How can I get the SVC Usage for Saved Searches and Ad-hoc searches?  These logs don't have it. index="_internal" data.searchType="scheduled"   index="_audit" sourcetype="audittrail" action="search" info="completed"   ... View more

I have a time selector with custom tokens that control various aspects of the dashboard.  Changing the value of the time selector changes the values of the custom tokens. I also have a separate input dropdown with a list of times taken from when our alerts fired.  I need to update the time selector when the alert dates/times are chosen so the panels below update with a timeframe showing what happened with alert.  When changing the value of the separate input dropdown to a new date, the 'earliest' and 'latest' update on the time selector, but none of its custom tokens do.  They only change when I change the time selector. When I update input dropdowns with other input dropdown dynamically, they work, just not when I attempt to update the time selector from another input dropdown.   How can I update "all" tokens on the time selector, not just 'earliest' and 'latest' from the other dropdown?       <form theme="dark"> <label>Time Issue</label> <description></description> <fieldset submitButton="false" autoRun="false"> <input type="time" token="time" searchWhenChanged="true"> <label>Time Frame</label> <default> <earliest>@d-1d</earliest> <latest>now</latest> </default> <change> <eval token="time.earliest">if(len('earliest')=0 OR 'earliest="" OR isnull('earliest') OR 'earliest'="null" OR 'earliest'="0", "@d-90d", 'earliest')</eval> <eval token="time.latest">if('latest'="now" OR len('latest')=0 OR isnull('latest') OR 'latest'="null","@m",'latest')</eval> <eval token="time.earliest_type">if(match('earliest', ".*[@smhdwy].*"), "rel", "abs")</eval> <eval token="time.latest_type">if(match('latest', ".*[@smhdwy].*"), "rel", "abs")</eval> <eval token="time.earliest_epoch">if($time.earliest_type$="rel", relative_time(now(), 'earliest'), 'earliest')</eval> <eval token="time.latest_epoch">if($time.latest_type$="rel", relative_time(now(), 'latest'), 'latest')</eval> <eval token="time.difference">$time.latest_epoch$-$time.earliest_epoch$</eval> <eval token="form.panel">if($time.difference$&lt;=604801,"compare","single")</eval> <eval token="form.span">if($time.difference$&gt;2592000,"1d",if($time.difference$&gt;604800,"1h",if($time.difference$&gt;172800,"15m",if($time.difference$&gt;86400,"3m","1m"))))</eval> <eval token="time.earliest_day1">if($time.earliest_type$="rel", 'earliest' . "-1d", 'earliest'-86400)</eval> <eval token="time.earliest_day1_epoch">'earliest'-86400</eval> <eval token="time.latest_day1">if($time.latest_type$="rel", 'latest' . "-1d", 'latest'-86400)</eval> <eval token="time.latest_day1_epoch">'latest'-86400</eval> <eval token="time.earliest_week1">if($time.earliest_type$="rel", 'earliest' . "-1w", 'earliest'-604800)</eval> <eval token="time.earliest_week1_epoch">'earliest'-604800</eval> <eval token="time.latest_week1">if($time.latest_type$="rel", 'latest' . "-1w", 'latest'-604800)</eval> <eval token="time.latest_week1_epoch">'latest'-604800</eval> </change> </input> <input type="dropdown" token="span" searchWhenChanged="true"> <label>Span</label> <choice value="1m">1 Minute</choice> <choice value="3m">3 Minute</choice> <choice value="5m">5 Minutes</choice> <choice value="10m">10 Minutes</choice> <choice value="15m">15 Minutes</choice> <choice value="30m">30 Minutes</choice> <choice value="1h">1 Hour</choice> <choice value="3h">3 Hours</choice> <choice value="6h">6 Hours</choice> <choice value="12h">12 Hours</choice> <choice value="1d">1 Day</choice> <change> <eval token="span.seconds">case($span$="1m", 60, $span$="3m", 180, $span$="5m", 300, $span$="10m", 600, $span$="15m", 900, $span$="30m", 1800, $span$="1h", 3600, $span$="3h", 10800, $span$="6h", 21600, $span$="12h", 43200, $span$="1d", 86400)</eval> <eval token="time.earliest_snap">(int($time.earliest_epoch$/$span.seconds$)*$span.seconds$)+$span.seconds$</eval> <eval token="time.latest_snap">int($time.latest_epoch$/$span.seconds$)*$span.seconds$</eval> <eval token="time.earliest_week1_snap">(int($time.earliest_week1_epoch$/$span.seconds$)*$span.seconds$)+$span.seconds$</eval> <eval token="time.latest_week1_snap">int($time.latest_week1_epoch$/$span.seconds$)*$span.seconds$</eval> <eval token="time.difference_snap">$time.latest_snap$-$time.earliest_snap$</eval> <eval token="span.intervals">ceil($time.difference$/$span.seconds$)</eval> <eval token="span.intervals_snap">$time.difference_snap$/$span.seconds$</eval> </change> <default>5m</default> <initialValue>5m</initialValue> </input> <input type="dropdown" token="panel" searchWhenChanged="true"> <label>Panel</label> <choice value="single">Single</choice> <choice value="compare">Compare</choice> <change> <condition value="compare"> <unset token="showPanelSingle"></unset> <set token="showPanelCompare">true</set> </condition> <condition value="single"> <unset token="showPanelCompare"></unset> <set token="showPanelSingle">true</set> </condition> </change> <default>compare</default> <initialValue>compare</initialValue> </input> <input type="dropdown" token="timeOption" searchWhenChanged="true"> <label>Choose a Time</label> <fieldForLabel>timeLabel</fieldForLabel> <fieldForValue>time</fieldForValue> <search> <done> <condition match="len('timeOption') != &quot;0&quot;"> <unset token="form.time.earliest"></unset> <unset token="form.time.latest"></unset> <eval token="form.time.earliest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@d-1d", relative_time($timeOption$, "@d-2h"))</eval> <eval token="form.time.latest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@m", relative_time($timeOption$, "@d+1d+2h"))</eval> </condition> </done> <query>| makeresults count=5 | eval _time = floor((relative_time(_time, "@d") / 86400) * 86400) | streamstats current=false count as _row | eval time = _time - (_row * 86400) | eval timeLabel = strftime(time, "%Y-%m-%d")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <condition match="len('timeOption') != &quot;0&quot;"> <unset token="form.time.earliest"></unset> <unset token="form.time.latest"></unset> <eval token="form.time.earliest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@d-1d", relative_time($timeOption$, "@d-2h"))</eval> <eval token="form.time.latest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@m", relative_time($timeOption$, "@d+1d+2h"))</eval> </condition> </change> </input> </fieldset> <row> <panel> <html> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>timeOption</span></div> <div style="width: 300px; float: left;"><span>$timeOption$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest</span></div> <div style="width: 300px; float: left;"><span>$time.earliest$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest</span></div> <div style="width: 300px; float: left;"><span>$time.latest$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.latest_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_type</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_type$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_type</span></div> <div style="width: 300px; float: left;"><span>$time.latest_type$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.difference</span></div> <div style="width: 300px; float: left;"><span>$time.difference$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_day1</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_day1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_day1</span></div> <div style="width: 300px; float: left;"><span>$time.latest_day1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_day1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_day1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_day1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.latest_day1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_week1</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_week1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_week1</span></div> <div style="width: 300px; float: left;"><span>$time.latest_week1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_week1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_week1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_week1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.latest_week1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>panel</span></div> <div style="width: 300px; float: left;"><span>$panel$</span></div> </div> </html> </panel> </row> </form>     ... View more

I have an input text and input dropdown that both need to allow blank value.  They cannot be null since the token must be set or the queries that use it won't run.  I need a prefix and suffix both wildcards only when there's a value, and to use a single wildcard (*) in its absence. I tried this, but the prefix and suffix keep multiplying and soon i have 10 suffixes and 10 prefixes. here's the input text:   <prefix/> <suffix/> <change> <eval token="assetFilter">if(len($assetFilter$)&gt;0, "*" . $assetFilter$ . "*", "*")</eval> </change>   after entering, removing, entering, removing values, the suffix and prefix kept multiplying and eventually looked like this ****tag=****   Here's the other one, a dropdown of macros so it needs the ` char with the wildcard, after selecting, unselecting, selecting, and unselecting values in the dropdown.   <change> <eval token="asset">if(len($asset$)&gt;0, "*`" . $asset$ . "`*", "*")</eval> </change>   *`*`*`*`*`*`*`*`*`*`*`*`*`*`*`ED_ENDI_Asdf`*`*`*`*`*`*`*`*`*`*`*`*`*`*`*   How can I use prefix and suffix conditionally a little better or in a way that works? -c     ... View more

I am writing a query to look for rises in error messages over the past hour.  It looks in 15 minute chunks from 0 to 60 minutes ago.  Rows where there are 0 error messages are missing from the table, but i need to keep them there so when i run a median over the last 3 time bins, it includes the 0s. Each API has their own error messages when it fails, and not every failure occurs in every 15 minute block of time for their API. So far I have this, in run-anywhere spl, but it's not correct   | makeresults 1 | eval api="api1", errorMsg="msg1", Minute=0, Traffic="1234", Failures="5" | append [| makeresults 1 | eval api="api1", errorMsg="msg2", Minute=15, Traffic="1786", Failures="2"] | append [| makeresults 1 | eval api="api1", errorMsg="msg2", Minute=30, Traffic="1842", Failures="1"] | append [| makeresults 1 | eval api="api1", errorMsg="msg2", Minute=45, Traffic="1619", Failures="7"] | append [| makeresults 1 | eval api="api1", errorMsg="msg3", Minute=0, Traffic="1234", Failures="15"] | append [| makeresults 1 | eval api="api1", errorMsg="msg3", Minute=45, Traffic="1619", Failures="12"] | append [| makeresults 1 | eval api="api2", errorMsg="msg10", Minute=15, Traffic="7856", Failures="110"] | fields api, errorMsg, Minute, Traffic, Failures | appendpipe [| stats count by api, errorMsg | eval Minute=split("0,15,30,45", ",") | mvexpand apiErrorMsg | mvexpand Minute] | stats sum(Traffic) as Traffic, sum(Failures) as Failures by api, errorMsg, Minute | fillnull value=0 Failures     Table is too large to show, but it doesn't carry with it the total traffic values for each 15 minute bin. I looked at the following solutions, but they are each different enough that their solutions only partially worked as I have 2 group by fields and the APIs and Error Messages are not yet known until the query runs. https://community.splunk.com/t5/Dashboards-Visualizations/how-to-insert-row-on-zero-count-and-still-use-group-by-multiple/m-p/144172#M8722 https://community.splunk.com/t5/Splunk-Search/Any-way-to-return-zero-result-count-stats-of-a-field-such-as-the/td-p/92149 https://community.splunk.com/t5/Security/Search-events-against-a-lookup-table-and-show-matching-count/td-p/47408 https://community.splunk.com/t5/Dashboards-Visualizations/Conditionally-Append-Rows-to-Stats-Table/m-p/121235#M7040 The only problems is the Total Traffic field (total of all calls regardless whether it erred) is missing from many rows. What can I do after the makeresults that will fill this table out correctly?   ... View more