HI Team, I would like to use join to search for "id" and pass it to sub search and need the consolidate result with time. search 1: searching for value next to "id" provide me list index=TEST sourcetype=source1 url="/api/v1/test" | rex "'id':'(?<id>[\d.]+)" | table _time id Above search gives me integer "id" I will pass in search2. Search2:  index=TEST sourcetype=source2 url="/api/*/values(id)/*" Response_Status="200" | table url _time   I need output from search2 referencing id from search 1    ... View more

Hi Team, I have a query that output below. loggerName="test" DC=Test ENV=IT AppName=Test2 HostPort=9443 ClientIP=17.XXX.XX.XXX ClientAppId= ClientAppName= txnId=test1 sessionId=test2 method=test requestHeaders={x---geo-test=TEST, x--test=000, dsid=000188, postman-token=TEST, User-Agent=PostmanRuntime/7.20.1, mid=test x-gs-token=test altdsid=test, deflate, Content-Length=83, X-Real-IP=test, Content-Type=application/json, Cookie=SA-Locale=en_US; dslang=US-EN, Accept=/, Host=sse-ws-p189-test.apple.com ,no-cache,X-MMe-Client-Info= x-mme-client-info= X-MMe-Client-Info= <=Test OS;11.3;16G102> } Here I would like to capture/Search for the 'Test OS;11.3' and make it to Test-OS=11.3 and count and chart the Test-OS values (Please note 11.3 is variable value) Then the I would like to chart the number of logs entries with Test-OS > 13. ... View more

Hi Team, My current configs has drop down with one token , 3 choice value and 1 search query below. $api_cached_realtime_token$ is replaced by choice value as per 3 dropdown(All, RealTime, Cached ) Below is original code: <input type="dropdown" token="api_cached_realtime_token" searchWhenChanged="true"> <label>Type</label> <choice value="apiActualTimeTaken">All</choice> <choice value="realTime_timeTaken">RealTime</choice> <choice value="cached_timeTaken">Cached</choice> <default>apiActualTimeTaken</default> <initialValue>apiActualTimeTaken</initialValue> </input> <chart> <search> <query>index=mysupport_core sourcetype=mysupport_app_log event=ApiSummaryEvent api=LinkingToolController.linkProduct apiStatus=* | timechart span=1h avg($api_cached_realtime_token$) as AVG, P95($api_cached_realtime_token$) as P95</query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> Now I am moving into summary index. summary_index is = my_summary_index I am writing all the above into summary index by using search query below. index=mysupport_core sourcetype=mysupport_app_log event=ApiSummaryEvent api=LinkingToolController.linkProduct apiStatus=* | stats avg(apiActualTimeTaken) as AVG_Actual avg(realTime_timeTaken) as AVG_real avg(cached_timeTaken) as AVG_cached P95(apiActualTimeTaken) as P95_Actual P95(realTime_timeTaken) as P95_real P95(cached_timeTaken) as P95_cached Pls help me achieve same with 3 dropdown (All, RealTime, Cached ) that output search for respective drop-down. (one-token-multiple value-perhaps) index=my_summary_index | stats sum(AVG_Actual or AVG_real or AVG_cached ) as AVG sum(P95_Actual or P95_real or P95_cached) as per dropdown(All, RealTime, Cached ) respectively. I tried This article helped a bit but could not achieve yet. https://answers.splunk.com/answers/525245/how-to-pass-multiple-values-for-a-field-through-to-1.html ... View more

I would like to track count of the all the below splunk search query columns. if any "solutionType" is appended or deleted I expect alert. index=index1 | search solutionType=* | timechart count by solutionType | result below column1 column2 column3 column4 column5 if column6 is added in next splunk report. or col5 is removed I expect alert. if current_col_count != 5 I would like to track if any "solutionType" is appended or deleted in next splunk report expect alert. ... View more