is this a direct copy of the search string you're using? Try using 'straight' quotes, rather than 'curly' ones: Eval name2=if(ID="XYZ","Unknown", name) ... View more

Agree with Chris about reading the documentation, but to answer your sepcific question, if you click on the 'Open in Search' button on one of your panels that uses a summary search, a new window will open with the underlying search. The value of source in the query will correspond to the name of the underlying report, which should be listed in Settings>Searches, reports and alerts. Hope that helps, Phil ... View more

Hi, Can you try using CDATA in your link, something like: <link target="_blank"><![CDATA[ search?q=|makeresults | eval test="$row.test$" | rex field=test "(?<testxtract>.*)"&amp;earliest=-15m&amp;latest=now ]]></link> Did that help? ... View more

Do you have the multi-series mode enabled in your visualisation? If so, when you disable it, the graphs should be combined onto a single y-axis. The same goes for if you have trellis mode enabled. I'm not sure if you can change what these fields are called...what is the query you're using? Thanks ... View more

For a sparkline try: | tstats count by index | join index type=inner [| inputlookup LookUp1 | eval index=lower(index) | table field1,index,count | sort field1 asc] | stats list(index) as index, sum(count) as count, sparkline(sum(count)) as trend by field1 Let me know if that helps. Philip ... View more

no problem! You could use an eval statement with a case clause, something like: index=main sourcetype=audit_main source=AUDIT_LOGS RETURN_CODE="*" |eval RETURN_CODE=case(RETURN_CODE=="1017","Failed Login Attempts", RETURN_CODE=="1012","Another message",1==1,"other")|stats count by RETURN_CODE etc. See http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/ConditionalFunctions#case.28X.2C.22Y.22.2C....29 for more info on the case statement Hope that helps ... View more

Can you try removing the space after the count so that it's: stats count(machine) by location Let me know if that helps. ... View more

In your setup, Docker is mapping port 8000 on your Docker instance onto port 8000 on your machine, which is what enables you to access the Splunk UI of the Docker instance. The -p "8000:8000" part of your initial Docker run command is what did this. You need to add another port mapping flag for 8089 to allow access to the REST API, eg -p "8089:8089" to allow access to the REST API via your local machine. So the whole Docker run command would be something like: docker run -d -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_USER=root" -p "8000:8000" -p "8089:8089" splunk/splunk Now you should be able to access the REST API via https://localhost:8089 (nb, you need to use https, not http for REST API, unlike you did in your original post) ... View more