Hi Splunkers,  some examples from our logs..  [Time:11:03:01] [Function:upload] [User:aaa] [Time:11:03:10] [Function:upload] [User:aaa] [Time:11:03:15] [Function:upload] [User:ccc] [Time:11:05:30] [Function:upload] [User:aaa] and my search | bin _time span=1m  | dedup _time   I want to count the events per 1min. or let's say deduplicate if other events are in 1 minute but only for same users.  and expect the result like this that user "CCC"  don't filtered.  [Time:11:03:01] [Function:upload] [User:aaa] [Time:11:03:30] [Function:upload] [User:ccc] [Time:11:05:10] [Function:upload] [User:aaa]   But my search filtered also other user's events and the result is like that.  [Time:11:03:01] [Function:upload] [User:aaa] [Time:11:05:30] [Function:upload] [User:aaa] This is only example logs that means users are not only two but over hunderes.  Can somebody help me how should i search?    Thanks  ... View more

Hi Splunkers!  This is just an example from splunk.  And it is a just similar visualization what i want to. Except a point.  It shows already seperately the time in second "Time" column. So i want to exclude the time in Third "Event" Column, part with red pen. And if it is possible, i want to show only part with blue pens in Event column. Is it available?   (I don't want to with statistic table because i want to keep the first (i) column which shows all information with clicking.      Can anyone help me? Thanks in advance.  ... View more

Hi Splunkers,     my search is like that  and it makes table with data and error message.  But error message includes like 50sentences.  And  I want to show this all sentences in table. But as you can image that table is too long and my dashboard looks like ugly.  So i want to show only first 3sentences with arrow or something.  Which means when user click arrow show all sentences for error, but before click you can see only 3 sentences. Can i do this in splunk?  Thanks for help !    ... View more

Hi, splunkers! I have question about menu bar or label bar. i'm not sure how i call. That screenshot is part of top-right in main page. normally we have only one Dashboard named "Application" in label like this photo . can i also add another dashboard next to "Application" ? which means next to "Application" i want to put another dashboard. is it possible? Thanks for any help ... View more

Hi Splunkers! i set the alert with "upload". which means someone upload something, i get email. The email is only included last event. But i want to get email with a few previous events. for example, if logs are like this [date:02.08.2019] [user:haha] [c:login] [date:02.08.2019] [user:haha] [c:download] [date:02.08.2019] [user:haha] [c:edit] [date:02.08.2019] [user:haha] [c:upload] i got email only with last line which is "[date:02.08.2019] [user:haha] [c:upload]". But i want to get alert email not only event but also previous events. which is "[date:02.08.2019] [user:haha] [c:edit], [date:02.08.2019] [user:haha] [c:upload] " or even last 3 events. is it possible? Thanks for reading ... View more