@ITWhisperer  , i considered 1,0 and and put condition like this. But still i am not able to set the token. Is this implementation correct? <done> <condition match="match(has_runtime,&quot;1&quot;)"> <set token="tok_runtime">true</set> </condition> <condition match="match(has_runtime,&quot;0&quot;)"> <unset token="tok_runtime"></unset> </condition> </done>   ... View more

@ITWhisperer, yes im trying to set a token based on the value has_runtime. Since i want to show some charts only if that particular data is present.  For this i am trying to create a token so that i can use this to show or hide the charts. ... View more

@ITWhisperer,I have used stats and i was able to match the data. I want to do one more implementation. I want to se t token based on the availability of Info.runtime_data{}. For every event there will not be Info.runtime_data{}. I want to set a token if Info.runtime_data{} is present in the event of Info.Title, if not present i want to unset that token. I have tried it in the search query using if condition. But i am not able to implement it in the dashboard. <search> <query> index="abc" sourcetype="abc" Info.Title="$Title$" |spath output=Runtime_data path=Info.runtime_data | eval has_runtime = if(isnotnull(Runtime_data), "Yes", "No") | table _time, has_runtime </query> <done> <condition match="has_runtime=Yes"> <set token="tok_runtime">true</set> </condition> <condition match="has_runtime=No"> <unset token="tok_runtime"></unset> </condition> </done> </search> This is my code, i am not sure the Condition match is correct or not. But im not able to set or unset the token. Please suggest me anything. ... View more

Hi @ITWhisperer , Thank you so much for the info. I referred the example mentioned above and i was able to get the answer. ... View more

Hi @AKG11 , I'm trying to use your solution. I have used this query to populate dropdown. | makeresults | addinfo | eval date=mvrange(info_min_time,info_max_time,"1mon") | mvexpand date | sort - date | eval Month=strftime(date,"%b-%y") | table Month date May i know how did you use this token from drill down in searches? So that searches whill take the exact month selected? ... View more

Hi @richgalloway , i added the year and it is working fine now. I want to only show the calendar week in the chart, any solution for this? What i understand is that we cannot change the labels. ... View more

Hi @richgalloway , Is it possible to sort this according to the year? My search query i have set for last 3 months data, it is taking last years data. But in chart the calendar week 48,49 etc are coming at the end. But they should be in the beginning. I am trying out some solutions but not able to do it properly. Do you know any suggestion for this? ... View more

Thank you @gcusello , I'll try using lookup. ... View more

Hi, @gcusello ,   Thanks for the reply. I have one concern, in the mutliselect dropdown the values selected will be a,b,c or b,c,a etc which will be comma separated. In such conditions will this logic will work? ... View more

Thank you so much.. I totally forgot that it is already in epoch format. ... View more

Mt date field is _time. When i use this query i'm getting as no results found. | eval weeknum=strftime(strptime(_time,"%d-%m-%Y"),"%V") | chart dc(Task_num) as Tasks over weeknum by STATUS   ... View more

Hi @gcusello , I tested it and it is working fine. The paths in my data are vary from another. I may have data something like this. In these conditions will it work. C:\a\b\c\abc.pqr.a1.b1.jkl\xyz\abc.h   ... View more

hi @gcusello , still i am not able to extract. ... View more

hi @gcusello , I am not able to get the path \xyz\abc.h using this regex.. ... View more

Hi @gcusello , Thanks for the response.. I don't want to  extract the first 4 folders.. I want to skip them and extract the rest of the path.. I was finding hard writing a regex.. How can i do this? ... View more

Hi @bowesmana the data comes from Splunk index and it is csv file ... View more

Hi @bowesmana , the method you mentioned is working fine.. Sorry for not mentioning before, the column VALUE can have data like {'a','b'} or a. In such cases how can i change the regex? ... View more