Index = prod-x7 host IN ( 12345678) sourcetype=“Wineventlog” Eventcode=“19” |eval patching = if(eventcode =“19”, “ok”, “not ok”) If events are found then search server availability i.e., index= server_123 host in (12345678) uri_stem IN (http/hltchck) | status count eval( status=100) as success, count as total by _time |eval Percent = round((Success/total)*100,2) | table Percent   how to merge this two diff querys. But display only if the patching has happened  ... View more

I am getting the events from an Australian timeline. But time running in my laptop is IST. So, when i try to calculate the events from today beginning i.e., 12:00 am  to latest now with span of 3h. i having my stats showing the timechart starts from yesterday 10pm. I don't understand the mistake. But above the results it showing the events from 8,sep,2021 00:00:00 to 8, sep,2021 13:53:12(now). But i Don't know why it is starting to show from 10 pm yesterday. I calculating the avg of the results of particular field. ... View more

I need all the stats on x-axis .  ... View more

We have the count of different fields We need to get all that data on x-axis for the that we are using appendcols more than thrice. Our data base contains huge data running search command more than once is creating a problem. We would like to group the count data. Can i please know how. Below is the query we are using: index="main" sourcetype="SF1" | stats count(CASS_RESULT) as CASS by CASS_RESULT |appendcols [search index="main" sourcetype="SF4" | stats count(DIALOGUE_RESULT) as DIALOGUE by DIALOGUE_RESULT] |appendcols [search index="main" sourcetype="SF2" | stats count(TPOS_RESULT) as TPOS by TPOS_RESULT] |appendcols [search index="main" sourcetype="SF3" | stats count(PCO_RESULT) as PCO by PCO_RESULT] |appendcols [search index="main" sourcetype="SF5" | stats count(VAS_RESULT) as VAS by VAS_RESULT] |table CASS_RESULT CASS DIALOGUE TPOS PCO VAS | transpose header_field=CASS_RESULT ... View more

Hi , I would like to share my splunk dashboards for my clients and other users. How can i share with them. Like should i create a role and share for them by allotting specific permissions. If yes, How please let me know the steps. If no, Can i know why? ... View more

bin _time span=1d |stats count by _time | eval time_chunk = case( _time > relative_time(now(), "-30d") AND _time < relative_time(now(), "-45d"), "Applications sits in New Applications Status > 30 days", _time > relative_time(now(), "-45d") AND _time < relative_time(now(), "-60d"), "Applications sits in New Applications Status > 45 days", _time > relative_time(now(), "-60d") AND _time < relative_time(now(), "-90d"), "Applications sits in New Applications Status > 60 days", _time > relative_time(now(), "-90d") ,"Applications sits in New Applications Status > 90 days") | stats count by time_chunk   ... View more

Hi, I need to get the no.of events happened over last 90 days, 60 days, 30 days in one column chart. Using eval, if. Use the if command to group the events by their time stamps. ... View more