@ravir_jbp , Did you try fillnull https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fillnull OR  replace in case its a literal value NULL https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Replace    ... View more

Try changing the applicationName to APPLICATION_NAME in the prefix <input type="dropdown" token="BankApp" searchWhenChanged="true"> <label>ApplicationName</label> <choice value="*">All</choice> <search> <query> | inputlookup BankIntegration.csv | dedup APPLICATION_NAME | sort APPLICATION_NAME | table APPLICATION_NAME </query> </search> <fieldForLabel>ApplicationName</fieldForLabel> <fieldForValue>APPLICATION_NAME</fieldForValue> <default>*</default> <prefix>APPLICATION_NAME="</prefix> <suffix>"</suffix> </input> in the second look up, you are trying to filter with applicationName="" where as the lookup file seems to have APPLICATION_NAME as header ... View more

@karthi2809  Try this example.  Changes : While setting the token on the change event, you should use the values .  PS : Added a token to the Interface text to demonstrate the changes.   <form version="1.1" theme="light"> <label>Depends_Rejects</label> <fieldset submitButton="false"></fieldset> <row> <panel id="panel_layout"> <input id="input_link_split_by" type="link" token="tokSplit" searchWhenChanged="true"> <label></label> <choice value="Finance">OVERVIEW</choice> <choice value="BankIntegrations">BANKS</choice> <default>OVERVIEW</default> <initialValue>OVERVIEW</initialValue> <change> <condition value="Finance"> <set token="Finance">$value$</set> <unset token="BankIntegrations"></unset> </condition> <condition value="BankIntegrations"> <set token="BankIntegrations">$value$</set> <unset token="Finance"></unset> </condition> </change> </input> </panel> </row> <row> <panel> <input type="time" token="time" searchWhenChanged="true"> <label>Time Interval</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="env" searchWhenChanged="true"> <label>Environment</label> <choice value="*">ALL</choice> <choice value="DEV">DEV</choice> <choice value="TEST">TEST</choice> <choice value="PRD">PRD</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="dropdown" token="applicationName" searchWhenChanged="true" depends="$Finance$" rejects="$BankIntegrations$"> <label>ApplicationName</label> <choice value="*">ALL</choice> <choice value="p-wd-finance-api">p-wd-finance-api</choice> <default>"p-wd-finance-api</default> <initialValue>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</initialValue> <fieldForLabel>ApplicationName</fieldForLabel> <fieldForValue>ApplicationName</fieldForValue> </input> <input type="text" token="InterfaceName" searchWhenChanged="true" depends="$Finance$" rejects="$BankIntegrations$"> <label>InterfaceName</label> <default>$tokSplit$</default> <initialValue></initialValue> </input> <input type="dropdown" token="applicationName" searchWhenChanged="true" depends="$BankIntegrations$" rejects="$Finance$"> <label>ApplicationName</label> <choice value="p-wd-finance-api">p-wd-finance-api</choice> <default>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</default> <initialValue>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</initialValue> <fieldForLabel>ApplicationName</fieldForLabel> <fieldForValue>ApplicationName</fieldForValue> </input> <input type="text" token="InterfaceName" searchWhenChanged="true" depends="$BankIntegrations$" rejects="$Finance$"> <label>InterfaceName</label> <default>$tokSplit$</default> <initialValue></initialValue> </input> </panel> </row> </form>     Hope it helps! ... View more

@selvam_sekar  Are you trying to achieve something similar? Here is a run anywhere example . Number input is only to change the value in the A box for demonstration   { "visualizations": { "viz_mP9NTc6l": { "type": "splunk.singlevalue", "options": { "trendColor": "#171d21", "backgroundColor": "#dc4e41" }, "dataSources": { "primary": "ds_uCpsCnrn" } }, "viz_5qfKAE2H": { "type": "splunk.singlevalue", "options": { "backgroundColor": "#b6c75a" }, "dataSources": { "primary": "ds_s5yiPOpw_ds_uCpsCnrn" } }, "viz_lwpeyQcS": { "type": "splunk.singlevalue", "options": { "backgroundColor": "#62b3b2" }, "dataSources": { "primary": "ds_6iVMrVEi_ds_s5yiPOpw_ds_uCpsCnrn" } }, "viz_P6dRCwGc": { "type": "abslayout.line" }, "viz_jTW6Jy5J": { "type": "abslayout.line" } }, "dataSources": { "ds_uCpsCnrn": { "type": "ds.search", "options": { "enableSmartSources": true, "query": "| makeresults count=$number$\n| stats count" }, "name": "A" }, "ds_s5yiPOpw_ds_uCpsCnrn": { "type": "ds.search", "options": { "enableSmartSources": true, "query": "| makeresults count=5\n| stats count" }, "name": "B" }, "ds_6iVMrVEi_ds_s5yiPOpw_ds_uCpsCnrn": { "type": "ds.search", "options": { "enableSmartSources": true, "query": "| makeresults\r\n| eval variance=$A:result.count$ - $B:result.count$\r\n| table variance" }, "name": "Variant" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, "input_vWVKiJlJ": { "options": { "defaultValue": 10, "token": "number" }, "title": "Number Input Title", "type": "input.number" } }, "layout": { "type": "absolute", "options": { "width": 1440, "height": 960, "display": "auto" }, "structure": [ { "item": "viz_mP9NTc6l", "type": "block", "position": { "x": 410, "y": 170, "w": 150, "h": 100 } }, { "item": "viz_5qfKAE2H", "type": "block", "position": { "x": 680, "y": 170, "w": 150, "h": 100 } }, { "item": "viz_lwpeyQcS", "type": "block", "position": { "x": 520, "y": 370, "w": 150, "h": 100 } }, { "item": "viz_P6dRCwGc", "type": "line", "position": { "from": { "x": 483, "y": 274 }, "to": { "item": "viz_lwpeyQcS", "port": "n" } } }, { "item": "viz_jTW6Jy5J", "type": "line", "position": { "from": { "x": 756, "y": 272 }, "to": { "item": "viz_lwpeyQcS", "port": "n" } } } ], "globalInputs": [ "input_global_trp", "input_vWVKiJlJ" ] }, "description": "", "title": "Variance_Test" }     ... View more

It could be in the default location as well Try the command and should give you some pointers splunk btool web list --debug|findstr cert   Or in details splunk btool web list settings ... View more

Can you try changing the condition value to tok1* instead of tok1 ?   Here is a run anywhere example for reference <form version="1.1" theme="light"> <label>Tokens</label> <fieldset submitButton="false"> <input type="dropdown" token="project" searchWhenChanged="true"> <label>Project</label> <choice value="tok1*">Token1</choice> <choice value="tok2*">Token2</choice> <change> <condition value="tok1*"> <set token="x-key">Key1</set> </condition> <condition value="tok2*"> <set token="x-key">Key2</set> </condition> </change> </input> <input type="multiselect" token="Record"> <label>Record</label> <delimiter> ,</delimiter> <fieldForLabel>Record</fieldForLabel> <fieldForValue>Record</fieldForValue> <search> <query>|makeresults count=5|streamstats count|eval Record="Record".count|eval count=ceil(count/2)|eval project="tok".count."abc",x-key="Key".count|fields - _time,count|search project=$project$ AND x-key=$x-key$</query> </search> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> </input> </fieldset> <row> <panel> <title>Project = $project$ , Key = $x-key$, Record = $Record$</title> <table> <title>Results</title> <search> <query>|makeresults count=5|streamstats count|eval Record="Record".count|eval count=ceil(count/2)|eval project="tok".count."abc",x-key="Key".count|fields - _time,count|where Record in ($Record$)</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> ... View more

@Ayushi-Sriva , You can use the dynamic formatting, please refer here  https://docs.splunk.com/Documentation/Splunk/9.2.0/DashStudio/chartsSV#Add_emphasis_to_a_returned_value_using_dynamic_formatting Please find a run anywhere example  You can change the status in the drop down and will be reflected in the search by using token. Based on the status, the color changes { "visualizations": { "viz_NJsTjQl4": { "type": "splunk.singlevalue", "options": { "majorColor": "> majorValue | matchValue(majorColorEditorConfig)" }, "dataSources": { "primary": "ds_275I8YNY" }, "context": { "majorColorEditorConfig": [ { "match": "Running", "value": "#118832" }, { "match": "Stopped", "value": "#d41f1f" } ] } } }, "dataSources": { "ds_275I8YNY": { "type": "ds.search", "options": { "query": "| makeresults\n| eval value=\"$status$\"" }, "name": "Search_1" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, "input_BHJAbWl2": { "options": { "items": [ { "label": "Running", "value": "Running" }, { "label": "Stopped", "value": "Stopped" } ], "token": "status", "selectFirstSearchResult": true }, "title": "Status", "type": "input.dropdown" } }, "layout": { "type": "grid", "options": { "width": 1440, "height": 960 }, "structure": [ { "item": "viz_NJsTjQl4", "type": "block", "position": { "x": 0, "y": 0, "w": 1440, "h": 400 } } ], "globalInputs": [ "input_global_trp", "input_BHJAbWl2" ] }, "description": "", "title": "single_panel_studio" }   ... View more

From the syntax `Exempted_Dark_Devices`, it's a macro. Look in the macro definitions and you should be able to find the expansion of this macro https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Definesearchmacros ... View more

@Abhigyan_2907 , Assuming that by PCF , you meant Pivotal Cloud Foundry  Without looking at the sample logs, it's difficult to formulate a search to get the logs.  There are different log types for applications and based on your requirement , you could search the respective types.  Have a look at this https://docs.cloudfoundry.org/devguide/deploy-apps/streaming-logs.html  ... View more

Please have a look at https://docs.splunk.com/Documentation/Splunk/9.2.0/Indexer/Configurethepeerindexes ... View more

inputs.conf is configured on the machine from where the data is forwarded. So it could be on UF,HF,Indexer or even on Search Head if the logs are being forwarded Sourcetype can be applied on the general section which will be considered if individual sections are not specified Please have a look at this https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/Wheretofindtheconfigurationfiles more detailed information And also here to have an understanding about the data processing https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platform-the-Masa/m-p/590781#M103485 The source is the name of the file, stream, or other input from which a particular event originates. The sourcetype determines how Splunk software processes the incoming data stream into individual events according to the nature of the data. In short , /var/log/apache.log is a source and how the source file should be parsed is defined by the sourcetype access_combined     ... View more

Did you mean the drop down is not enabled to select? If thats the case, check the search which populates the dropdown. If it uses the macros, then ensure that the user/app has permissions to access the macro and is expending the search ... View more

Few preliminary things to check Are the missing machine still up & running and part of your network? Is Splunk still running on those missing machines? Are the forwarders still able to connect to the indexers? Is the *nix apps (or whichever apps used ) are installed and configured? ... View more

Try including the _time as well in your search  Either using timechart or by _time bucket  index=_internal source=*license_usage.log* type=Usage idx=*| eval GB=b/1024/1024/1024 |timchart span=1d sum(gb) by st   or index=_internal source=*license_usage.log* type=Usage idx=*| eval GB=b/1024/1024/1024 |bin _time span=1d | stats sum(GB) by _time,st ... View more

There could be multiple reasons including the connectivity , timestamp, field extraction , filtering etc. You may start with this documentation would find some common issues https://docs.splunk.com/Documentation/Splunk/9.0.3/Troubleshooting/Cantfinddata ... View more

Hi @cheanaydoo , It's possible. Please find below a sample Cluster 1 { "name": "cluster1", "clustername": "cluster1_name", "version": "v123" } Cluster 2 { "name": "cluster2", "clustername": "cluster2_name", "version": "v321" }   Search index="api" sourcetype="_json" | stats latest(version) as version by name,clustername | stats first(version) as version1,last(version) as version2 | eval result=if(version1 == version2,"yes","no")   Output When you compare the result, it should be based on a parameter such as common keys, timestamp etc. In the above example, we compared based on time stamp, i.e. takes the latest from both outputs and compared them. ... View more

Probably, you can start from  https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/GetthetutorialdataintoSplunk Also there free courses  https://www.splunk.com/en_us/training.html?301=%2Fen_us%2Ftraining%2Fcourses.html&filters=filterGroup1FreeCourses Start practising from above and use our community forum to get more insights 🙂 ... View more

It's worth to check your email server settings and make sure they are valid servers  Server settings  » Email settings https://docs.splunk.com/Documentation/Splunk/9.0.0/Alert/Emailnotification ... View more

you may use |eval duration=tostring(uptime,"duration")   Reference : Conversion functions  ... View more

You may try index=myindex (search1 terms OR search2 terms) |table App,Size,Count|addcoltotals ... View more

The error mentioned shouldnt be the reason for missing the data. There could be multiple reasons and close look into the splunkd log should give you some hints. Please refer to this documentation for generic reasons https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Cantfinddata ... View more

Try the search without the "search" keyword. ie. 'search=|rest /servicesNS/-/-/saved/searches/ splunk_server=local ... ... View more