Hi Guys, My search is working very well in search bar as shown below but  when i try to put that under a tab in Splunk Dashboard it is not working, could anyone please help 😞 P.S I'm using the latest tabs.js and tabs.css from git TIA kavya ... View more

hi Guys, I'm looking a better app than Meta Woot for the following reasons -> To track our licenses per index/sourcetype/host/source. -> To graph over a period of 1 month, quarter, 6 months and one year  Could anyone please suggest anything that you are using Regards Kavya   ... View more

Hi Friends, Apologies for my ignorance, but I have a problem formatting the output of the result from a sub-query. index=* "[92929292]" | stats values(CALLGUID) as CALLGUID by _time_ | dedup CALLGUID| mvexpand CALLGUID | join CALLGUID [ search index=* CALLGUID=* | rex "D](:|\s-)(? [^,|.]+)" | stats count by CALLGUID error | stats list(error) list(count) as count by CALLGUID] | fields _time,CALLGUID,errors,count _ I’m working on the above query and I get the results as attached as actualoutput.png and desired_output.png Could anyone please suggest how to make it work 😞 ... View more

Hi I currently have a search which returns a list of users with employee id from a user lookup eg: user lookup has the following information syyyyyy sxxxxxx szzzzzz My initial search returns syyyyy, sxxxxx but I want the search to return szzzzzz. But my below search is not returning any results *index=idx_xxxxx sourcetype="cisco:xxx" svc | rename user as identity | lookup local=true wfh_names_def identity OUTPUT identity, name | search identity NOT [| lookup local=true wfh_names_def identity OUTPUT identity, name] * Could anyone please help Thanks & Regards Kavya Dekkata ... View more