If your searches are lightweight, you could potentially run all 3 searches and hide/show panels depending on the dropdown value selected. This works well if you have static index and environment_names, which looks to be true in your case. It also renders very fast when you switch the drop down selection. Here is one way to do it, which can be pasted in as dashboard source XML. It has dummy searches to illustrate different results. <form> <label>3 env demo</label> <fieldset submitButton="false" autoRun="false"> <input type="dropdown" token="tokEnv"> <label>Environment</label> <choice value="dev">dev</choice> <choice value="tst">tst</choice> <choice value="prd">prd</choice> <default>dev</default> <initialValue>dev</initialValue> <change> <condition label="dev"> <set token="dev">true</set> <unset token="tst"></unset> <unset token="prd"></unset> </condition> <condition label="tst"> <unset token="dev"></unset> <set token="tst">true</set> <unset token="prd"></unset> </condition> <condition label="prd"> <unset token="dev"></unset> <unset token="tst"></unset> <set token="prd">true</set> </condition> </change> </input> </fieldset> <row> <panel depends="$dev$"> <table> <title>dev panel</title> <search> <query>| makeresults count=5 | eval x=1 | accum x | autoregress x p=1-4</query> <earliest>-10s@s</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> <panel depends="$tst$"> <table> <title>tst panel</title> <search> <query>| makeresults | eval timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S")</query> <earliest>-1s@s</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> <panel depends="$prd$"> <table> <title>prd panel</title> <search> <query>| makeresults count=3 | eval x=5 | accum x | autoregress x p=1-2</query> <earliest>-1s@s</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> ... View more

One way to do it is to create a field for each average you collect. This example populates a field if it satisfies the cases you put int your conditional, or leaves it null if not: basesearch | stats avg(assets_collected) as ac avg(metrics_returned) as metrics avg(no_metrics) as not_returned | eval acStatus=if(ac==0, "Asset Collector broke!", null()) | eval metStatus=if(metrics==0,"Data Lake Failure!", null()) | eval notRetStatus=if(not_returned==0,"Cron Failure!",null()) ... View more

Another approach is to use the colon as a delimiter, and then pull the sought after fields out of the mv you create: | makeresults | eval myField="cpe:/a:adobe:shockwave_player" | eval mvFields=split(myField,":") | eval f1=mvindex(mvFields,2), f2=mvindex(mvFields,3) While not as slick as a regex, it is easier for most mortals to understand. It's also handy in a lot of other cases where you need to pull fields out of text that has predictable delimiters. ... View more

When I run into this issue, here's what I do, and it might work for you. 1. Clone the dashboard. 2. Remove all panels except one that is giving you issues. 3. Hard code the full search and the time range into the panel's search. In other words, use the earliest and latest keywords in the search itself before the first pipe. Example: (main search elements) earliest=-1w@w latest=now | search host=.... Test it. 4. Add your time picker input, remove the earliest and latest from your search, and make the search use your time picker tokens. Test it. 5. Remove the front part of the working search to make your base search, use the time tokens in that search, and make your main search use the base. Test it. ... View more

Might not hurt to physically join the base query in front of the panel's query along with the time tokens. Do away with the base search for now. Also, consider a debug HTML panel to validate your tokens (remove leading spaces): < row> < panel> < html> < h1>Debug< /h1> < p>earliest=$TimeRangePkr.earliest$<br/>latest=$TimeRangePkr.latest$< /p> < /html> < /panel> < /row> ... View more

Here is one way, with some flexibility built in for the error codes: |makeresults | eval _raw="Jan 8 12:52:29 abc notice def[xxxx]: xxxxxxxx:x: Pool /Common/xyz.abc.com443 member /Common/hostinfo_portal:443 session status forced disabled. Jan 8 10:44:23 abc notice def[xxxx]: xxxxxxxx:x: Pool /Common/xyz.abc.com443 member /Common/hostinfo_portal:443 monitor status up. [ /Common/https_xxxx: up ] [ was down for xxhrs:Xxmins:XXsec ] Jan 8 10:44:22 abc notice def[xxxx]: xxxxxxxx:x: Pool /Common/xyz.abc.com443 member /Common/hostinfo_portal:443 session status enabled. Jan 8 10:30:42 abc notice def[xxxx]: xxxxxxxx:x: Pool /Common/xyz.abc.com443 member /Common/hostinfo_portal:443 monitor status forced down. [ /Common/https_xxxx: up ] [ was forced down for Xxhrs:Xxmins:Xsec ] Jan 8 10:24:21 abc notice def[xxxx]: xxxxxxxx:x: Pool /Common/xyz.abc.com443 member /Common/hostinfo_portal:443 session status forced disabled." | multikv forceheader=1 | fields _raw | rex "Pool\s\/\w+\/(?<hostname>[\w.]+)\d{3}\smember\s\/\w+\/(?<client>[^_]+).*? (?<remarks>.*?)\." | table hostname client remarks ... View more

Are you saying that you want to look at each week in isolation, dedup the IP and VIP in that week's group of events? If so, then try adding a "weekbreaker" field and deduping that before your timechart: | eval weekbreaker=relative_time(_time, "@w") | dedup IP,VIP,weekbreaker ... View more

While not a direct solution, you can always look into the use of sentinel values. I found this Splunk .conf 2015 presentation helpful, with focus on slide 25. The challenge you describe is identifying what is missing, which is hard to do if you don't know what should exist in the first place. It's like asking a classroom: "OK, who isn't here today?" ... View more

I'll admit I don't fully understand your use case, but have you looked at this link? https://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/PanelreferenceforSimplifiedXML The solution may lie in the section labeled "condition (form input)". I use this logic a lot to set multiple tokens based upon conditions that match the input's label or value. Maybe you can use this to set tokens that have relative ranges? Plus, did you try set token instead of eval token ? See the link I provided for the syntax. ... View more

Ok, leave the dedup in there, and change the top line from multisearch to union ... View more

So your first 3 lines should look like this: | multisearch [ search index="1" sourcetype="1" source="1" | search state="running" | rename vm_name AS hostname ] [ search index="2" source="2*" group=tcpin_connections | dedup hostname ] Is this what you have? If so, then all events will have "hostname" which is needed later on. ... View more

There is a quick reference guide that is very helpful. Also, Splunk has a pretty well-stocked YouTube page. ... View more

Get rid of table vm_name in the first subsearch, and table hostname in the second subsearch. ... View more

One way to do this is to set up a multisearch: | multisearch [ search index="1" sourcetype="1" source="1" | search state="running" | table vm_name | rename vm_name AS hostname ] [ search index="2" source="2*" group=tcpin_connections | dedup hostname | table hostname] | stats count(index) AS Vol first(index) AS index by hostname | where Vol=1 | eval message=if(index==1,"Host belongs to index 1 only","Host belongs to index 2 only") | fields hostname message You can test this with some "run anywhere" SPL: | makeresults | eval raw="index=1,sourcetype=1,source=1,hostname=1a index=1,sourcetype=1,source=1,hostname=1b index=1,sourcetype=1,source=1,hostname=1c index=1,sourcetype=1,source=1,hostname=1d index=1,sourcetype=1,source=1,hostname=1e index=2,sourcetype=,source=2,hostname=2a index=2,sourcetype=,source=2,hostname=2b index=2,sourcetype=,source=2,hostname=1a index=2,sourcetype=,source=2,hostname=2g " | makemv raw | mvexpand raw | rename raw AS _raw | kv | table index sourcetype,source,hostname | stats count(index) AS Vol first(index) AS index by hostname | where Vol=1 | eval message=if(index==1,"hostname belongs to index 1 only","hostname belongs to index 2 only") | fields hostname message ... View more

Here is one way to do it | makeresults | eval user="YHYIFLP@intra.bcg.local" | rex field=user "(?<username>[^@]+)@.*" | table user username ... View more

If your log is literally lines like Header product-id, 12345678900 then you can extract the last value (assuming all digits) and stats-by on that. Example: (your search) | rex "Header product-id, (<productId>\d+)" | stats count by productId If this doesn't work, please post the actual events you get back and I'm sure people here can help! ... View more

Will this get you close? index=cisco_asa Cisco_ASA_user=* | transaction fields=Cisco_ASA_user maxspan=12h30m connected=f startswith="*connection established*" | search eventtype!=cisco_vpn_end | dedup user | timechart span=1h count(user) AS UserCount FYI, it is generally preferred to use stats instead of transaction like this: | (your search) | eval StartTime=if(match(_raw, "cisco_vpn_start"), _time, null()) | eval EndTime=if(match(_raw, "cisco_vpn_end"), _time, null()) | stats earliest(StartTime) as StartTime latest(EndTime) as EndTime by Cisco_ASA_user Then you can search for full sessions (have both StartTime and EndTime) or abandoned (StartTime but missing and well overdue end times) or in progress (StartTime, no EndTime, but not long enough for timeout). You can do a lot with this info. ... View more

Hi, can you please provide a little more detail? Specifically in the examples you provide, what are the examples of SES and ABC matches you expect from the legal ones? And which of those should not match anything? When you have ABC twice (the last formats seen line) is that literally the same ABC twice, or different ABCs? ... View more

The dc aggregation function can be very expensive. Did you job inspector give any insight as to where the time is being spent? I'm also curious what you're ultimately trying to achieve...knowing that may help the community solve your challenge. See this link for info on dc and how to work around it. ... View more

Ok then, you'll have to use a new "status" field. Here is an example where 200 is defined as "Pass" and everything else is "Fail" | makeresults | eval raw="File=A,Method=200 File=A,Method=300 File=A,Method=400 File=B,Method=500 File=B,Method=200 File=C,Method=300 File=C,Method=500 File=C,Method=500 File=A,Method=500 File=A,Method=200 File=B,Method=400" | makemv raw | mvexpand raw | rename raw AS _raw | kv | table File Method | eval status=if(Method==200,"Pass","Fail") | stats count AS Vol by File,status | xyseries File status Vol | where Fail>Pass ... View more

Here is one way to do it, using Run Anywhere SPL: | makeresults | eval raw="File=A,Method=Fail File=A,Method=Success File=A,Method=Fail File=B,Method=File File=B,Method=Success File=C,Method=Fail File=C,Method=Success File=C,Method=Fail File=A,Method=Success File=A,Method=Success File=B,Method=Fail" | makemv raw | mvexpand raw | rename raw AS _raw | kv | table File Method | stats count AS Vol by File,Method | xyseries File Method Vol | where Fail>Success ... View more

This might get you close, with a run anywhere example: | makeresults | eval _raw=":{\\\"buaid\\\":{\\\"business\\\":[\\\"12345\\\"],\\\"exclude*" | rex ":{\\\\\"buaid\\\\\":{\\\\\"business\\\\\":\[\\\\\"(?<bss_value>[^\\\]+)\\\\\"\]," It sets up a _raw field, and then extracts from it. The last line should do it for you. ... View more