Splunk Search

Timechart not populating the result

mayank101
New Member

I have a checkbox named host in which user enters the hostname manually, and then as per the name entered it should display the timechart.But it still shows waiting for input even after I enter. Can anyone please help in my case. I have pasted below the XML

       <query>index="xxxxx" 
         publisher="xxx"
      (entity="*:boot*" event="FAIL-ALERT" state!="Clear")

  |rex field=entity "_(?!.*_)(?&lt;host&gt;.*)" |eval myhost=$host$ |timechart useother=f count by myhost limit=200</query>
      <earliest>-6mon@mon</earliest>
      <latest>now</latest>
0 Karma

jpolvino
Builder

If you're collecting hostname from the user via a text field that becomes a token like $host$ then why are you also extracting host from the entity field?

If you want to use the token from then dashboard, then try putting $host$ in double quotes. As in: |eval myhost="$host$"

It might help to pull the query from the dashboard and run it directly in search. Be sure to substitute literals, like the hostname.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Just guessing, but perhaps it's because you have a token called 'host' as well as a field (created by rex) called 'host'.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...