i have 3 stats panel in a row, i need first panel width as 40% and 2nd panel as 40% and 3rd panel is 20% (if solution given in pixels its very better) by the way below is not my requirement one of scenario  there solution is given for different types of panel but here i have same type of panel. it would be better if solution provided from UI itself rather than changes from backend Splunk infra.   Thanks. ... View more

Need to find out suspicious IPs and count of hits (sub search) use those IPs and do outer search in same time frame of each result of subsearch show fields of outer search and inner search count index=trace type=success | eval temp=split(ip,",") |eval src=mvindex(temp,0) | search [search index=trace type=blocks | bin span=10m _time |eval temp=split(ip,",") |eval src=mvindex(temp,0)|stats count by src| where count > 50| fields src] | table _time src route Now i am getting wrong results because ip is dynamic (once ip used by attacker may be genuine ip at other time, i am getting genuine results of suspicious IP used once - time picker is last 6 months.).. now i want to search outer query in same timeframe of each subsearch result (need to find ip of success type who are blocked more than 50 times at same time) Thanks in Advance. ... View more

How to ignore a transaction (not an event) if any of its events contain a "abcd" string ... View more