Can you provide a small dataset ? ... View more

Agree with Chris about reading the documentation, but to answer your sepcific question, if you click on the 'Open in Search' button on one of your panels that uses a summary search, a new window will open with the underlying search. The value of source in the query will correspond to the name of the underlying report, which should be listed in Settings>Searches, reports and alerts. Hope that helps, Phil ... View more

I tried this before but for the sparkline it shows a flat line with 0 value all across. ... View more

Thanks again, guys! I was able to get everything working just the way I wanted. I appreciate the help! ... View more

What do you mean by consolidated graph for a week? In you question you had asked for last 7 days graph with different lines. For second query, you can try the following. | rename "NULL_*" as * For finding deviations you would need to add more historic data and possibly use Machine Learning Toolkit for finding suitable algorithm for outlier. ... View more

Hi @kwitczak, In your docker command, you have just mapped 8000 port. docker run -d -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_USER=root" -p "8000:8000" splunk/splunk For accessing management port you have to map 8089 port also. docker run -d -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_USER=root" -p "8000:8000" -p "8089:8089" splunk/splunk As per my suggestion, map below splunk port also. 8191 8065 9997 515 Thanks ... View more