We have a table where i see no data for few coloumns tried fillnull value=0 but its not working. But this is happening only when there no count for complete column, for example, For invalidcount we have data for Login but no data for other applications so it automatically filled zero values,  but for rejectedcount, trmpcount, topiccount there is no data for any application  0 value is not getting filled up. Application incomingcount rejectedcount invalidcount topcount trmpcount topiccount Login 1   2 5     Success 8   0 2     Error 0   0 10     logout 2   0 4     Debug 0   0 22     error-state 0   0 45     normal-state 0   0 24       ... View more

original query: index=splunk-index   |where  message="start"  |where NOT app IN("ddm", "wwe", "tygmk", "ujhy") |eval day= strftime(_time, "%A") |where _time >= relative_time(_time,  "@d+4h") AND _time <= relative_time(_time, "@d+14h") |where NOT day IN("Tuesday", "Wednesday", "Thursday") To suppress my alert, i created a lookup file and added the alert name and holidays dates as shown below: Alert Holidays_Date App Relative Logs Data 8/12/2023 App Relative Logs Data 8/13/2023 App Relative Logs Data 8/14/2023 App Relative Logs Data 8/18/2023   Query with inputlookup holiday list: |inputlook HolidayList.csv |where like(Alert, "App Relative Logs Data") AND Holidays_Date=strftime(now(), "%m/%d/%y") |stats count |eval noholdy=case(count=1, null(), true(), 1) |search  noholdy=1 |fields noholdy |appendcols [search index=splunk-index   |where  message="start"  |where NOT app IN("ddm", "wwe", "tygmk", "ujhy") |eval day= strftime(_time, "%A") |where _time >= relative_time(_time,  "@d+4h") AND _time <= relative_time(_time, "@d+14h") |where NOT day IN("Tuesday", "Wednesday", "Thursday")] When i used this query i am still receiving alert on the dates mentioned in the .csv file. But i don't want to receive  the alerts. is there something wrong in my query, please help  ... View more

Original query:   index=app-data sourcetype=clientapp-code |rex field=_raw "\Status\:(?<Code>.*?)\|" |eval Failed=if(Code!=0, "Failed", null()) |bucket _time span=1d |stats count(Failed) as Fail by _time   OUTPUT: _time Fail 2022-01-22 6 2022-01-23 0 2022-01-24 8 2022-01-25 0 2022-01-26 0 2022-01-27 12 2022-01-28 0 2022-01-29 0 tstats query:   |tstats count where index=app-data sourcetype=clientapp-code by PREFIX(status:) _time span=1d |rename status: as Code |eval Failed=if(Code!=0, "Failed", null()) |where Code!=0 |stats values(count) by _time   OUTPUT: _time Fail 2022-01-22 6 2022-01-24 8 2022-01-27 12   I want to see original query  output  with tstats query but 0 data rows are not showing up in tstats command. How can i get the 0 data rows using tstats query??? ... View more

Below is my original xml code for dashboard. from the panel of EPP TimeZone , i have modified the query using tstats, query is working fine, but when i compare with original xml code query i am not able to pass tokens ((prodct="$eppProduct$") OR site="$eppProduct$")) in my tstats query. can anyone please help on this.   <form> <label>EPP Mode Dashboard</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="eppProduct" searchWhenChanged="true"> <label>Product</label> <fieldForLabel>all_product</fieldForLabel> <fieldForValue>all_product</fieldForValue> <search> <query> |tstats count where index=epp-prd-clc by site host host_ip |eval prodct= case(like(host, "%prod%"), "PROD", like(host, "%pat%"), "PAT", like(host, "%sit%"), "SIT", like(host, "%dev%"), "DEV") |stats count by site prodct |eval all_product=if(like(prodct, "PROD"), site, prodct)</query> <earliest> -4h@h </earliest> <latest>now</latest> </search> <default>*</default> <intialValue>*</intialValue> <choice value="*"> ALL </choice> </input> <input type="time" token "eppTime" searchWhenChanged="true" <label>Time</label> <default> <earliest> -60m@m </earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>EPP TimeZone</title> <chart> <title> Average Response Time</title> <search> <query> index=epp-prd-clc variable="ap" virginal="ssc" (prodct="$eppProduct$") OR site="$eppProduct$") deposit="calp" |eval Deposit=upper(deposit) |timechart avg(duration) as Duration |eval Duration=round(Duration,2)</query> <earliest> $eppTime.earliest$ </earliest> <latest>$eppTime.latest$</latest> </search> <option nmae="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle </option> <option nmae="charting.axisLabelsX.majorLabelStyle.rotation">0 </option> <option nmae="charting.chart"> line </option> <option nmae="charting.chart.nullValueMode"> zero </option> <option nmae="charting.chart.showDataLabels">minmax </option> <option nmae="charting.drilldown>all </option> <option nmae="charting.layout.splitSeries"> 1 </option> <option nmae="referesh.display"> none </option> </chart> </panel> </row> </form>   below is the modified xml dashboard code using tstats.   <form> <label>EPP Mode Dashboard</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="eppProduct" searchWhenChanged="true"> <label>Product</label> <fieldForLabel>all_product</fieldForLabel> <fieldForValue>all_product</fieldForValue> <search> <query> |tstats count where index=epp-prd-clc by site host host_ip |eval prodct= case(like(host, "%prod%"), "PROD", like(host, "%pat%"), "PAT", like(host, "%sit%"), "SIT", like(host, "%dev%"), "DEV") |stats count by site prodct |eval all_product=if(like(prodct, "PROD"), site, prodct)</query> <earliest> -4h@h </earliest> <latest>now</latest> </search> <default>*</default> <intialValue>*</intialValue> <choice value="*"> ALL </choice> </input> <input type="time" token "eppTime" searchWhenChanged="true" <label>Time</label> <default> <earliest> -60m@m </earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>EPP TimeZone</title> <chart> <title> Average Response Time</title> <search> <query> |tstats avg(duration) as Duration where index=epp-prd-clc TERM(variable) TERM("ap")TERM(virginal) TERM("ssc") TERM(deposit) TERM("calp") BY PREFIX(deposit:) _time |rename deposit: as Deposit |eval Deposit=upper(deposit) |timechart |eval Duration=round(Duration,2)</query> <earliest> $eppTime.earliest$ </earliest> <latest>$eppTime.latest$</latest> </search> <option nmae="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle </option> <option nmae="charting.axisLabelsX.majorLabelStyle.rotation">0 </option> <option nmae="charting.chart"> line </option> <option nmae="charting.chart.nullValueMode"> zero </option> <option nmae="charting.chart.showDataLabels">minmax </option> <option nmae="charting.drilldown>all </option> <option nmae="charting.layout.splitSeries"> 1 </option> <option nmae="referesh.display"> none </option> </chart> </panel> </row> </form>       ... View more

Query: index=xxx  application_code=mobile  NOT   feature  |stats count by code message |sort -count |eval message-substr(message, 1, 40) output: code message count mobile-job-115 application error occured 100 mobile-app-180 application is stable 240 app-job-800 information good 34 project-job-100 system error occured 10 project-job-100    system error occured 20 project-job-100    system error occured 34 project-job-100    system error occured 23 project-job-100    system error occured 50  expected output: code message count mobile-job-115 application error occured 100 mobile-app-180 application is stable 240 app-job-800 information good 34 project-job-100 system error occured 137  i want to get my table display count as one value for similar messages like for example(system error occured) as shown above. ... View more

i have jira issue collector app in splunk and inputs also added we can see logs as well. here it was with only one project with index=jirarequest Now i modified the JQL query in the inputs to get data from 2 projects, the JQL query i used is: project%20in(MMAAS%2CBBAT)%20AND%20updated%3E-2h   But now after  updating the JQL query with 2 projects i am not able to see the data from second project i.e CBBAT. Do i need to modify or update anywhere else, i am not sure. ... View more

Hi, I have 10 hosts, from this only 3 hosts are reporting to DS and 7 are not reporting. when i searched with _internal i could see only 3 hosts logs are coming in. How to troubleshoot further on this issue?? ... View more

Hi all when i run my original query i am getting one result and when i execute the same query using tstats i am getting different output. AVG IS NOT MATCHING. how to modify the query to match the count. my original query:     index=apl-cly-sap sourcetype=cly:app:sap |search processName="applicationstatus" |stats avg(plantime)     output: 1233.43223454   tstats query:     |tstats count where index=apl-cly-sap sourcetype=cly:app:sap TERM(processName=applicationstatus) by PREFIX(plantime=) |rename plantime= as Time |stats avg(Time)     output: 1345.7658755 ... View more

Hi, My query:   |tstats count where index=app-clietapp host=ahnbghjk OR host=ncsjnjsnjn sourcetype=app-clientapp source=/opt/splunk/var/clientapp/application.log by PREFIX(status:) |rename status: as App_Status |where isnotnull(App_Status) |eval Sucess=if(App_Status="0" OR App_Status="", "Succ", null()) |eval Error=if(App_Status!="0", "Error", null())   output: App_Status count   Error Sucess 0 767890   Succ 6789 65 Error     But i want the output as shown below: App_Status Error Sucess 6789 65 767890   please let me know how to modify the query so that i can get the required output. ... View more