I am doing some analysis on our existing searches. What I would like to do is run the saved search when I get the result from a rest search. Right now I have the following, which was working at one point but not sure why it isn't now.     |rest /servicesns/-/-/saved/searches | where title = "test" | fields search | map search="|makeresult | map search="$search$""     I have used this before and it was working but some reason now it is not but I can't tell why. Right now I am just running it in a search not in a dashboard.  ... View more

I have a search where I have multiple evals to check if items are true of false. With my results I want to show something like: Search Triggered Scheduled Test TestAlert1 True True True   Currently what I am getting is something like this: Search Triggered Scheduled Test TestAlert1 True False False TestAlert1 False True False TestAlert1 False False True I am thinking I need to use xyseries chart but am not sure. ... View more

I want to use predicted values in my search and apply them to a time chart. What would be the best way to store these values for future use? I am thinking a summary index would be ideal but I am not sure if there is a different way I might want to store it. I want the time chart to show some bounds as well based on the predicted values to help with analyzing what expected performance/traffic would be like. ... View more

I am working on migrating some items over to dashboard studio. I have a very simple stats command getting a few counts. One item I have is to just get an average response time, avg(responseTime). When I put this into my search the column doesnt get results, other columns like count(eval(status=OK)) populate fine. Also if select to run the item as just a search it works fine and all my data shows. Anyone else have similar issues? ... View more

I wanted to establish an alert that will look at the past hour for the past 6 weeks and make some comparisons. So for 2 PM I will have 6 results for week 1,2,3.... I know I can use date_hour but I need something that I can set when the alert runs, so for the last 60 minutes somehow.       index=text source=text date_hour=14 | timechart span=1h count      Is there a way I can do this more easily?   ... View more

I am using dashboard studio and had a base search that is just a macro then chained that to a search creating a table. When I try to use this in the table nothing shows up. If I take the chain search and move it fully to its own base search I get results. Is there something I am missing that a chain search can't have certain commands? I have stats and evals in there also; do they need to be part of the base search and not the chain? ... View more

I have a field with error messages that I need a case statement to cleanup for reporting. In this case some of the messages contain ID's which make the report long as each error has a unique ID. I want to lean this up by using something like eval error=case(like(error, "%DB Error"), "Database error", like(error, "%network Error", "Network Error"))... Etc. I am not getting the matches that I should be getting with this though, still the full errors are showing. Is there a better way to accomplish this? ... View more

General question on how people might be baselining for alerts. At this time our alerting is over complicated and cumbersome, our basic alert setup is 150+ lines. I have looked at cutting this down a lot by using some prediction models which seems pretty good but wondering if there are any good articles or documents others have come across on this. ... View more

I am looking to calculate per second transactions but when doing so through either stats or a timechart I am hitting the limits of these functions. This is in a dashboard with a time selector so it can be variable. Is there any way to protect against running over the limits in a search? I was using the per_second function in timechart. Has anyone found a better way to handle getting average, min/max at a per second interval?     timechart span=5m per_second(count) as TPS      ... View more

I want to get a per second average over a period of time. I am running into an issue getting an average of these values. For example one item only occurs 4 or so times and when I calculate the average I get 1; it is not considering the seconds where there are no results. I am doing the following now:   | bin _time span=1s |stats count as Vol by foo | stats avg(vol) by foo   I would expect to get a very low decimal due to all of the 0 values but, I get 1. I have attempted multiple ways of doing this but it seems that it is only doing an average of the existing values, not the times where I do not have results. ... View more

I have an event list in a dashboard so I can use a workflow action. What I found is that it would be easier to have a drill down in the panel to get to the URL the workflow is using. Putting the data into a table is not ideal based on how everything gets formatted. I wanted to still use the Event panel type; is it possible to append a column between Time and the Event? ... View more

I have an event action I want users to be able to access in a dashboard. Right now I need to include an event panel, and then users need to go through there to access it. Is it possible to call the event action through a hyperlink? ... View more

I have a set of trellis items that I want to show in a dashboard. With the results though I want to set the height dynamically to show all the trellis structures correctly. Is there a way I can get the count returned from the job as to how many trellis' the job created? ... View more

I had annotations I wanted to control with a Yes or No dropdown. It mostly works, unsetting the token doesn't seem to clear the token correctly as the annotations remain.      <search depends=$showToken$ id="base"> <query>search.....</query> </search> ... <input type="dropdown" token="showToken" searchWhenChanged="true"> <label>...</label> <choice value="yes">Yes</choice> <choice value="no">No</choice> <change> <condition match="$value$ == &quot;yes&quot;"> <set token="showToken">true</set> </condition> <condition match="$value$ == &quot;no&quot;"> <unset token="showToken"></unset> </condition> </change>   is there a better way to accomplish this easily? I saw an older post that said using javascript could work but I need to do this through only XML at this time. ... View more

I was working on using | rest ....alerts/fired_alerts to create annotations for a dashboard. I thought I read somewhere that the way the fired_alerts are stored is that on a restart of Splunk this data will be lost. Is this true on Cloud? ... View more

I am working on using prediction for alerting. I want to track some data I have that has some business trends; it is fairly seasonal. Right now we manually calculate a baseline; which only works if our data is stable. So I have found as our traffic rises and falls through the seasonality of it; our calculated baseline is inaccurate most of the time. I have created a prediction based alert but it has not been received too well since it uses standard deviation. Is there an issue to base alerting from standard deviation? Just trying to under stand if there is some limitation or if it is error prone. The data I am getting seems to be accurate thresholds for the alerts. ... View more

I am using a bin of 10 minutes with stats for the past hour. What I am running into is that when doing so not all items in my stats command have a count for one of the buckets. For example one might show up for the 10, 20, 40 minute buckets but, I want to the 30 and 50 minute buckets to show blank values. What is the best way to accomplish this? Fillnull does not work for this since there is no null value, the value just is not showing at all. ... View more