I have changed the schedule report to run at at a different time, it is working now. Thank you!!! ... View more

I've had a look at that site a few times, however, I cannot download the programs mentioned there as they run on Windows and I'm using Apple... ... View more

The UID drop down ... View more

<input type="time" token="field1"> <label></label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="staff_email" searchWhenChanged="true"> <label>Email</label> <choice value="*">All</choice> <search> <query>|sort dataa_alias|table dataa_alias</query> </search> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>dataa_alias</fieldForValue> <default>*</default> </input> <input type="dropdown" token="gadget_os" searchWhenChanged="true"> <label>gadget OS</label> <choice value="*">All</choice> <search> <query>| tstats count from datamodel=switch_dm where ( nodename=switch._switch_ping ) AND (switch.dataa_alias=*) GROUPBY switch.gadget_os|sort switch.gadget_os|table switch.gadget_os</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>switch.gadget_os</fieldForValue> <default>*</default> </input> <input type="dropdown" token="phone" searchWhenChanged="true"> <label>Phone</label> <choice value="*">All</choice> <search> <query>| tstats count from datamodel=switch_dm where ( nodename=switch.switch_ping ) AND (switch.dataa_alias=*) GROUPBY switch.sd_name|sort switch.sd_name|table switch.sd_name</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>switch.sd_name</fieldForValue> <default>*</default> </input> <input type="dropdown" token="team" searchWhenChanged="true"> <label>Team</label> <choice value="*">All</choice> <choice value="null">Null</choice> <search> <query>|inputlookup|dedup Team|sort Team|table Team</query> </search> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>Team</fieldForValue> <default>*</default> </input> <input type="dropdown" token="uid" searchWhenChanged="true"> <label>UID</label> <search> <query>| inputlookup |sort data_uid|table data_uid</query> </search> <fieldForLabel>data_uid</fieldForLabel> <fieldForValue>data_uid</fieldForValue> <choice value="*">All</choice> <default>*</default> </input> <panel> <table> <title>Pivot Report - By Staff</title> <search> <query>| tstats count from datamodel=switch_dm where ( nodename=switch._switch_ping ) AND (switch.dataa_alias=$staff_email$) (switch.gadget_os="$gadget_os$") (switch.sd_name="$phone$") NOT ("switch.dataa_alias"=unknown) GROUPBY _time span=1d switch.dataa_alias|lookup_switch.dataa_alias OUTPUT Name Team|fillnull value=null Team|search Team="$team$" |rename switch.dataa_alias AS dataa_alias|lookup staff_lookup dataa_alias OUTPUT data_uid|search data_uid="$uid$" |eval "Date" = strftime(_time, "%F %T")|rename dataa_alias As Email |chart limit=30 values(count) by Email,Date</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <drilldown> <set token="staff_email">$row.Email$</set> <set token="form.staff_email">$row.Email$</set> </drilldown> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">heatmap</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> <panel> <table> <title>Pivot Report - By Team</title> <search> <query>| tstats count from datamodel= switch_dm where ( nodename= switch. switch_ping ) AND (switch.dataa_alias=$staff_email$) (switch.gadget_os="$gadget_os$") (switch.sd_name="$phone$") NOT ("switch.dataa_alias"=unknown) GROUPBY _time span=1d switch.dataa_alias|lookup switch.dataa_alias OUTPUT Name Team|fillnull value=null Team|search Team="$team$" |rename switch.dataa_alias AS dataa_alias|lookup _staff_lookup dataa_alias OUTPUT data_uid|search data_uid="$uid$" |eval "Date" = strftime(_time, "%F %T")|rename switch.dataa_alias As Email | chart limit=30 sum(count) by Team,Date</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <drilldown> <set token="team">$row.Team$</set> <set token="form.team">$row.Team$</set> </drilldown> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> <panel> <chart> <title>Staff Chart</title> <search> <query>| tstats count from datamodel=switch_dm where ( nodename=switch.switch_ping ) AND (switch.dataa_alias=$staff_email$) (switch.gadget_os="$gadget_os$") (switch.sd_name="$phone$") NOT ("switch.dataa_alias"=unknown) GROUPBY _time switch.dataa_alias|lookup switch.dataa_alias OUTPUT Name Team|fillnull value=null Team|search Team="$team$" |rename switch.dataa_alias AS dataa_alias|lookup _staff_lookup dataa_alias OUTPUT data_uid|search data_uid="$uid$" |rename switch.dataa_alias As Email |timechart values(count) by Email limit=30</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">zero</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> ... View more

Thank you for your response. I have gone through the beginning of the book... now on Chapter 2, and have not seen the link to download, would you be able to assist me further, could you perhaps send me the link? Thank you ... View more

Splunk 6.2.1 - I am using a macbook air laptop. When I look at the details of the folder it does not say that it is zipped. Could you possibly send it to me already zipped? Thank you for your response. ... View more