@nagas you need to make use of the bin command and the chart command.  Alternatively you can look at the timechart command Here is an example, based on what you've posted.   | makeresults | eval _raw="time, event, value 20/07/2020 09:00:00, order_one, 100 19/07/2020 09:00:00, order_two, 10 15/07/2020 09:00:00, order_three, 11 12/07/2020 09:00:00, order_four, 30 10/07/2020 09:00:00, order_five, 800 09/07/2020 09:00:00, order_six, 500 07/07/2020 09:00:00, order_seven, 40 06/07/2020 09:00:00, order_eight, 20 03/07/2020 09:00:00, order_nine, 12 01/07/2020 09:00:00, order_ten, 1000" | multikv forceheader=1 | eval value = ltrim(value) | eval _time = strptime(time, "%d/%m/%Y %H:%M:%S") | bin _time span=1w@w | chart sum(value) by _time ... View more

@chaitali_1994  your MAX_TIMESTAMP_LOOKAHEAD value needs to be at least, 230.  The way that value works, is from the beginning of the event it will continue to validate the regex in TIME_PREFIX value.  In your example, <Apr 9 02:00:01>  <syslog- server name> <02: 00:01, 371>  ERROR [EventLogManager] Udated logs Successfully CEF:|<cefVersion>|<vendor>|<product>|<version>|<id>|<id desc>|<severity id>|start=Apr 09 2020 01:00:01 end=Apr 09 2020 01:00:01 The TIME_PREFIX = end= is 214, characters from the beginning of the string.  This is after you've anonymised the data.  So the value of 22 is not going to meet the criteria in any scenario.  The best way forward, is to copy some of the large event into a text editor or word and check how many character are there prior to the timestamp "end=<timestamp>" and set the MAX_TIMESTAMP_LOOKAHEAD value to the MAXIMUM value you get ... View more

@chaitali_1994 that makes it clear, I did not understand that regex.   props.conf TIME_PREFIX = end= MAX_TIMESTAMP_LOOKAHEAD = 100 [or the furtherest the "end" timestamp is at, you've currently set it to 20, so it is only look 20 characters ahead] TIME_FORMAT = %b %d %Y %H:%M:%S TZ = GMT   ... View more

@chaitali_1994 no worries. If the time signature is this: Apr 9 02:00:01, than your props needs to be modified to include this: TIME_FORMAT= %b %d %H:%M:%S apart from that the rest appears fine. ... View more

@svaroor have a read at this.  https://www.splunk.com/en_us/blog/tips-and-tricks/getting-started-with-citrix-in-splunk-part-1.html   ... View more

@chaitali_1994 Please provide a screenshot from the Splunk search showing the actual event vs the time extracted. Also are the events going from UF ---> IDX(C) or UF ---> HF ---> IDX(C) ... View more

@amerineni  this should provide the guidance on what you need | makeresults | eval _raw="HttpStatus, isValidError 200, false 200, false 201, false 305, true 202, false 400, true 500, true" | multikv forceheader=1 | rename COMMENT AS "CHECK THE CODE FROM HERE ON" | eval result = if(HttpStatus < 299, 1, 0) | eventstats count as TotalSuccessFailure by result | eventstats count as TotalEvents | eval percent = round((TotalSuccessFailure / TotalEvents) * 100,1) | rename COMMENT AS "CHECK THE CODE ABOVE HERE" | fields HttpStatus result TotalSuccessFailure TotalEvents percent   you can than take it further and just get the score by using stats | stats values(percent) by result   ... View more

@phanichintha here is an example of how it can be achieved using the transaction command. | makeresults | eval _raw = "time, userID, eventName 20/07/2020 09:00:00, 1, AM-LOGIN-COMPLETED 20/07/2020 09:01:00, 2, AM-LOGIN-COMPLETED 20/07/2020 09:10:00, 2, AM-LOGOUT 20/07/2020 09:06:00, 1, AM-LOGOUT 20/07/2020 09:00:00, 3, AM-LOGIN-COMPLETED 20/07/2020 10:06:00, 3, AM-LOGOUT" | multikv forceheader=1 | eval _time = strptime(time,"%d/%m/%Y %H:%M:%S") | transaction userID maxspan=1d | stats avg(duration) as AverageTimeSpentOnThePlatform   Here is the link to the command  https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction You can make it more robust by using the startswith and endwith arguments Hope this helps ... View more

*Updated* Have a try with this blacklist stanza: blacklist1 = EventCode="4103" Message="Host Application\s=\s*.*SolarWinds\.APM\.Probes" ... View more

Are you ingesting the WinHostMon data? Check using this search index=myindex sourcetype=WinHostMon source=operatingsystem | stats count by OS host If you're, than this should help index=myindex sourcetype=WinHostMon source=operatingsystem | stats values(OS) as OS by host | append [search index=myindex sourcetype=wineventlog source=WinEventLog:Security | stats VALUES(EventCode) AS EventCode BY host ] | stats VALUES(*) AS * BY host   ... View more

@seomaniv can you please provide a sample on how the changes are to take place based on selection. ... View more

Without JS + CSS, i've not achieved this before. Though here is an alternative that will work. - Create a new column which sets the range by the log level. Once you've set the values you can set the range to colour code the row See the below code: <row> <panel> <title>Range colour</title> <table> <search> <query>| makeresults | eval _raw = "desc, range ERROR, 4 WARN, 3 OK, 0" | multikv forceheader=1 | table desc range</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">50</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="range"> <colorPalette type="list">[#53A051,#F8BE34,#EC9960,#DC4E41]</colorPalette> <scale type="threshold">1,3,4</scale> </format> </table> </panel> </row> Results: Hope this alternative helps. ... View more