Sample Log files Log file1: index,sourcetype,host,entrypost aaa,123,10.12.13.14,text aaa,124,10.12.13.15,text aaa,126,10.12.13.16,text Log file2: index,sourcetype,host,entrypost bbb,141,10.12.13.20,text bbb,144,10.12.13.21,text bbb,148,10.12.13.22,text Expected Output: Suppose, if I select Index=aaa then output list host 10.12.13.14, 10.12.13.15, 10.12.13.16,....... if I select index=bbb then output list host 10.12.13.20, 10.12.13.21, 10.12.13.22,.............. Note: host name is same in both log files ... View more

Hi Stephane, This query is not working as required output. Thanks for your suggestion, but query sample type which I want is not available in reference manual. ... View more

Thanks. I got the list of project_names ... View more

Yes, you can create dynamic dashboard with multiple panels. http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/Buildandeditforms ... View more

Output of above query is count of project names, but i want list of names of project_name. Suppose if I have index=abc, output list should be project_name=xyz, xxx, yzx, .... if index=bbc, then output list should be project_name=yyy, zzz, bbb, ..... ... View more

Below are the two log files- LogFile1 index,sourcetype,host,proj_n,entry_post abc,aaa,10.11.190.12,xyz,text.... abc,aaa,10.11.190.12,xxx,text.... abc,aaa,10.11.190.12,yzx,text.... LogFile-2 index,sourcetype,host,project_n,entry_post bbc,aaa,10.11.190.12,yyy,text.... bbc,aaa,10.11.190.12,zzz,text.... bbc,aaa,10.11.190.12,bbb,text.... ... View more

I tried using above query to fetch list of project_names from different index_names, project names has different field names for each index. index=$index_name$ sourcetype=$source_type$ host=$host_name$ | eval Project_N=if($index_name$=="xyz", "project_n= * ", "proj_n= * ") | chart count(host) as hostname by Project_N I tried using cases, if statement and coalesce function but not getting list of project names. 2 Logfiles for your undestanding - Below are the two log files- LogFile1 index,sourcetype,host,proj_n,entry_post abc,aaa,10.11.190.12,xyz,text.... abc,aaa,10.11.190.12,xxx,text.... abc,aaa,10.11.190.12,yzx,text.... LogFile-2 index,sourcetype,host,project_n,entry_post bbc,aaa,10.11.190.12,yyy,text.... bbc,aaa,10.11.190.12,zzz,text.... bbc,aaa,10.11.190.12,bbb,text.... Suppose if I have index=abc, output list should be project_name=xyz, xxx, yzx, .... if index=bbc, then output list should be project_name=yyy, zzz, bbb, ..... ... View more

Hi Mason, Thanks for your reply, this is not working I want list of project names available in given timeperiod. I have to try by project_n=(star) or proj_n=(star) (project_n=star or asterisk) ... View more

Hi Chimell, Thanks for your reply, this is not working I want list of project names available in given timeperiod. I have to try by project_n=(star) or proj_n=(star) (project_n=star or asterisk) ... View more

Hi Stephane, Thanks for your reply, this is not working I want list of project names available in given timeperiod. I have to try by project_n=(star) or proj_n=(star) (project_n=star or asterisk) ... View more

Thansk Gys, I tried using your query but no output. Let me tell you few things We have project names with different fields names in different index. Suppose if I select index1 (abc) i want project names (fieldname of project names is "proj_n") from index1 list and if I select index2 (xyz) I want project names (fieldname of project name is "proj_names") from index2 list. ... View more