There several solution, I usually prefer the one described in the Splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603) in the example "link switch". In this way you can have in the same dashboard more dashboards, each one with a limited set of panels, and pass from one to another using the link switch in the header. Ciao. Giuseppe ... View more

What do you mean 'download a csv for each row'? Where is this CSV coming from? Is this data in Splunk already? ... View more

Hi @revanthammineni  Just add following line in at the of the query  or before stats/chart/ that you are using in query  | eval Country=if(Country="Tokyo","Japan",Country)     ---- Regards, Sanjay Reddy ---- If this reply helps you, Karma would be appreciated. If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

In SimpleXML, you could have a html panel with your comment. You could then make this panel depends on the existence of a token. You could then set or unset this token depending on a result from your dashboard panel search ... View more

Abnormal account activity is a broad topic for which Splunk has a dedicated product - UBA (Use Behavior Analytics). The Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435) has example searches for geographically improbable access and access outside of business hours.  You should be able to adapt them to your needs. ... View more

@revanthammineni - If @woodcock 's reply answered the question then kindly mark it as "Accept as Solution" so other people in the future can get benefit from it. ... View more

OK, it sounds like your actual data already has the counts in? This means that your example search would also have returned 1's Try summing the counts (assuming the count column in your csv is called "count") |inputlookup september.csv |eval _time=strptime("2022-09-01","%Y-%m-%d") |append [|inputlookup july.csv |eval _time=strptime("2022-07-01","%Y-%m-%d")] | chart sum(count) by _time "Age Group"  It is often helpful and less time-consuming if you provide as much information about your problem as possible so we are not left guessing and end up providing incorrect solutions based on false assumptions. ... View more

The pie chart can only show one series - have you tried to use trellis to show multiple pie charts for multiple series. ... View more

Thanks man!! It worked ... View more

Worked like a charm. Thank you!! ... View more

Hi @revanthammineni, Your conditions are very similar but else values are overwriting. You can use below to give an idea. | eval score=if(searchmatch(insurance="Y" instate="Y" age_requirements="y" id!="N/A" risk="Critical" risk_factor="critical" ), 30, 60) | eval score=if(searchmatch(insurance="Y" instate="Y" age_requirements="y" id!="N/A" risk="Critical" risk_factor="high" ), 60, 90) ... View more

Hi @revanthammineni, you have to apply two times the lookup command (https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Lookup) , something like this: <your_search> | lookup your_lookupA.csv customer OUTPUT ids | lookup your_lookupB.csv customer OUTPUT ids | table customer ids Ciao. Giuseppe ... View more

That search seems to work, but without knowing what you are getting it's hard to say, but this is another way to do it |inputlookup lookup1.csv | eval source="v1" | append [ |inputlookup lookup2.csv | fields values | eval source="v2" ] | stats values(source) as sources by values | where mvcount(sources)=1 AND sources="v1"  or you could do it like this | inputlookup lookup1.csv where NOT [| inputlookup lookup2.csv | fields values ] ... View more

See the Splunk dashboard examples app from Splunkbase https://splunkbase.splunk.com/app/1603 which has numerous visualisation examples and tips Take a look at the example Table Icon Set (Inline) ... View more

| chart count by name month ... View more

Create an input that contains your users Create / use a time picker to select the time range Create a panel which filters the search based on the user you selected and calculates the average for that user ... View more

Here is a link to Slack channel https://splunk-usergroups.slack.com/archives/C02QJCLUFD4 And some other blogs / information about it https://www.splunk.com/en_us/cyber-security/log4shell-log4j-response-overview.html https://www.splunk.com/en_us/blog/bulletins/splunk-security-advisory-for-apache-log4j-cve-2021-44228.html https://www.splunk.com/en_us/blog/security/log4shell-detecting-log4j-vulnerability-cve-2021-44228-continued.html https://www.splunk.com/en_us/blog/security/log-jammin-log4j-2-rce.html   ... View more

Hi @revanthammineni, the first thing you could do it's installing Enterprise Security Content Updates (ESCU) from Splunkbase (https://splunkbase.splunk.com/app/3449/) in this way you'll have up around 300 Use Case already available that you can enable if you have the related logs. In addition I hint to follow the videos on YouTube and eventually to follow a training on ES Admin. Ciao. Giuseppe ... View more

Thank you for the answer. I was thinking of going through a python script and do it but your answer gave me a hope. Appreciate it! ... View more

It is a working sample. Maybe something causing an error on your search string. are you using double quotes for your savedsearch name? If yes please try below,. You can also test with output mode csv, curl -u user:password https://splunk_server:8089/services/search/jobs/export -d search='savedsearch abc' -d output_mode=csv   ... View more

Hi. I’m having an issue related to my savedsearch. I created a saved search and scheduled it. But it is not showing up when try with the API endpoint.  /search/saved/searches. I can only see few of the reports. any recommendations? TIA. ... View more

Direct the ServiceNow team to Splunk's REST API docs: https://docs.splunk.com/Documentation/Splunk/8.1.2/RESTTUT/RESTTutorialIntro https://docs.splunk.com/Documentation/Splunk/8.1.2/RESTUM/RESTusing https://docs.splunk.com/Documentation/Splunk/8.1.2/RESTREF/RESTprolog ... View more