I know this conversation was a long time ago, but Did you find the answer? I have exactly the same question, but do not understand the answers posted here. I just want to replace the file, I am surprise there is not an update option in the lookup. ... View more

Did you find the answer? I have exactly the same question, but do not understand the answers posted here. I just want to replace the file, I am surprise there is not an update option in the lookup. ... View more

It is sorting the buckets as text, all the 10, 100 etc first. Is there a way to order the buckets as number? Or I am asking too much? :) ... View more

Yay, thank you very much!!! ... View more

Hi, thank you, it is getting closer but it is still not working. When I enter this: index="mobile_app_tracking" event=song |stats count(data.url) as SongsPlayed BY userEmail | bin SongsPlayed span=10 I see results, emails with the bucket where they belong But, when I put the whole thing as you suggested, I get nothing, no results! ... View more

Thank you that works, but it is giving me users per 10 seconds, I think? I want to count number of users, and the number of songs they play. My basic query gives me the user email and the number of songs they listen to. What I want is to group those users in buckets, of those who listen between 0 and 10, those who listen to etc. So for example, it would be a bar graph for each bucket of songs. 10 users play 0-10 songs 34 users play 11-20 songs etc ... View more

The purpose of the dashboard is to have it be a permanent display on a monitor in our office, opened on launch by a rasberry pi That is why we cannot login. I tried exporting the dashboard to PDF, but it spins forever without creating the pdf. Suggestions? @Rob2520 ... View more

Could you tell me what the purpose of the the HTML dashboard is? For my purpose, I am wondering if just creating a PDF of the Dashboard would suffice. ... View more

Would it be a better option to convert the Dashboard to html? Would that html page be able to be seen but those without Splunk? ... View more

Ok, now can a report be more than one search string? Meaning I have a dash with many dashlets, Can that become a report? ... View more

Beside the PDF delivery there is no way? We want to show the dash on a special monitor to show stats in the office. but the monitor has no mouse or keyboard, so there is possibility to login. ... View more

Yes, it shows me all the emails!! Thank you very much for all your help! ... View more

Yes, it shows me all the emails!! Thank you very much for all your help! ... View more

Just so you know, I did the whole thing with a Control file (pulled from my original query) And it worked perfectly. One question if I may, when i run the query for F17-created, if the time is the last 24 hours, I get one. If the time is All time, I get none. I do not understand that. Again, thank you for your help. ... View more

Thank you again! I had not created a Lookup Definition. I just did that, and corrected the syntax. I got a result, only for one email out of 300. I will have to do it all again with a file of users that I know use the system just to verify that the result is correct. Thank you very much for your help! ... View more

Thank you! I uploaded csv called in Splunk "F17-created.csv" to the search app with all apps permissions, all users. File only has one column, first row called email_address. I did not create a Lookup definition. Here is the query: index="mobile_app_tracking" event=song [|inputlookup F17-created |stats values (email_address) A userEmail ] |chart count (data.url) as SongsPlayed over userEmail |sort -SongsPlayed I am not familiar with the square brackets. I get this error with the brackets: Error in 'inputlookup' command: This command must be the first command of a search. And without brackets I get the same error: Error in 'inputlookup' command: This command must be the first command of a search. Suggestions? ... View more

Sure! for example this querie index="mobile_app_tracking" event=song |chart count(data.url) as SongsPlayed over userEmail |sort -SongsPlayed Tells me how many songs were played by each userEmail. Now, I want to do this but for a predefined set of emails. Imagine an excel with 300 email addresses, I want to know how many songs these specific email address (in my excel) played? or even if the played at all. Is that possible? ... View more