I am trying to create a simple bar chart to check and report status of a service.  Something similar to Intercom Status. (https://www.intercomstatus.com) The bar will show green if the service is up (1), and will show red if the service go down (2), in per day status.  Like a 0 (red) and 1(green).  any suggestions if this can be achieved with Splunk?   ... View more

Hello, I want total of multiple searches in timechart per week. My search in simple format last 90 days: | inputlookup abcd.csv | search host=*CC* | dedup host | stats count(host) as "List1" | appendcols [| inputlookup efgh.csv | search host=*AA* | dedup host | stats count(host) as "List2"] | appendcols [| inputlookup xyz1.csv | search host=*BB* | dedup host | stats count(host) as "List3"] | eval Total=List1+List2+List3 | timechart span=w@1w sum(Total) as "Hosts" If I run it without last timechart line, then it gives me total for 90 days or 1 week, but I need same results calculated weekly using timechart, and display total per week.  ... View more

Hello, I am running a search for last 7 days results, and i am using fixed_date field as _time field. fixed_date can have any value in last 1 year, so I filtering for results of last 6 months.  I want the weekly results to show for every Monday. Below query shows results for last 2 Mondays, but then it pickup Thursday.        index=abcd sourcetype=abcd (IP=x.x.x.x OR IP=y.y.y.y) | eval _time=strptime(fixed_date,"%Y-%m-%d") | where _time > relative_time(now(), "-6mon") | bin _time span=w@w1 | stats count by IP ID _time | stats count as "Fixed vulnerabilities" by _time Results I get: _time Fixed vulnerabilities 2020-05-07 3678 2020-05-14 1455 ....<few weekly results for total 6 months> ...... 2020-10-22 5543 2020-10-29 2212 2020-11-02 7732 2020-11-09 2213     Only last 2 are Mondays, but all before those are Thursdays. how to get it for every Monday? ... View more

I have a dashboard for daily alerts, and I want to add a comment text box at extreme right of it for team to add comments. Splunk query: index=firewall (IP="10.10.10." OR IP="10.10.20." OR IP="100.100.20.*") (Status=deny) | stats count(IP) As "Hits" by SrcIP, DstIP, Port, Status Results in table format: SrcIP DstIP Port Status Hits 10.10.10.1 10.10.10.2 80 deny 11 10.10.20.1 10.10.10.2 443 deny 45 I want to add a Comments text box to extreme right, so that the table will look like this: SrcIP DstIP Port Status Hits Comments 10.10.10.1 10.10.10.2 80 deny 11 10.10.20.1 10.10.10.2 443 deny 45 how to add this on splunk dashboard ? ... View more