If your searches are lightweight, you could potentially run all 3 searches and hide/show panels depending on the dropdown value selected. This works well if you have static index and environment_names, which looks to be true in your case. It also renders very fast when you switch the drop down selection. Here is one way to do it, which can be pasted in as dashboard source XML. It has dummy searches to illustrate different results. <form> <label>3 env demo</label> <fieldset submitButton="false" autoRun="false"> <input type="dropdown" token="tokEnv"> <label>Environment</label> <choice value="dev">dev</choice> <choice value="tst">tst</choice> <choice value="prd">prd</choice> <default>dev</default> <initialValue>dev</initialValue> <change> <condition label="dev"> <set token="dev">true</set> <unset token="tst"></unset> <unset token="prd"></unset> </condition> <condition label="tst"> <unset token="dev"></unset> <set token="tst">true</set> <unset token="prd"></unset> </condition> <condition label="prd"> <unset token="dev"></unset> <unset token="tst"></unset> <set token="prd">true</set> </condition> </change> </input> </fieldset> <row> <panel depends="$dev$"> <table> <title>dev panel</title> <search> <query>| makeresults count=5 | eval x=1 | accum x | autoregress x p=1-4</query> <earliest>-10s@s</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> <panel depends="$tst$"> <table> <title>tst panel</title> <search> <query>| makeresults | eval timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S")</query> <earliest>-1s@s</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> <panel depends="$prd$"> <table> <title>prd panel</title> <search> <query>| makeresults count=3 | eval x=5 | accum x | autoregress x p=1-2</query> <earliest>-1s@s</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> ... View more

One way to do it is to create a field for each average you collect. This example populates a field if it satisfies the cases you put int your conditional, or leaves it null if not: basesearch | stats avg(assets_collected) as ac avg(metrics_returned) as metrics avg(no_metrics) as not_returned | eval acStatus=if(ac==0, "Asset Collector broke!", null()) | eval metStatus=if(metrics==0,"Data Lake Failure!", null()) | eval notRetStatus=if(not_returned==0,"Cron Failure!",null()) ... View more

Another approach is to use the colon as a delimiter, and then pull the sought after fields out of the mv you create: | makeresults | eval myField="cpe:/a:adobe:shockwave_player" | eval mvFields=split(myField,":") | eval f1=mvindex(mvFields,2), f2=mvindex(mvFields,3) While not as slick as a regex, it is easier for most mortals to understand. It's also handy in a lot of other cases where you need to pull fields out of text that has predictable delimiters. ... View more

When I run into this issue, here's what I do, and it might work for you. 1. Clone the dashboard. 2. Remove all panels except one that is giving you issues. 3. Hard code the full search and the time range into the panel's search. In other words, use the earliest and latest keywords in the search itself before the first pipe. Example: (main search elements) earliest=-1w@w latest=now | search host=.... Test it. 4. Add your time picker input, remove the earliest and latest from your search, and make the search use your time picker tokens. Test it. 5. Remove the front part of the working search to make your base search, use the time tokens in that search, and make your main search use the base. Test it. ... View more

Might not hurt to physically join the base query in front of the panel's query along with the time tokens. Do away with the base search for now. Also, consider a debug HTML panel to validate your tokens (remove leading spaces): < row> < panel> < html> < h1>Debug< /h1> < p>earliest=$TimeRangePkr.earliest$<br/>latest=$TimeRangePkr.latest$< /p> < /html> < /panel> < /row> ... View more

Here is one way, with some flexibility built in for the error codes: |makeresults | eval _raw="Jan 8 12:52:29 abc notice def[xxxx]: xxxxxxxx:x: Pool /Common/xyz.abc.com443 member /Common/hostinfo_portal:443 session status forced disabled. Jan 8 10:44:23 abc notice def[xxxx]: xxxxxxxx:x: Pool /Common/xyz.abc.com443 member /Common/hostinfo_portal:443 monitor status up. [ /Common/https_xxxx: up ] [ was down for xxhrs:Xxmins:XXsec ] Jan 8 10:44:22 abc notice def[xxxx]: xxxxxxxx:x: Pool /Common/xyz.abc.com443 member /Common/hostinfo_portal:443 session status enabled. Jan 8 10:30:42 abc notice def[xxxx]: xxxxxxxx:x: Pool /Common/xyz.abc.com443 member /Common/hostinfo_portal:443 monitor status forced down. [ /Common/https_xxxx: up ] [ was forced down for Xxhrs:Xxmins:Xsec ] Jan 8 10:24:21 abc notice def[xxxx]: xxxxxxxx:x: Pool /Common/xyz.abc.com443 member /Common/hostinfo_portal:443 session status forced disabled." | multikv forceheader=1 | fields _raw | rex "Pool\s\/\w+\/(?<hostname>[\w.]+)\d{3}\smember\s\/\w+\/(?<client>[^_]+).*? (?<remarks>.*?)\." | table hostname client remarks ... View more

Are you saying that you want to look at each week in isolation, dedup the IP and VIP in that week's group of events? If so, then try adding a "weekbreaker" field and deduping that before your timechart: | eval weekbreaker=relative_time(_time, "@w") | dedup IP,VIP,weekbreaker ... View more

While not a direct solution, you can always look into the use of sentinel values. I found this Splunk .conf 2015 presentation helpful, with focus on slide 25. The challenge you describe is identifying what is missing, which is hard to do if you don't know what should exist in the first place. It's like asking a classroom: "OK, who isn't here today?" ... View more

I'll admit I don't fully understand your use case, but have you looked at this link? https://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/PanelreferenceforSimplifiedXML The solution may lie in the section labeled "condition (form input)". I use this logic a lot to set multiple tokens based upon conditions that match the input's label or value. Maybe you can use this to set tokens that have relative ranges? Plus, did you try set token instead of eval token ? See the link I provided for the syntax. ... View more

Ok, leave the dedup in there, and change the top line from multisearch to union ... View more

So your first 3 lines should look like this: | multisearch [ search index="1" sourcetype="1" source="1" | search state="running" | rename vm_name AS hostname ] [ search index="2" source="2*" group=tcpin_connections | dedup hostname ] Is this what you have? If so, then all events will have "hostname" which is needed later on. ... View more

There is a quick reference guide that is very helpful. Also, Splunk has a pretty well-stocked YouTube page. ... View more

Get rid of table vm_name in the first subsearch, and table hostname in the second subsearch. ... View more