Hi Team  Can you please let me know why i am not able fetch the base_date in the dashoard using the below logic.  Please help me to fix this issue. Splunk query :  <input type="time" token="time_token"> <label>TIME</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query> | inputlookup V19_Job_data.csv | eval base_date = strftime(strptime("$time_token.earliest$", "%Y-%m-%dT%H:%M:%S"), "%Y-%m-%d") | eval expected_epoch = strptime(base_date . " " . expected_time, "%Y-%m-%d %H:%M") | eval deadline_epoch = strptime(base_date . " " . deadline_time, "%Y-%m-%d %H:%M") | join type=left job_name run_id [ search index = events_prod_cdp_penalty_esa source="SYSLOG" sourcetype=zOS-SYSLOG-Console system = EOCA host = ddebmfr.beprod01.eoc.net (( TERM(JobA) OR TERM(JobB) ) ) ("- ENDED" OR "- STARTED" OR "ENDED - ABEND") | eval Function = case(like(TEXT, "%ENDED - ABEND%"), "ABEND" , like(TEXT, "%ENDED - TIME%"), "ENDED" , like(TEXT, "%STARTED - TIME%"), "STARTED") | eval _time_epoch = _time | eval run_id=case( date_hour &lt; 14, "morning", date_hour &gt;= 14, "evening" ) | eval job_name=if(searchmatch("JobA"), "JobA", "JobB") | stats latest(_time_epoch) as job_time by job_name, run_id ] | eval buffer = 60 | eval status=case( isnull(job_time), "Not Run", job_time &gt; deadline_epoch, "Late", job_time &gt;= expected_epoch AND job_time &lt;= deadline_epoch, "On Time", job_time &lt; expected_epoch, "Early" ) | convert ctime(job_time) | table job_name, run_id, expected_time, expected_epoch , base_date, deadline_time, job_time, status</query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> ... View more

Hi Team  Is it possible to switch the dashboard after a regular interval in the same app ?  I've around 15 dashboards in the same app and i want to switch to next dashboard after every 2 mins.  In the above attached screenshot , i have around 15 dashboards and the home screen is always "ESES Hotline SUMMARY"  dashboard.  Is it possible to move automatically to next dashboard "ESES Hotline" after 2 mins and then move automatically to next dashboard "EVIS Application" after 2 mins and so on.      ... View more

Hi Team  Can you please let me know how it is possible to fetch the events with the time greater than the time of the 1st event in the dashboard.  Example: I've 3 jobs executed every day at around below timings:  Job1 : Around 10 PM  ( Day D)  Job2 : Around 3 AM ( Day D + 1) Job3 : Around 6 AM ( Day D + 1) I am fetching the latest of the Job1/Job2/Job3 to show in the dashboard and want the result in the below format.  If we are after 5 PM - 10 PM ,  Job1 : PLANNED  Job2 : PLANNED  Job3 : PLANNED  If we are at 11 PM ,  Job1 : Executed at 10:00  Job2 : PLANNED  Job3 : PLANNED  If we are 4 AM ,  Job1 : Executed at 10:00  Job2 : Executed at  03:00 Job3 : PLANNED  If we are 7 AM ,  Job1 : Executed at 10:00  Job2 : Executed at  03:00 Job3 : Executed at  06:00  If we are 4 PM ,  Job1 : PLANNED  Job2 : PLANNED  Job3 : PLANNED  If we are at 5 PM ,  Job1 : PLANNED  Job2 : PLANNED  Job3 : PLANNED  We want to consider the start of day at 5 PM and end at next day at 5 PM instead of using last 24 hours / today.    ... View more

HI Team  Can someone please help me to find how we can fetch the status of the application A1 having 5 jobs (Job1 , Job2 , Job3 , Job4 , Job5) running every day.  Status of Application : This needs to be extracted using the query attached below:  Planned : If current time is less than the expected time of JOB1  OK-Running :  If Current time is between the expected time of JOB1 and expected time of JOB5 + Status of all the JOBs is either OK  or PLANNED KO-FAILED : if Current time is between the expected time of JOB1 and expected time of JOB5 + Status of any the 1 JOBs is either KO.  Query used today to fetch the status of each job in the application:  index = ABC ( TERM(JOB1) OR TERM(JOB4) OR TERM(JOB2) OR TERM(JOB3) OR TERM(JOB5) OR TERM(JOB6) OR TERM(JOB7) ) ("- ENDED" OR "- STARTED" OR "ENDED - ABEND") | eval Function = case(like(TEXT, "%ENDED - ABEND%"), "ABEND" , like(TEXT, "%ENDED - TIME%"), "ENDED" , like(TEXT, "%STARTED - TIME%"), "STARTED") | eval DAT = strftime(relative_time(_time, "+0h"), "%d/%m/%Y") , {Function}_TIME=_time | rename DAT as Date_of_reception | stats max(Date_of_reception) as Date_of_reception max(ENDED_TIME) as ENDED_TIME max(STARTED_TIME) as STARTED_TIME max(ABEND_TIME) as ABEND_TIME by JOBNAME | inputlookup append=t ESES_Job_MIFID_PPE.csv | stats values(*) as * by JOBNAME | eval DAY_OF_WEEK = strftime(strptime(Date_of_reception, "%d/%m/%Y"), "%A") ,today = strftime(1743030000, "%Y-%m-%d") , TO_DAY = strftime(strptime(today, "%Y-%m-%d"), "%A") , Diff=ENDED_TIME-STARTED_TIME | rename STARTED_TIME as START_TIME1 , ENDED_TIME as END_TIME1 , ABEND_TIME as ABEND_TIME1 | eval diff_time = tostring(Diff , "duration"), diff_time_1=substr(diff_time,1,8) , START_TIME = Date_of_reception." ".strftime((START_TIME1),"%H:%M:%S") , END_TIME = Date_of_reception." ".strftime((END_TIME1),"%H:%M:%S") , END_TIME2 = strftime((END_TIME1),"%H:%M:%S") , ABEND_TIME = Date_of_reception." ".strftime((ABEND_TIME1),"%H:%M:%S") , ABEND_TIME2 = strftime((ABEND_TIME1),"%H:%M:%S") , EXPECTED_TIME = exp_time , DEADLINE_TIME = high_dl2 ```EXPECTED_TIME_run = Date_of_reception." ".EXPECTED_TIME, EXPECTED_TIME_run = strptime(EXPECTED_TIME_run, "%d/%m/%Y %H:%M:%S") , TimeDiff=EXPECTED_TIME_run-now() , EXP_TIME_norun = if (TO_DAY = "Friday" , exp_time2 , exp_time1) ,EXPECTED_TIME_norun = today + " " + EXP_TIME_norun, EXPECTED_TIME_norun = strptime(EXPECTED_TIME_norun, "%Y-%m-%d %H:%M:%S") , TimeDiff_norun =EXPECTED_TIME_norun-now() , Time_Diff=now() - strptime(START_TIME, "%d/%m/%Y %H:%M:%S") ``` | eval STATUS = if(isnotnull(END_TIME2) AND (END_TIME2 <= ABEND_TIME2),"ABEND", if(isnotnull(END_TIME2) AND (END_TIME2 <= DEADLINE_TIME),"OK", if(isnotnull(END_TIME2) AND (END_TIME2 > DEADLINE_TIME),"BREACHED", if(isnull(END_TIME2) AND isnull(START_TIME1) AND (TimeDiff_norun > 300),"PLANNED", if(isnull(END_TIME2) AND isnull(START_TIME1) AND isnull(TimeDiff) AND (TimeDiff_norun < -600) AND (TimeDiff_norun >= -1800),"JOB NOT STARTED YET", if(isnull(END_TIME2) AND isnull(START_TIME1) AND isnull(TimeDiff) AND (TimeDiff_norun < -1800),"JOB DID NOT EXECUTED", if(isnull(END_TIME2) AND isnotnull(START_TIME1) AND (Time_Diff>600),"FAILED", if(isnull(END_TIME2) AND isnotnull(START_TIME1) and (TimeDiff<=600),"RUNNING", if( isnull(END_TIME2) AND isnull(START_TIME1) AND JOBNAME IN ("$JOB3" ) , "OK-Interest file is received" , if( isnull(END_TIME2) AND isnull(START_TIME1) AND JOBNAME IN ("$JOB6") , "OK-Mifid 2 file is received" , if( isnotnull(END_TIME2) AND isnotnull(START_TIME1) AND JOBNAME IN ("$JOB3" ) , "KO-Interest file Not received" , if( isnotnull(END_TIME2) AND isnotnull(START_TIME1) AND JOBNAME IN ("$JOB6") , "KO-Mifid 2 file Not received" , "WARNING")))))))))))) | rename diff_time_1 as EXECUTION_TIME | sort Order | table Application,JOBNAME,Description, EXPECTED_TIME , DEADLINE_TIME , START_TIME , END_TIME ,EXECUTION_TIME, STATUS | fillnull value="-"   ... View more

HI Team  Can you please let me know if it is possible to display the different CSV files based on the drilldown value selected in parent table.  Example:  I have a search panel with the below drilldown that set the value of the Application clicked in the parent dashboard:  <drilldown> <condition match="isnotnull($raw_hide$)"> <unset token="raw_hide"></unset> <unset token="raw_APPLICATION"></unset> </condition> <condition> <set token="raw_hide">true</set> <set token="raw_APPLICATION">$row.APPLICATION$</set> </condition> </drilldown> Based on the value of the APPLICATION clicked on the parent Dashboard, i want to display the corresponding csv.  If Application = "X", then i want to use the command ,  | inputlookup append=t X.csv  If Application = "Y", then i want to use the command ,  | inputlookup append=t Y.csv  If Application = "Z", then i want to use the command ,  | inputlookup append=t Z.csv  OR  Is it possible to display 3 different panels based on the APPLICATION selected in the parent Dashboard.  i.e based on the value of the token set in the <drilldown> of the parent dashboard , can we display the different panel using <panel depends="$tokenset$"> Panel 1 using X.csv   <panel depends="$tokensetX$"> Panel 2 using Y.csv   <panel depends="$tokensetY$"> Panel 3 using Z.csv   <panel depends="$tokensetZ$">   ... View more

HI  Can someone please let me know how to open different web URLs by clicking on different rows of a dashboard using drilldown option:  Example : Dashboard is using vlookup file  File.csv with below 2 columns:  DESC1 , LINK1 DESC2 , LINK2 DESC3 , LINK3  I've used the below code , but it is taking me always to the same link even when i click on DESC1 or DESC2 or DESC3.  <row> <panel> <table> <search> <query>| inputlookup File.csv | fields * </query> <earliest>1722776400.000</earliest> <latest>1722865326.000</latest> <sampleRatio>1</sampleRatio> <done> <set token="schedule">$result.Schedule$</set> </done> </search> <drilldown> <link target="_blank">https://community.splunk.com/</link> </drilldown> </table> </panel> </row> Is it possible , then if i click  DESC1 , it will take me to the link  "https://community.splunk.com/t5/Dashboards-Visualizations"  DESC2 , it will take me to the link  "https://www.google.com/"  DESC3 , it will take me to the link  "https://blog.avotrix.com/embed-splunk-dashboard-into-external-website/?force_isolation=true"    ... View more

Hi Team  Can you please help me to create a statistic table based on the below requirement:  current output :  Expected Output:    Current query :  Index = xyz source = db  (TERM(A) OR TERM(B) OR TERM(C) OR TERM(D) ) ("- ENDED" OR "- STARTED" OR "ENDED - ABEND") | eval Function = case(like(TEXT, "%ENDED - ABEND%"), "ABEND" , like(TEXT, "%ENDED - TIME%"), "ENDED" , like(TEXT, "%STARTED - TIME%"), "STARTED") | eval DAT = strftime(relative_time(_time, "+0h"), "%d/%m/%Y") , {Function}_TIME=_time | rename DAT as Date_of_reception | stats max(Date_of_reception) as Date_of_reception max(STARTED_TIME) as STARTED_TIME max(ENDED_TIME) as ENDED_TIME  by JOBNAME | eval Application = case ( JOBNAME IN ( "A" ,"B") , "A1" , JOBNAME IN ( "C" , "D" ) , "A2" ) | table Application , JOBNAME, Date_of_reception , STARTED_TIME  , ENDED_TIME    ... View more