Hi all, im looking to create a dashboard to capture various info on or proxy data. I have a few simple queries index=siem-proxy | top limit=5 cs_method and my other query index=siem-proxy | top limit=8 dest_port this gets the requests methods such as POST, GET etc. I want to add this to a dashboard but looking to streamline the query first, i tried using tstats but was getting nothing back some I think im getting the syntax wrong. Without streamlining the queries are taking a very long time to run as i have millions of events. Is there a way to put this into a tstats query that I can use as  visualization?   thank you  ... View more

Hello I have created a dashboard that shows the previous 4 days and the equivalent days the week before for asset counts, for example IPS devices reporting in. Some days i will have 15 devices reporting in, but the previous week may have 18, so im looking for a way to show what the missing devices are? is there a way to just pull out the devices that are missing?   Cheers ... View more

Hello, We have recently moved over to Splunk Cloud platform and I am making a dashboard that will have panels for each of our reporting servers/tools. So for example the dashboard will have a panel to show all IPS devices reporting in, all Proxies, all windows servers etc. I have created a query to show all proxies reporting in over the week, along with a timewarp to show the difference from the week before.   index="siem-proxy" source="global" |timechart dc(an) | rename dc(an) as "Proxy" | timewrap 1w | rename "Proxy_1week_before" as "Proxy Previous Week" | rename "Proxy_latest_week" as "Proxy Latest"   This search goes through millions of events to show 15 proxies have reported in per day, so its very slow running. Is there an easy way to make this more efficient?   Cheers ... View more

Hello, I have been given a list of 40 servers in a text file, all servers are separated by commas for example: server1, server2, server3 etc I cant upload the text file to splunk and compare the data that way, so is there a way in the search field i can just list all the servers and search my index? I know i can do OR between each one but im sure there is a quicker way?   Thanks,   Allan ... View more

Hello,  I am creating a query for my proxy data. The idea is to show all categories that I want in multiple single value charts. And for any categories that return 0, they will still be represented by a 0. my current query is  index="siem-cyber-proxy" action=blocked category=gambling OR category=malware  | eval isEvent=if(searchmatch("category"),1,0) | stats count as myCount sum(isEvent) AS isEvent | eval result=if(isEvent>0, isEvent, myCount) | table result   This current query adds results from both categories together rather than split into individual charts. I need to find out how to split the results so it creates multiple charts. Or do i need to run the query for each individual category? Hopefully this makes sense. Thank you ... View more