Hi, I have an index= random_index which contains JSON data of a URL HTTP status code like {'availability':200,application:'random_name'}. the above index gets  input  from an RPA bot through sent to the splunk http event collector endpoint every hour. example search query  index=random_index earliest=-24h latest=now |  search availability=200 | lookup Application_details.csv application OUTPUT Service,ServiceOffering,AssignmentGroup,Priority | stats count as avaibility_count | eval availability_percentage=  (avaibility_count/24)*100 | search availability_percentage < 95 | table availability_percentage,Service, ServiceOffering,AssignmentGroup,Priority | appendpipe[  | stats count  | where count=0 | appendcols [| eval availability_percentage=0,Service=random_service,AssignmentGroup=random_group etc | table availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority ]] | dedup availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority | table availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority       if the percentage is less than 95% then we will trigger an email and create a ServiceNow incident through the row that is returned in the Splunk search but in case the index didn't receive the data per hour due to some error, how to check that and still return a dummy result only if no results are returned but not to return the dummy result in the append-pipe section  in the case where availability is less than 95%       ... View more

KPI XYZ-123 XYZ-12345 Service-123 Service-12345 random_data random_data random_data random_data random_data random_data random_data random_data random_data random_data   I Have a dashboard like this one above , I want to enable drilldown for the columns whose field-names start with XYZ and disable drilldown for the ones that start with Service. Is there any way i can achieve this in xml ? ... View more

i have a query like index = xyz | eval assignment= upper(assignment) | eval SO = upper(SO) | eval Ser = upper(Ser) | join type=inner assignment,SO,Ser [ I inputlookup xyz.csv | table assignment,SO,Ser | eval assignment= upper(assignment) | eval SO = upper(SO) | eval Ser = upper(Ser) ] is this is a valid query because i want only the events containing the common fields (assignment,SO,Ser). ... View more

  TYPE Month KPI_1 KPI_2 GLOBAL Oct'21 76 24 LOCAL Oct'21 46 67   I'm searching the table like | search TYPE="GLOBAL" | search Month="Oct'21" Then i'm transposing the table after  deleting the months field | fields - Month | transpose header_field=TYPE column_name=KPI  My problem is sometimes when I'm searching something that is not there like Month="Sep'21" only the first column of the transposed table is coming like KPI KPI_1 KPI_2 How to show no results found instead of this 1 column table ... View more