Thanks this worked like a charm! ... View more

Thanks a lot! It worked! ... View more

It's working! Thanks a lot 🙂 ... View more

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

Please refer this document https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Eval by using this command, you can use logic for cross transformation ... View more

Hi elliotproebstel Can you please help me with one of my previous question labelled "TRANSFORMING TABLES" I need to join 2 tables without a common field. All rows of 1st table must join with all the rows of the second one. I have also illustrated an example in that question's description. Also link is also given below- https://answers.splunk.com/answers/624552/transforming-table.html ... View more

Great! Some folks don't always think everything through to the end, so I'm glad you have already done so! (And sometimes it's worth noting specifically so someone else with unbounded results might be forewarned just a bit that they'll have to use care with this solution... 🙂 ) Happy Splunking! ... View more

Hi @nkankur, Have you resolved this issue? Can you please share your findings? If it is not resolved, can you please share more information regarding your Instance and app installed. Thanks Kamlesh ... View more

Following is a run anywhere dashboard. Please change the Search queries for Panel 1 and Panel 2 as per your need as the current one are based on Splunk's _internal index, which are used to mock data. <form> <label>Pass Token from Two Panels to Third</label> <fieldset submitButton="false"> <input type="time" token="tokTime" searchWhenChanged="true"> <label></label> <default> <earliest>-60m@m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <single> <search> <query>index=_internal sourcetype=splunkd | stats sum(date_minute) as "Total Bill"</query> <earliest>$tokTime.earliest$</earliest> <latest>$tokTime.latest$</latest> <sampleRatio>1</sampleRatio> <done> <condition match="$job.resultCount$==0"> <set token="Token1">0</set> </condition> <condition> <set token="Token1">$result.Total Bill$</set> </condition> </done> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="underLabel">Total</option> <option name="unit">$</option> <option name="unitPosition">after</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> </single> </panel> <panel> <single> <search> <query>index=_internal sourcetype=splunkd | stats sum(date_hour) as "Expected Bill"</query> <earliest>$tokTime.earliest$</earliest> <latest>$tokTime.latest$</latest> <sampleRatio>1</sampleRatio> <done> <condition match="$job.resultCount$==0"> <set token="Token2">0</set> </condition> <condition> <set token="Token2">$result.Expected Bill$</set> </condition> </done> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="underLabel">Expected</option> <option name="unit">$</option> <option name="unitPosition">after</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> </single> </panel> <panel> <title>Token1: $Token1$ - Token2: $Token2$</title> <single> <search> <query>| makeresults | eval Saving=($Token1$-$Token2$)/$Token1$ | table Saving</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="numberPrecision">0.0000</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="underLabel">Savings</option> <option name="unit">$</option> <option name="unitPosition">after</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> </form> PS: I noticed in query 2 you have used following syntax: | eval value2=(some operation)| rename value2 as "Expected Bill" . Instead you can try | eval "Expected Bill"=(some operation) I have printed Token1 and Token2 values in Third panel for testing whether they are getting set as expected or not. ... View more

Thanks A lot! It's Working 🙂 ... View more

Also not sure what what you mean, but I'll make a couple of guesses. If you are trying to affect the value of an existing column, sometimes I do it like this: |eval Column=if(<Condition>,<new value>, Column) That way, if the condition is not met, the original value is not affected. If the column that you are setting does not exist yet, and you do not want it to exist if not match, I think that could could try something like |eval Column=if(<Condition>,<new value>, null()) ... View more

Thanks a lot! It is working! 🙂 ... View more

HI Can you please check below link?? It is the same question asked by you. https://answers.splunk.com/answers/587912/i-want-to-use-wildcard-in-eval-min-command-as-give.html Happy Splunking ... View more

I can find 3 issues in above query. there is a comma , in your first line end. That's is wrong the string -voice should be concatenated to field using . " (dot and double quotes) to make it a string. the PAC value is doing if based on a numeric value, but you have concatenated with a string. This might give unexpected results Please find corrected query |makeresults | eval total=0| eval VariableA="100"| eval VariableB="200" | foreach V* [eval PAC_<<MATCHSTR>>=<<FIELD>> . "-voice" ] | foreach PAC* [eval <<FIELD>>=if(<<FIELD>> < 0, -<<FIELD>>, 0)] ... View more

V1 V2 V3 Voice 1000 0 0 1000 1000 0 0 1200 1000 0 0 1300 But after the below command it is showing no results. | table V* Voice | foreach V* [ eval "Answer<>"=Voice-'<>'] No Results ... View more