@johnhuang  Changing the wrap results to Yes fix the problem. Thank you so much for your help   ... View more

@PickleRick @yuanliu @yuanliu  So, I did the following tests: 1) User A logged in to Splunk with his user ID using Google Chrome on User A's PC. The result was that Splunk displayed extra spaces correctly using Google Chrome on User A's PC. 2) I login to Splunk with my userID using Google Chrome on my PC. The result was that Splunk does not display extra space correctly using Google Chrome on my PC. 3) User A logged in to Splunk with his user ID using Google Chrome on my PC. The result was that Splunk displayed extra spaces correctly using Google Chrome on my PC. So, it is not an issue with Google Chrome on my PC. 4) I login to Splunk with my userID using Google Chrome on User A's PC. The result was that Splunk does not display extra space correctly using Google Chrome on User A's PC. So, the issue follows my User ID. The conclusion is: The problem follows my User ID, and it is not an issue with my Google Chrome or my PC.  I am following up with Splunk. Assuming I am User B, the issue follows User B: User Splunk Browser PC Result User A User A User A User A No Space issue User B User B User B User B Space issue User A User B user B User B No Space issue User B User A User A User A Space issue Thanks ... View more

Hi @PickleRick  Thank you for your response. I checked the developer tools, and it did show extra spaces on the browser. The PC support asked me this question "if this is a browser issue, then why did the issue also occur on a different browser?  So, no chance it's a Splunk profile issue? I already cleared, my cache and it's the same issue.     The next step is that I will test it using a different PC used by Splunk user that doesn't have this issue   ... View more

Hi @yuanliu  Could it be an issue with my Splunk profile? I am using Splunk Enterprise Version:9.0.4. My browser is Google Chrome Version 130.0.6723.117 (Official Build) (64-bit) and Microsoft Edge Version 130.0.2849.68 (Official build) (64-bit) If it's a browser issue, why is it not working on another browser like Microsoft Edge? Thank you for your help ... View more

@jawahir007  I don't have any pending updates.  If it's a browser issue, then why is it displaying text correctly in the search box, but not on the statistical table in Splunk?    Thanks ... View more

@yuanliu  Good to know.   If I may ask again, how did you know the cost associated for each SPL command? Thanks!! ... View more

@yuanliu  Thank you for your help. I accepted your suggestion as solution with the following note: - sendemail didn't work because I wasn't an admin - Using alert worked just fine Can you clarify what you meant "join" will get me nowhere?  😊 The result using JOIN worked just fine My intention is to "join" the data, not to "append". When I  used APPEND, the data was appended to the original data and I had to use "stats command" to merge the data.   Thanks ... View more

Hi @inventsekar  I got this error when using the send email command, that's probably because I am not an admin error: command="sendemail", 'rootCAPath' while sending mail to: Thanks ... View more

Hi @inventsekar , If I uncheck open in new tab, it will not open a new tab and use the current tab. My goal is to open a new tab, but only one, not two.   Thank you   ... View more

Hi @ITWhisperer  Here's the code:    Thank you so much { "type": "splunk.singlevalueicon", "options": { "showValue": false, "icon": "splunk-enterprise-kvstore://12345abcdefg" }, "eventHandlers": [ { "type": "drilldown.customUrl", "options": { "url": "/splunk/app/test_app/second_dashboard?form.student_token=$student_token$", "newTab": true } } ], "context": {}, "showProgressBar": false, "showLastUpdated": false }     ... View more

@ITWhisperer @gcusello  Do you have any ideas on how to fix this?  Thanks ... View more

Hi @PickleRick  The data is actually also available in Splunk using an index=contact, but it's a time based combined with other data, it makes the data even larger. It is derived from the original DB, so it's better off obtain the data directly from DB. Either way, both cases (data pulling dbxquery and index) will face the same problem  (see below) We are aware that permanent solution is to join the data in the backend, but for now as a workaround I need to pull the data using SPL join subsearch. I only need to find a way to alert me if it exceeds 50k. Thanks Same problem 50k: | search1 | join [search index=contact | ip="10.0.0.0/16" | eval source=search2] | join [search index=contact | ip="10.1.0.0/16" | eval source=search3] | join [search index=contact | ip="10.2.0.0/16" | eval source=search4] | join [search index=contact | ip="10.3.0.0/16" | eval source=search5]   ... View more

Hi @yuanliu  1) a)  I got this when using sendemail.  I think the reason is I am not an admin command="sendemail", 'rootCAPath' while sending mail to:       b)   This is the search, correct? | search1 | join [search2 | stats count | where count > 50000 | eval this = "search 2"] | sendemail test@testemail.com   2)  I found another option is to use "alerts" I did some tests, but it didn't work.  I have total counts about 40k Under "Trigger Conditions", I set Trigger alert when number of results is greater than 30,000.   Please suggest. Thanks ... View more

Hi @PickleRick  Thanks for your help 1.  Like I mentioned, the DB is on a different connection, if it's possible it will take a while until the DB team work on this. So, as a workaround I will need to do this at least to get the data now. 2. Yes 50k is for the join 3. Thanks. Let me look into _internal. The alerting that I am looking for is not only for a case where certain data hits a Splunk's internal threshold, but I also need it for other cases (non-Splunk's internal threshold), for example, if my scheduled report contains empty data or if data hits a certain threshold (max/min). 4.  Sorry, perhaps my explanation in the example is not clear enough because it's difficult to lay it out without a real example in SPL. Both tables (host table and contact table) in the example have been in Splunk and can be accessible via a DBX query. Like I mentioned before, the problem is that we cannot join in the DB; both are on different connections; the table host is in Connection A, and the table contact is in Connection B.  | dbxquery connection ="connectionA" query="select ip, host from table host" | dbxquery connection ="connectionB" query="select ip, contact from table contact" I did not search remotely on every search, but instead I ran this command for each subnet to find the number of rows. For example 10.0.1.0/16 => 20k rows and so on.   | dbxquery connection ="connectionB" query="select ip, contact from table contact where ip::inet<'10.0.0.0/16'" | dbxquery connection ="connectionB" query="select ip, contact from table contact where ip::inet<'10.1.0.0/16'" | dbxquery connection ="connectionB" query="select ip, contact from table contact where ip::inet<'10.2.0.0/16'" | dbxquery connection ="connectionB" query="select ip, contact from table contact where ip::inet<'10.3.0.0/16'" Once I figure the number of rows, then I group them until it hits right below 50k, so I am saving subsearches.  If one subnet above 50k, I will need to split them.   I hope this makes sense.  Note that this is only workaround. join max=0 type=left ip [| dbxquery connection ="connectionB" query="select ip, contact from table contact where ip::inet<'10.0.0.0/16' OR ip::inet<'10.1.0.0/16'" |eval source="group1" ] ... View more

I can make it wider by reducing the time frame, but last 7 days is usually the default. Are you sure we can't do it on the CSS part? Thanks ... View more

Hi @yuanliu  First, I would like to thank you for your help. This is "partly" related to my previous post that you solved, but I will describe it better here https://community.splunk.com/t5/Splunk-Search/How-do-I-quot-Left-join-quot-by-appending-CSV-to-an-index-in/m-p/697794#M237015 This is just an example: I have a host table containing IP and hostname, approximately 100k rows with unique IPs I have a contact table containing IP and contact, approximately 1> million rows with unique IPs Both can be accessed with DBX query,  but unfortunately they are both located in different DB connections, so it's not possible to join them at the backend. So, the workaround is to filter out subnet on the contact DB and use subsearches to join the contact DB with the Host DB Due to 50k rows limit using subsearch, I ran a separate query on the contact DB to find out the number of rows for each subnet, then I grouped them together to make sure the number of rows is below 50k. (Please see the diagram below) Group 1 = 40 rows, Group 2 = 45k rows,  and Group 3 = 30k rows. After that, I used left join for each group on the contact DB with the Host DB. Since I don't control the growth of data in the Contact DB,  I am trying to figure out a way to get an email alert if one of the groups exceeded 50k limit. I think I am able to create a scheduled report to produce the stats of each subnet in the group, but going back to my original question: I simply want to know if it's possible for Splunk to send me an email alert only if it meets certain thresholds. The subsearch is only one of my cases. Another case is  I have multiple reports that run daily, I intend to read the reports only if there is a problem, such as empty data, meeting certain thresholds, etc.       Input: Host table ip host 10.0.0.1 host1 10.0.0.2 host2 10.0.0.3 host3 10.1.0.1 host4 10.1.0.2 host5 10.1.0.3 host6 10.2.0.1 host7 10.2.0.2 host8 10.2.0.3 host9 Contact table ip contact 10.0.0.1 person1 10.0.0.2 person2 10.0.0.3 person3 10.1.0.1 person4 10.1.0.2 person5 10.1.0.3 person6 10.2.0.1 person7 10.2.0.2 person8 10.2.0.3 person9 Output:  Join host and contact DB ip host contact 10.0.0.1 host1 person1 10.0.0.2 host2 person2 10.0.0.3 host3 person3 10.1.0.1 host4 person4 10.1.0.2 host5 person5 10.1.0.3 host6 person6 10.2.0.1 host7 person7 10.2.0.2 host8 person8 10.2.0.3 host9 person9 ... View more

Hi @yuanliu  Thank you for your suggestion. The subsearch has a max 50k limit, not 5k. If one or more subsearches hit the 50k limitation, I'd want to get an email notification indicating which subsearch exceeded the 50k limit.  In the example  below, an email alert will be sent indicating that 2 subsearches exceed the 50k limit: search3 = 60k rows and search4 = 70k rows.  I can create a scheduled report that sends an email every day, but I am not sure if the report has the ability to send emails only when it meets a certain condition. search1 | join max=0 type=left ip [search ip="10.1.0.0/16" |eval this = "search 2"] | join max=0 type=left ip [search ip="10.2.0.0/16" |eval this = "search 3"] | join max=0 type=left ip [search ip="10.3.0.0/16" |eval this = "search 4"]   ... View more

Hi @PickleRick  I accepted your previous suggestion using eventstats as solution Thank you for your help.   Thanks for bringing me into attention that eventstats also have memory limitation, another limits.conf that only admin can modify 🙂      The default setting is max_mem_usage_mb=200MB.  How do I know if my dataset will ever hit 200 or not? Does streamstats have limitation? How do I use streamstats in my case?    When I changed eventstats to streamstats, it will show incremental data, instead of total, so I need to figure out on how to filter out if it's possible. Thanks Streamstats result dc ip location name dc    ip location name 1 1.1.1.1 location-1 name0 2 1.1.1.1 location-1 name1 1 1.1.1.2 location-2 name2 1 1.1.1.3 location-3 name0 2 1.1.1.3 location-3 name3 1 1.1.1.4 location-4 name4 2 1.1.1.4 location-4 name4b 1 1.1.1.5 location-0 name0 1 1.1.1.6 location-0 name0 0 1.1.1.7 location-7   ... View more

Hi @PickleRick , I tested your suggestion and it worked. Thank you for your help. 1) I added one more case where the IP has an empty name.   I added condition in the where clause (dc=0) and it worked.  I am afraid if I used isnull(name), sometimes it contains " " (empty string). Please let me know if this is doable 2)  Is it possible to do this without using eventstat?       I have already used eventstats in the search, but for a different field      Will that cause any delays or issues?   Did you ever use multiple eventstats in your search?    Thank you so much for your help ip name location 1.1.1.1 name0 location-1 1.1.1.1 name1 location-1 1.1.1.2 name2 location-2 1.1.1.2 name0 location-20 1.1.1.3 name0 location-3 1.1.1.3 name3 location-3 1.1.1.4 name4 location-4 1.1.1.4 name4b location-4 1.1.1.5 name0 location-0 1.1.1.6 name0 location-0 1.1.1.7   location-7 | makeresults format=csv data="ip, name, location 1.1.1.1, name0, location-1 1.1.1.1, name1, location-1 1.1.1.2, name2, location-2 1.1.1.2, name0, location-20 1.1.1.3, name0, location-3 1.1.1.3, name3, location-3 1.1.1.4, name4, location-4 1.1.1.4, name4b, location-4 1.1.1.5, name0, location-0 1.1.1.6, name0, location-0 1.1.1.7,,location-7" | eventstats dc(name) AS dc BY ip | where name!="name0" OR dc=0 OR (name=="name0" AND dc=1)   ... View more

Hi @PickleRick  When I ran the following command, the dc returned 6 for each row     | eventstats dc(name) as dc     dc ip location name 6 1.1.1.1 location-1 name0 6 1.1.1.1 location-1 name1 6 1.1.1.2 location-2 name2 6 1.1.1.2 location-20 name0 6 1.1.1.3 location-3 name0 6 1.1.1.3 location-3 name3 6 1.1.1.4 location-4 name4 6 1.1.1.4 location-4 name4b 6 1.1.1.5 location-0 name0 6 1.1.1.6 location-0 name0 So, the output are still missing1.1.1.5 and 1.1.1.6   Only name0 that exists on multiple rows should be removed.     Thanks for your help     | where name!="name0" OR (name=="name0" AND dc=1)     output dc ip location name 6 1.1.1.1 location-1 name1 6 1.1.1.2 location-2 name2 6 1.1.1.3 location-3 name3 6 1.1.1.4 location-4 name4 6 1.1.1.4 location-4 name4b Expected output: ip location name 1.1.1.1 location-1 name1 1.1.1.2 location-2 name2 1.1.1.3 location-3 name3 1.1.1.4 location-4 name4 1.1.1.4 location-4 name4b 1.1.1.5 location-0 name0 1.1.1.6 location-0 name0 ... View more

Hi @PickleRick  Sorry I missed another condition. I also updated the initial post. The name0 is not in order. The dedup/filter should not be applied  to IPs that doesn't contain "name0" AND it should not be applied to unique IP that has "name0" So,  unique IP like 1.1.1.5 and 1.1.1.6 that has "name0" needs to be remained in the data.   What I did now is to filter out statically, but another IP could show up with the same pattern.   Thank you again for your help Data: ip name location 1.1.1.1 name0 location-1 1.1.1.1 name1 location-1 1.1.1.2 name2 location-2 1.1.1.2 name0 location-20 1.1.1.3 name0 location-3 1.1.1.3 name3 location-3 1.1.1.4 name4 location-4 1.1.1.4 name4b location-4 1.1.1.5 name0 location-0 1.1.1.6 name0 location-0   Expected output: ip name location 1.1.1.1 name1 location-1 1.1.1.2 name2 location-2 1.1.1.3 name3 location-3 1.1.1.4 name4 location-4 1.1.1.4 name4b location-4 1.1.1.5 name0 location-0 1.1.1.6 name0 location-0   | makeresults format=csv data="ip, name, location 1.1.1.1, name0, location-1 1.1.1.1, name1, location-1 1.1.1.2, name2, location-2 1.1.1.2, name0, location-20 1.1.1.3, name0, location-3 1.1.1.3, name3, location-3 1.1.1.4, name4, location-4 1.1.1.4, name4b, location-4 1.1.1.5, name0, location-0 1.1.1.6, name0, location-0"     ... View more

Hi @PickleRick  Thank you for your help. I also updated the original post. The name0 is not in order. The dedup/filter should not be applied  to IP that doesn't contain "name0" Data: ip name location 1.1.1.1 name0 location-1 1.1.1.1 name1 location-1 1.1.1.2 name2 location-2 1.1.1.2 name0 location-20 1.1.1.3 name0 location-3 1.1.1.3 name3 location-3 1.1.1.4 name4 location-4 1.1.1.4 name4b location-4 Expected output: ip name location 1.1.1.1 name1 location-1 1.1.1.2 name2 location-2 1.1.1.3 name3 location-3 1.1.1.4 name4 location-4 1.1.1.4 name4b location-4 | makeresults format=csv data="ip, name, location 1.1.1.1, name0, location-1 1.1.1.1, name1, location-1 1.1.1.2, name2, location-2 1.1.1.2, name0, location-20 1.1.1.3, name0, location-3 1.1.1.3, name3, location-3 1.1.1.4, name4, location-4 1.1.1.4, name4b, location-4"   ... View more