ok so i was able to figure it out but now i have new issue that i don't know even where to start i have a list of alerts that i want to move from one splunk app to another is there a way to do it with script ? because doing it one by one will take me forever. i have a file with - alert name, alert id, current app name, new app name ... View more

this is an example to make results : | makeresults format=json data="[{\"browsers\":{\"0123456\":{\"id\":\"0123456\",\"fullName\":\"blahblah\",\"name\":\"blahblah\",\"state\":0,\"lastResult\":{\"success\":1,\"failed\":2,\"skipped\":3,\"total\":4,\"totalTime\":5,\"netTime\":6,\"error\":true,\"disconnected\":true},\"launchId\":7}},\"result\":{\"0123456\":[{\"id\":8,\"description\":\"blahblah\",\"suite\":[\"blahblah\",\"blahblah\"],\"fullName\":\"blahblah\",\"success\":true,\"skipped\":true,\"time\":9,\"log\":[\"blahblah\",\"blahblah\"]}]},\"summary\":{\"success\":10,\"failed\":11,\"error\":true,\"disconnected\":true,\"exitCode\":12}}]" ... View more

it's too long to paste it here 😞 ... View more

this is the output of the query :   also, example of my event : browsers: { [+] } coverageResult: { [+] } libraryPath: libs/funnels result: { [-] 82348856: [ [+] ] } summary: { [+] } } ... View more

browsers: { [+] } coverageResult: { [+] } libraryPath: libs/funnels result: { [-] 82348856: [ [+] ] } summary: { [+] } } ... View more

Hello Thanks for your reply. I have few heavy dashboards that most of them are using the same base search so i thought that summary index can be the right way to reduce the running time. As I understood from documentation, I need to create a report that running the base search and schedule it to run once a day and send the result to summary index, is it right ? If yes, should I run the dashboards with the summary index and the "regular" index ? also, If the report results are saved in summary index, does it mean the logs are saved twice ? once in the "regular" index and once in summary index ? ... View more

Hello It looks good but once im clicking on one of the graphs its shows no results: also, i want to visualize by Level as well ... View more

ok, i found the problem one of the panels that updates the table is trellis_pie and this token is the one that brakes every thing so i guess i configured it wrong what is the right way to configure trellis_pie token ? this is the source: <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.chart">pie</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.drilldown">all</option> <option name="charting.legend.placement">none</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">1</option> <drilldown> <set token="host_exposure_level">$row.category$</set> </drilldown> </chart> ... View more

ok, i found the problem one of the panels that updates the table is trellis_pie and this token is the one that brakes every thing so i guess i configured it wrong what is the right way to configure trellis_pie token ? this is the source: <panel> <chart id="trellis_pie"> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.chart">pie</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.drilldown">all</option> <option name="charting.legend.placement">none</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">1</option> <drilldown> <set token="host_exposure_level">$row.category$</set> </drilldown> </chart> </panel> ... View more

Hello i've tried to add * as the initial value but its not working in default initial value ignored once default value is configured.   ... View more

Hello Each filter have default value "*" this is an example for the source of 2 filters : <input type="multiselect" token="Account_Label_Azure"> <label>Account Label Azure</label> <choice value="*">ALL</choice> <default>*</default> <fieldForLabel>Account_Label_Azure</fieldForLabel> <fieldForValue>Account_Label_Azure</fieldForValue> <search> <query>index=report Account_Label_Azure=*</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="multiselect" token="Account_Label_VMware"> <label>Account Label VMware</label> <choice value="*">ALL</choice> <default>*</default> <fieldForLabel>Account_Label_VMware</fieldForLabel> <fieldForValue>Account_Label_VMware</fieldForValue> <search> <query>index=report Account_Label_VMware=*</query> <earliest>-24h@h</earliest> <latest>now</latest> </search>   and this is the source of the table  <table> <search> <query>index="report" Category__Severities_of_Patches="$host1$" OR Category__Categories_of_Patches="$host2$" OR Category__Sources_of_Patches="$host3$" OR exposure_level=$host_exposure_level$ OR Computer_Name="$computer_name$" OR Account_Label_Azure="$Account_Label_Azure$" OR Account_Label_VMware="$Account_Label_VMware$" OR BigFix_Groups="$BigFix_Groups$" OR Category__Sources_of_Patches="$Category__Sources_of_Patches$" OR Custom_Attributes="$Custom_Attributes$" OR Custom_Site_Names="$Custom_Site_Names$" OR IP_Address="$IP_Address$" OR Operating_System="$Operating_System$" OR OS="$OS$" OR Pending_Restart="$Pending_Restart$" OR Power_State_VMware="$Power_State_VMware$" OR Provider_Name="$Provider_Name$" OR Relay="$Relay$" OR State_Azure="$State_Azure$" OR VM_Region="$VM_Region$" OR Tags_Azure___cost_environment=$Tags_Azure___cost_environment$ OR Tags_Azure___cost_servicegroup=$Tags_Azure___cost_servicegroup$ OR Tags_Azure___cost_team=$Tags_Azure___cost_team$ OR Custom_Attributes=$Custom_Attributes$ | table Computer_ID Computer_Name Account_Label_VMware Account_Label_Azure Provider_Name OS Relay VMware_Tags Tags_Azure Custom_Site_Names Pending_Restart Custom_Attributes Last_Report_Time Last_Updated Free_Space_on_System_Drive_(GB) Power_State_VMware State_Azure BigFix_Groups Category__Names_of_Patches Category__Severities_of_Patches Category__Categories_of_Patches Category__Sources_of_Patches Category__CVEs_of_Patches Category__Release_Dates_of_Patches</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> ... View more

solved it by changing to stats. thanks ... View more

so what sould i do ? replacing it with timechart returns also no results ... View more

Well, ive changed it to this : | eval category=exposure_level | timechart span=1d count(Computer_Name) as totalNumberOfPatches by category but still no results ... View more

Hello Thanks ! it looks good but i still have few issues : i configured this : <style> #trellis_pie div.facets-container div.viz-panel:nth-child(1) g.highcharts-series path { fill: blue !important; } #trellis_pie div.facets-container div.viz-panel:nth-child(2) g.highcharts-series path { fill: yellow !important; } #trellis_pie div.facets-container div.viz-panel:nth-child(3) g.highcharts-series path { fill: red !important; } #trellis_pie div.facets-container div.viz-panel:nth-child(4) g.highcharts-series path { fill: green !important; } #trellis_pie div.facets-container div.viz-panel:nth-child(5) g.highcharts-series path { fill: gray !important; } </style> if i understand correctly, the order of the colors is the order of the conditions in the "case" so, in that case, "High Exposure" supposed to be red but actually its blue, "Low Exposure" supposed to be blue but its yellow and "Medium Exposure" supposed to be yellow but its red, the other two does not shown but it supposed to.  also, i don't see the number of results in the pie, i just see "other" even thought Minimum size set to 0   ... View more

sorry , category = exposure_level ... View more

exactly and will show the number of the count for the specific category ... View more

separate once ... View more

Thanks It looks better I just want to color the pie in different colors so :  "Low Exposure" - blue  "Medium Exposure" - yellow "High Exposure" - red "Compliant" - green <not reported> - gray I couldn't find an option to do it  ... View more