMQ$"> <panel depends="$funcsummaryMQ$"> <title>ABC</title> <table> <search > <query>index="SAMPLE" </query> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> </table> </panel> </row> ... View more

Hello,   I have requirement to create a Orange button in splunk dashboard and upon orange button click need to load few panels.   Kindly let me know how this can be accomplished?   Thanks ... View more

Hello,   I have created a dashboard of 10 panels and I have used base query’s. The entire dashboard loads with 4 base queries but still always Dashboard Either getting stuck in Waiting for Data or “Queued waiting for“   how can I solve this problem. ... View more

Hello, I have 2 distinct indexes with distinct values.Want to create one final stats query from select fields of both indexes.   Ex : Index A Fields X Y Z Stats Count (X) Avg(Y) by XYZ Index B feilds KM stats Count (K) Max(M) by K M i am able search both indexes  and give separate stats, If I give stats on all fields by XYZKM it is not giving any results. Note: No common feilds between both index’s. ... View more