Hi, i have a set of sourcetypes in a lookup. Now my spl has to look for the latest timestamp for all the sourcetypes in the last one hour and report for the sourcetype for which the events are not available in the last one hour ... View more

Hi, I want to find the duration of time for only one sourcetype where as the other values for both the sourcetype.. stats range(_time),values(field_a) by sourcetype,field_b |search sourcetype=abc The above is not helping,coz field_a value is not present in sourcetype abc,so am recieving null value . Suggestions please    ... View more

Hi  I have multiple panels and when i click on some value in one panel the other panels shouldnt be displayed so i unset all tokens. But is there a way to unset all/multiple the token in a easier way @niketn @woodcock  ... View more

I have a single value chart,who statistical date is as below <Field_name> _____________ <field_value>   Now when i click on it,the field name has to be passed as the token value to another panel. How to make that possible. Please advice ... View more

Hi @niketn  Greetings.. I have a requirement where.. My first query is as below: index = <my_index> eventtype=" " | table field1 And the values of my first query has to be used in the search of my second query index=<my_index> source= " " and field1 values.. I tried using join it doesnt seem to help.   Please advice ... View more

Hi, I have a lookup file with the entire list of service names,now i want to perform a search to have the count of the service and and for the service not present in logs for the selected time range but present in lookup file,the count has to be shown as 0 Please assist @niketn  ... View more

I have the below set of events where I wanted to write regex to capture only the last word Kindly help ... View more

I have a lookup file which has below 3 columns. Exception_Name Exception_Keyword Comments REXC RemoteException Alerted JNEXC Exception-NullPointer Ignorable Now in the logs when the Exception_Keyword occurs,It should look for the lookupfile and take the Exception_Name,Comments and give the result with host and count also. And if the Exception_Keyword does not exists in lookup it should be listed as New.. Expected output as below : Exception Name Host Count Comments REXC ABC 27 Alerted javanull ABC 3 New Kindly help please. Thanks! ... View more

I have a lookup file which has below coloumns. Exception_Name Exception_Keyword Comments REXC RemoteException Alerted JNEXC Exception-NullPointer Ignorable Now in the logs when the Exception_Keyword occurs,It should look for the lookupfile and take the Exception_Name,Comments and give the result with host and count also. And if the Exception_Keyword does not exists in lookup it should be listed as New..and when clicking on New it should show me all the new exceptions(_raw events) Expected output as below : Exception_Name Exception_Keyword Host count REXC RemoteException XYZ 67 New soapexception ABC 3 Further drilling down to the New exception It should show me this list of it..Same with others also. ... View more

Hi, I would want to know the current event and the after event of that particular current event. 1.First i would want to search for a particular number sequence 12345. 2.Then find the event that occurs right after it. 3.I want the result to have both the events. 4.index,source and sourcetype for both the events are same. Example: In the below set of data, Srvcs.APIController - Start - [12345] Srvcs.evntcontroller - service not found Srvcs.APIController - attempting Srvcs.APIController - Start - [12345] Srvcs.errcontroller - invalid call Srvcs.APIController - attempting Result i want is Srvcs.APIController - Start - [12345] Srvcs.evntcontroller - service not found And for the second set Srvcs.APIController - Start - [12345] Srvcs.errcontroller - invalid call Kindly help me with this ... View more

Hi, I wanted to extract the words that comes after 3 back slashes as field API Please help me in writing the regular expression ... View more

Can someone help me with Splunk Fundamentals 1 and 2 documents please. Thanks in advance!! ... View more

Hi, Could anyone please help me with use case for Splunk AI - Self Driving cars documents or link please ... View more

Hi, Could you please help me with reference article with examples for 'Splunk & Artificial Intelligence'. Thanks in advance! ... View more

Hi, I want a dashboard in which I have the Splunk queries in a lookup file like the below. Application Name SubName First_Search Second_Search XXX Y XY index=<<search>> index=<<search>> According to the Application,Name and SubName Inputed,my dashboard panels(1 and 2) has to pickup the query from input file and execute it. I'm able to write the below and bring them up in one panel,but I'm stuck how to use the token and how to pass them to pick the Second_Search query from lookup file and display the results in second panle.Kindly help me. <row> <panel depends="$show_panel_unique_users$"> <title>Total Vs Actual Users affected</title> <input type="dropdown" token="tokSearchQuery" searchWhenChanged="true"> <label>Select the Api_Call</label> <fieldForLabel>SubName</fieldForLabel> <fieldForValue>Search</fieldForValue> <search> <query>| inputlookup trial.csv | where Name="$tokapi$" AND SubName="$api_call$" |table SubName Search</query> </search> </input> <input type="dropdown" token="tokSearchresponsecode" searchWhenChanged="true"> <label>Select the Response_code</label> <fieldForLabel>response_code</fieldForLabel> <fieldForValue>response_code</fieldForValue> <search> <query>ABCYRT</query> </search> </input> <table> <title>Note : Click on the "Unique_Users_Count" to see all the Users affected</title> <search> <query>index=abc stats count</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">50</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="response_code"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <drilldown> <condition field="Unique_Users_count"> <set token="selected_Unique_Users_count">$click.value2$</set> <set token="show_panel_actual_users">true</set> </condition> </drilldown> </table> </panel> </row> ... View more