I have use case to use the ML feature to detect  the  anamoly in comm sent from each ID. I was trying to get the same from predict function, but there is multiple ID's and I can't set an alert/report individually for all ID's. How I can use the same, Please help. Query which I am trying: index=indexhc source=hcdriver sourcetype="assembly" appname="marketing" ID IN (abc,xyz,qtr,jyk,klo,mno,ghr)  | timechart span=1d count as commSent by ID | predict commSent as predicted_commSent algorithm=LLP holdback=0 future_timespan=24 | eval anamoly_score=if(isnull(predicted_commSent),0,abs(commSent - predicted_commSent)) |table _time,ID,commSent,predicted_commSent,anamoly_score Above query is not giving any output,it seems predict command doesnot work with multiple columns. Please suggest. ... View more

Hi Team, I have multiple jobs runs daily . Showing the status of these jobs in table. Now, I want to highlight the cell depend on the jobs run time.  For example there is three jobs .. Job Name A1 A2 A3  and data for 3 days is like date                    jobName              StartTime                                       Status 22-02-2022      A1                            22-02-2022 01:00:00         Success 22-02-2022      A2                            22-02-2022 04:00:00           Success 22-02-2022      A3                             22-02-2022  02:00:00          Success 23-02-2022      A1                            23-02-2022 00:50:00            Success 23-02-2022      A2                            23-03-2022 00:10:00           Success 23-02-2022      A3                             23-03-2033  03:00:00         Failed 24-02-2022      A1                            24-03-2022 00:20:00          Success 24-02-2022      A2                            24-03-2022 01:00:00          Success 24-02-2022      A3                             24-03-2033  00:00:00        Success Now , I want   Job dependencies 01: If A2 runs before A1 then it should be highlighted with a different color., suppose red Job dependencies 02: If A3 runs before A1 then it should be highlighted with a different color., Yellow And at last table will look like Date A1 A2 A3 22-02-2022 Success Success Success 23-02-2022 Success Success Failed 24-02-2022 Success Success Success Please help me to achieve this without using JS. ... View more

Hi Team, I have installed donut custom visualization app from splunkbase https://splunkbase.splunk.com/app/3150/ Its says , drilldown feature exist of this app , but when click on one part of donut and tried to pass the value by $click.value$ /$click.value2$, its not working. How to enable drilldown for clicked value in Donut custom visualization . Please suggest ... View more

Hi, I have field as Jan , Feb ,Mar .... Dec with values for each month and I want to take sum of current month and last month. I was truing to first check the current month and last month using eval like below and this eval gives me the current month name(Jul) , last month as Jun eval curr_mon=strftime(now(), "%b") eval last_mon= strftime(relative_time(now(),"-mon"),"%b") Now I have field names Name     id            Jan Feb Mar Jul Jun Aug xyz      123A         10    20  20    25   30   15 ABC    145B          20    15  30   25   30    20 Want to take sum of current month and last month field with stats, I tried like below but got no results; stats sum('curr_mon') as current_total sum('last_mon') as last_total I want this search to automatically show the current month's sum, and not using a static value in the stats sum expression. Please suggest. ... View more

HI, I wanted to show the Application running on line chart. Process start_time is _time and have duration and application . Wanted to show the chart by application which starts at _time and comes down after the given duration. For example, below is two events: _time host duration Application 2020-04-21 16:51:29 ABC 01:43 XXXX 2020-04-21 16:46:29 ABC 03:56 XXXX 2020-04-21 16:56:29 ABC 06:43 YYYY so, first event it should show the line goes up at 2020-04-21 16:51:29 and after 1:43 duration line goes down. Is this possible? Please suggest. ... View more

HI, I have searching data from only first 6 days of each month i.e for example: from 1st April to 4th April 2020 My first time value is 04/01/2020 09:20 and the latest is 04/07/2020 07:05, but in the timeline chart visualization its displaying axis label as 04/01/2020 04/07/2020 04/14/2020 ........ 05/02/2020 Is it possible to force the timeline to display the full range of only my search, or manually set the time range? I want the timeline to always displays the values which only in time field . Any advice and assistance is appreciated. Thanks, ... View more

Hi, I have below multiselect filter , based on username="ABC" , I need to display two more filters.( ip, city) And when those two input multiselect values should also reflect on our all panel , else it should not get search <input id="selid"> <search > <query>search user IN ($seluser$) | table id | dedup id</query> </search> <delimiter>, </delimiter> <default>*</default> <change> <condition value="ABC"> <set token="set_tok"></set> <set token="set_info"> ip IN ($selip$) city IN ($selcity$)</set> </condition> <condition> <unset token="set_tok"></unset> <set token="set_info"></set> </condition> </change></input> Base query: index........ | search name IN ($selname$) user IN ($seluser$) id IN($selid$) $set_info$ Now , I want to show below as in panel When I select user=ABC index ... | search name IN ($selname$) user IN ($seluser$) id IN($selid$) ip IN ($selip$) city IN ($selcity$) else for other user index ... | search name IN ($selname$) user IN ($seluser$) id IN($selid$) I am getting problem , when I am trying to change the value on any of those two filter (ip, city) , its only taking the initial value , when I changed to anything else no effect on panels, Please suggest , what I am doing wrong here. ... View more

Hi, I need to Optimize my query to improve the dashboard performance without using any type of join function. Below is my query | inputlookup sample.csv | search user IN ( ) application_name IN () "application id" IN (*) |eval None="None" | table "application id",application_name,user,"Status",Type,"Service Host",Platform,Jan,Feb,Mar,Apr,None,env | rename "application_name" as Server_Name | eval Server_Name=upper(Server_Name) | join type=left Server_Name [ search index=idx sourcetype=xyz | eval Server_Name=upper(Server_Name) | search Status!="Completed" | table Server_Name Status] | search Status!="Completed" | stats sum("Jan") as jan sum("Feb") as feb sum("Mar") as mar sum("Apr") as apr by env | eval total = jan+feb + mar + apr |table env total Please help me to optimize this query without using join ... View more

Hi Team, I have created one custom alert action to get all triggered alert details. I am unable to get triggered actions. How do I get the Triggered actions like email, slack, from parameter of my alert_actions.conf I am trying to add a parameter $alert.action$ into my alert_actions.conf (param.action=$alert.action$) but that giving me blank ,after alert triggered. The test alert has triggered actions of slack and email both. I have tried like this also (param.action=$action$) or (param.action=$trigger_action$), but all not working. Please help , any tips or hints appreciated. Thanks, ... View more

Hi , I want to show dashboard showing Alert statistics. Like total number alerts exists on app , Number of alerts sent , Number of alerts triggered , Number of total alerts notified to slack channel etc. So, how to get all alert details from internal index? Please suggest. ... View more