| eval test_data_index=mvfind(split("bl01,bl02,bl03,0_Ref_res", ","), Test_Data) | eventstats max(test_data_index) as max_test_data_index by Identity | where test_data_index = max_test_data_index ... View more

You have not shown anything that indicates that the search has the value you are seeking on the first row of your results. Please share your search and follow @bowesmana's suggestion about which token to use to retrieve the results. ... View more

You are on the right lines with streamstats - please share some sample anonymised event for us to work with to find you a solution. ... View more

Hi @ITWhisperer , Thank you so much for the info. I referred the example mentioned above and i was able to get the answer. ... View more

@anooshac  There is 2nd part of this query. In this section based on month selection it will set earliest and latest time in  "start" and "end" token. use these token in respective search. basically these token have earliest and latest time in epoch format for selected month.  PS: I have to use separate sub search because $result.token_name$ only works for 1 entry. <search base="basesearch_time"> <query> | where Month="$month_token$" | table start end </query> <done> <set token="start">$result.start$</set> <set token="end">$result.end$</set> </done> </search>   ... View more

It is true one cannot change the labels.  That means we have to choose between having week numbers in numerical rather than calendar order or having year-week numbers in calendar order. ... View more

Hi @anooshac, You were probably really close to the solution for this - but it looks like using tokens to set the colour on tables only works before the table has loaded. The only workaround out I found was to re-run the search each time you select a new radio button. Here's a working version for you to build from. The radio buttons set the type: Both and Type A => Highlight Columns A and B Type B => Highlight Column B The table has a format for ColumnA and ColumnB that looks for the right Type in the token: <format type="color" field="ColumnB"> <colorPalette type="expression">if(match($field_to_highlight|s$,".*TypeB.*"),"#FF0000", "")</colorPalette> </format> To make the dashboard redraw with the right columns highlighted, I added this to the query: ``` $field_to_highlight$ ``` That won't do anything to the search results, but will force the search to be run again. Here is a working dashboard: <form version="1.1" theme="dark"> <label>Answers for anooshac</label> <fieldset submitButton="false"> <input type="radio" token="field_to_highlight" searchWhenChanged="true"> <label>Option</label> <choice value="TypeA__TypeB">Both</choice> <choice value="TypeA_TypeB">Type A</choice> <choice value="TypeB">Type B</choice> <default>TypeATypeB</default> </input> </fieldset> <row> <panel> <table> <title>Content</title> <search> <query>| gentimes start=-20 | eval type=if(random()%2==0,"Type A","Type B") | appendcols[|windbag] | fields starttime, endtime, sample, lang, type | rename starttime as "ColumnA", endtime as "ColumnB" | head 20 ``` $field_to_highlight$```</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <format type="color" field="ColumnA"> <colorPalette type="expression">if(match($field_to_highlight|s$,".*TypeA.*"),"#FF0000", "")</colorPalette> </format> <format type="color" field="ColumnB"> <colorPalette type="expression">if(match($field_to_highlight|s$,".*TypeB.*"),"#FF0000", "")</colorPalette> </format> </table> </panel> </row> </form>   Hopefully that's close to what you were after. ... View more

Hi @anooshac , good for you, see next time! let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

OK. Assuming that: 1. You always have a drive letter at the beginning 2. You don't have "empty parts" (you don't have consecutive backslashes which are syntactically correct if you want to specify a file path but are typically not returned as a path to existing file) 3. You want to extract the part after the first four components The regex to do so would be like that: [a-zA-Z]:\\\\([^\\]+\\){4}(?<remainder>.*) The "remainder" capture group will capture the path after first four directories. Of course if you want to do it with "rex" command in Splunk, you need to escape all backslashes which makes it something like this: | rex  "[a-zA-Z]:\\\\\\\\([^\\\\]+\\\\){4}(?<remainder>.*)" ... View more

Just add any additional character groupings into the allowed character ranges, i.e. | rex field=Group max_match=0 "'(?<g>[A-Za-z_\.]+)':'" | rex field=Value max_match=0 "'(?<v>[A-Za-z_\.]+)'" ... View more

Hi @anooshac, I don't think that's possible using the Classic Dashboard interface, maybe modifying the dashboard CSS, but I'm not sure. It should be possible in Dashboard Studio. Ciao. Giuseppe ... View more

Yes with custom Javascript, you could possibly do virtually anything on the browser side. ... View more

Assuming each ID has only one status value, then the results should be the same. It depends on your data. ... View more

Thank you so much @ITWhisperer , It is working. ... View more

@anooshac  Can you please try this? | makeresults | eval _raw="{ \"Info\": { \"Unit\": \"ABC\", \"Project\": \"XYZ\", \"Analysis Summary\": { \"DB1\": { \"Available\": 1088, \"Used\": 173.23, \"Used(%)\": 15.92, \"Status\": \"OK\" }, \"DB2\": { \"Available\": 4096, \"Used\": 1591.85, \"Used(%)\": 38.86, \"Status\": \"OK\" }, \"DB3\": { \"Available\": 128, \"Used(%)\": 2.6, \"Status\": \"OK\" }, \"DB4\": { \"Available\": 16500, \"Used\": 6696.0, \"Used(%)\": 40.58, \"Status\": \"OK\" }, \"DB5\": { \"Available\": 22000, \"Used\": 9800.0, \"Used(%)\": 44.55, \"Status\": \"OK\" } } } }" | rex field=_raw mode=sed "s/(\n\s+)//g" max_match=0 | rex field=_raw mode=sed "s/(^.*\"Analysis Summary\"\: )//g" max_match=0 | rex field=_raw mode=sed "s/(,\"RAM_Tracking.*)//g" max_match=0 | rex field=_raw "\"(?<Database>[^\"]+)\": \{\"Available" max_match=0 | rex field=_raw ":\s?(?<Data>\{.+?})" max_match=0 | eval tmp = mvzip(Database,Data,"|") | mvexpand tmp | eval Database=mvindex(split(tmp,"|"),0), Data=mvindex(split(tmp,"|"),1) | rex field=Data "{\"Available\"\:\s?\"?(?<available>[^,]+)\"?,(\"Used\"\:\s?\"?(?<used>[^,]+)\"?,)?\"Used\(%\)\"\:\s?\"?(?<used_p>[^,]+)\"?,\"Status\"\:\s?\"(?<status>[^}]+)\"}" | table Database available used used_p status     Incase still not working then, remove all statements and try adding them one by one to check at which point its breaking.     Thanks KV If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.   ... View more

@anooshac  Can you please check the below link for your ask?   https://community.splunk.com/t5/Dashboards-Visualizations/How-to-format-JSON-data-into-a-table/m-p/633736/highlight/true#M51954   KV   ... View more

Try this | bucket _time span=1d | chart dc(Task) as counts useother=f limit=0 by _time Group | eventstats min(_time) as start | eval bin=floor((_time-start)/(60*60*24)) | makecontinuous bin | filldown start | eval _time=start+(bin*60*60*24) | fillnull value=0 | fields - bin start | untable _time Group counts | stats avg(counts) as AverageCountPerDay by Group ... View more

There is nothing wrong with that set of dates, I assume there is a user against each row. Is there a reason why you don't use timechart? When you use bin+stats then it will not give months where there is no data for a user - it would be better to use timechart. You can use 'makecontinous' command to fill in the 'gaps' but using timechart is the right solution ... View more

Hi @kamlesh_vaghela , I have similar requirement, i referred your solution. But i am not able to print the row in the any one value has the data 0. Is there anything to be added in the query to avoid such condition? ... View more

Thank you so much!! Totally forgot about the use of fillnull! ... View more

Hi, @somesoni2 , the data is in json format. Here is one example. "Task_no":"5", "Group": "G1", "EXECUTION_DATE":1648081994535, "STATUS":"FAILURE", "DURATION":1951628   and the data im calculating is MTTR. .........[| streamstats count as start reset_on_change=true by STATUS | where start=1 | streamstats count(eval(STATUS=="FAILURE")) as fails by STATUS | eval fails=if(fails=0,null(),fails) | filldown fails | stats list(*) as * by fails| where mvcount(STATUS) = 2|eval MTTR=....] |append[.....| chart count(Task_no) by Group STATUS | table Group SUCCESS FAILURE] | stats values(eval(if('FAILURE'=="0",0,MTTR))) as MTTR Whenever there is no failures i want to make the MTTR as 0, if there are failures MTTR will be calculated by the query and i want to keep that result as it is. While using stats i am not able to achieve this condition. Where i went wrong in the query? Can you please help me. ... View more

You could also extract component Value using regex. | eval component=trim(mvindex(split(tmp,":"),0),"\"") | eval Value=trim(mvindex(split(tmp,":"),1),"\"") = | rex field=tmp "\"(?<component>[^\"]+)\":\"(?<Value>[^\"]+)\""   ... View more

OK. If it's a big enough search, you might be hitting sort limits (10000 rows if I remember correctly). You could try sort with limit=0 parameter but that might turn out to be a resource-intensive operation. Always think about what you want to achieve and whether you need to do all the operations and if you need them at all. (like - for example - sorting data only to do stats max seems pointless) ... View more

I want to get the chart for 2 data . If i use count by will i be able to get the data for 2 charts? I used | timechart span=1d distinct_count(NUM), count(NAME{}.PART_NO{}) I used the solution you provided but the count is still not matching with the data i uploaded. The reeating values are not being considered. How to consider the repeating values for the count? ... View more