index=indexApp with field "officer" index=indexTeam with fields "officer" and "team id" indexTeam has been created on 14 August 2014 but the indexApp was created around 2 months ago. I have "team id" drop-down in my dashboard which is used for applying filtering on my dashboard panels. when I use alltime in timerangepicker search, the drop-down is populated with list of teams but when I change the filter to 24hours or yesterday or previous week, the drop-down is empty. The error occurred on 15 Aug 2014. I think the error is related to indexTeam involved in timerangepicker search where index is created only on 14 August. Is there any way to tell drop-down search not to use timerangepicker. <form> <label>App by Team</label> <fieldset autoRun="true" submitButton="false"> <input type="time" searchWhenChanged="true"> <input type="time" searchWhenChanged="true"> <label>Time period</label> <default/> </input> <input type="dropdown" token="teamId"> <label>Team Id</label> <prefix>"team id"="</prefix> <suffix>"</suffix> <populatingSearch fieldForValue="team id" fieldForLabel="team id"> <![CDATA[index=indexTeam |dedup "team id"|sort "team id"]]> </populatingSearch> <default/> <choice value="">All</choice> </input> ... View more

We have requirement to make dashboard panel unclickable. sometime users who clicks on the panel and seeing logs and they don't know what to do about them. we want to prevent them clicking on the panels ... View more

I have three indexes. I want to create single table in dashboard panel for the following requirement. index=indexProvision with field "UserName" index=indexApp with field "officer" index=indexTeam with fields "officer" and "team" e.g indexProvision has 500 users and indexApp has 150 Users and indexTeam is a master index which has 1000 users. Question I want to compare IndexProvision to find Users who are not found in indexApp. The result I am expecting is 350users. Using 350 users (from indexProvision), I want to compare against indexTeam so that the end result is officer and team details for 350 users. I want to add this query to my panel, so that I can get table showing UserName and Team ... View more

Index1 with fields (name, "team id", surName) Index2 with fields (userId, correlationId, operation) Questions1: I want to join two indexes which are having completely different sets of information. There is a joining field but the field names are not unique but the values are same both name and userId's holding the same set of values. e.g name=John, userId=John How do I combine these two indexes by name and userId fields to get results from both indexes Question2: we have created two form fields in splunk dashboard. one is "userId" and second one is "team id". "team id" is available only in Index1 and userId is available in Index2. As I mentioned in the question1, the only joining condition is using name and userId. Please suggest best search query to combine the indexes filtered by "team id" and userId Answering to Somesoni2, Ayn Thanks a lot for your quick responses. Please find the sample logs from the index1 and index2. There are lot more fields in addition to the one I mentioned but I am not in a position to reveal them as they are sensitive. Index1 2014-08-10 21:34:12,558 INFO TeamReportImpl - {name=John, "team id"=Team 1, surname=Wright} Index 2 2014-08-10 22:24:11,668 INFO OperationReportImpl - {userId=John operation=Create, correlationId=021C0E78-65D2-AF4F38A93D7E} The requirement is, we have dashboard with three fields, 1. Date range 2. officer name 3. team drop down I have to create several panel to display Total counts. e.g 4. Total count of Create operation 5. Total count of correlation id by team (even though the team is not provided in index2) thanks again for prompt response ... View more