Hi Splunkers,   Is there any way that we can add comments to the dashboard panel to give more information for easy understanding.  For example: If there’s any jump in the trend from previous month to this month. I need to put a comment box and explain why the jump happened. TIA ... View more

Hi Splunkers, I recently set up a use case based of BIAS failure logins with a threshold limit of 9 logins per day according to my company requirements.  Now, My management asking me to check if there are any out of the box Splunk features we could run against BIAS logs + Domain controller logs. Any information regarding this would be helpful. Also, I'm trying to use  "iplocation"  ... View more

Hi Splunkers, I’m working on a Dashboard panel where I have to create a monthly wise data as shown in the screenshot.  I have a field called “age group” and corresponding month’s data. But every month’s data comes from an external lookup file. Data for example: Age Group    Sept        July        Jun 30-90              235          0             34 90-180          1757        2168     3467 180+              19374     20,534  12,661  I’m using this below code but it’s not actually working for me. Please help me with the logic to produce the chart like as it was in the screenshot. TIA   |inputlookup september.csv |stats count by "Age Group" |eval _time=strptime("2022-09-01","%Y-%m-%d") |append [|inputlookup july.csv |stats count by "Age Group" |eval _time=strptime("2022-07-01","%Y-%m-%d")] … |chart count by _time, “Age Group”  ... View more

Hi Splunkers, I’m working on a pie chart where I have to put two different field of results in the graph.  For example.  I have a column called Risk where I’m doing  stats count by risk and putting the values in Pi chart. I also want to add another set of results from a different search. like stats count by SLA,  in the pi chart. How can I append both results into the pi chart.  ... View more

Hi Splunkers, I'm working on two conditions where I need to use condition eval statement. Some filters that I need to add for every condition before I do eval. Please help me in achieving this. Condition 1: Filters to be applied before: id is not "N/A"  AND risk="Critical" AND risk_factor="critical" After satisfying above conditions, I have to create a field called score. eval score=IF(insurance="Y",  instate="Y", age_requirements="y",  30, 60) Condition 2: Filters to be applied before: id is not "N/A"  AND risk="Critical" AND risk_factor="high" After satisfying above conditions. Add to the newly existing field "score" eval score=IF(insurance="Y",  instate="Y", age_requirements="y",  60, 90) TIA. ... View more

Hi Splunkers, I need a help in coming up with a logic in getting values from two lookups to my current search. I'm working on a search which has a field "customer" and I need to bring their ids from two different lookups. Basically, I have to check both the lookups for their ids and write them in the field called "ID" in my current search. TIA Search : customer       ID a                      b          c          d            e          lookup 1                                   lookup 2 customer       ids                    customer      ids a                         1                         d                      4 b                         2                         e                      5 c                         3                         a                      1                              ... View more

Hi Splunkers, I have two lookups where having a common field "values" For example: lookup 1     lookup 2 values           values a                       a b                       e c                       f d                       g I need to compare these two lookups and get the values that are not in the lookup2 (b,c,d). I'm using below query but it's not working. Please help. TIA |inputlookup lookup1.csv |stats count by "values" |search NOT [|inputlookup lookup2.csv |fields "values" | fields - count ] ... View more

Hi Splunkers! I want to achieve a visualization on a report to show the comparison with an arrow (Increase or decrease). I'm attaching the image of what I want to achieve. Please help me to know if there's a way to achieve it or If there's any other trend I can do similar to that. TIA ... View more

Hi All, I'm working on a use case called explicit logins with of collecting eventid 4648. I'm wondering whether this event id tracking clear text passwords or direct logins? I can't tell from the event information as it didn't say anything relates to logon type. Could anyone shed some light on this?  Thanks in advance. ... View more

Hi Splunkers, I'm working on a dashboard panel where I have to show the average count of events for the users. This should be dynamic means it should give the average based on the time I select. Example: users      count a                 9 b                 3 c                 5 d                 2 If I select time frame 7 days and user "a" from inputs, The panel should show the avg of count of events for the 7 days of the user a. Please help me to achieve this TIA. ... View more