About ashrafsj

ashrafsj · ‎08-26-2021

@ITWhisperer - the solution works fine for 1 day worth of data for the API's. but when I try with 7 days/30 Days worth of data then it doesn't produce the desired results. I was using soucetype = json_no_timestamp which eventually splits the json into multiple events when the json file is large. At the moment with 10 API's the event is split into 2 events (for 7 days ) and when its 30 days its getting split in to multiple events. sample of 7 days data in JSON, { "org": "xxx", "env": "prod", "from_date": "08/20/2021 00:00:00", "curr_date": "08/26/2021 23:59:59", "data": [ { "management-api-v1": { "08/20/2021": { "Total Number of Traffic": "10.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "0.0" } "08/21/2021": { "Total Number of Traffic": "120.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "120.0" } "08/22/2021": { "Total Number of Traffic": "40.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "40.0" } "08/23/2021": { "Total Number of Traffic": "0.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "0.0" } "08/24/2021": { "Total Number of Traffic": "20.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "10.0" } "08/25/2021": { "Total Number of Traffic": "60.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "30.0", "Number of Success Traffic": "30.0" }"08/26/2021": { "Total Number of Traffic": "80.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "70.0" } } }, { "sXXXX-api-v1": { "08/20/2021": { "Total Number of Traffic": "2158.0", "Average Request Turnaround(ms)": "50.00", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "2108.0" } "08/21/2021": { "Total Number of Traffic": "2113.0", "Average Request Turnaround(ms)": "57.68", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "2108.0" } "08/22/2021": { "Total Number of Traffic": "2113.0", "Average Request Turnaround(ms)": "57.68", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "2108.0" } "08/23/2021": { "Total Number of Traffic": "2113.0", "Average Request Turnaround(ms)": "57.68", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "2108.0" } "08/24/2021": { "Total Number of Traffic": "2113.0", "Average Request Turnaround(ms)": "57.68", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "2108.0" } "08/25/2021": { "Total Number of Traffic": "2113.0", "Average Request Turnaround(ms)": "57.68", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "2108.0" } "08/26/2021": { "Total Number of Traffic": "2113.0", "Average Request Turnaround(ms)": "57.68", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "2108.0" } } }, { "sXX-api-v1": { "08/20/2021": { "Total Number of Traffic": "10.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "0.0" } "08/21/2021": { "Total Number of Traffic": "120.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "120.0" } "08/22/2021": { "Total Number of Traffic": "40.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "40.0" } "08/23/2021": { "Total Number of Traffic": "0.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "0.0" } "08/24/2021": { "Total Number of Traffic": "20.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "10.0" } "08/25/2021": { "Total Number of Traffic": "60.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "30.0", "Number of Success Traffic": "30.0" }"08/26/2021": { "Total Number of Traffic": "80.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "70.0" } } }, { "open-banking-v31": { "08/20/2021": { "Total Number of Traffic": "10.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "0.0" } "08/21/2021": { "Total Number of Traffic": "120.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "120.0" } "08/22/2021": { "Total Number of Traffic": "40.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "40.0" } "08/23/2021": { "Total Number of Traffic": "0.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "0.0" } "08/24/2021": { "Total Number of Traffic": "20.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "10.0" } "08/25/2021": { "Total Number of Traffic": "60.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "30.0", "Number of Success Traffic": "30.0" }"08/26/2021": { "Total Number of Traffic": "80.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "70.0" } } }, { "fca-accounting-metrics-api-v1": { "08/20/2021": { "Total Number of Traffic": "10.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "0.0" } "08/21/2021": { "Total Number of Traffic": "120.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "120.0" } "08/22/2021": { "Total Number of Traffic": "40.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "40.0" } "08/23/2021": { "Total Number of Traffic": "0.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "0.0" } "08/24/2021": { "Total Number of Traffic": "20.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "10.0" } "08/25/2021": { "Total Number of Traffic": "60.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "30.0", "Number of Success Traffic": "30.0" }"08/26/2021": { "Total Number of Traffic": "80.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "10.0", "Number of Success Traffic": "70.0" } } } ] }

ashrafsj · ‎08-23-2021

Thanks a lot @ITWhisperer for a quick answer

ashrafsj · ‎08-23-2021

Hi All, I have an JSON file that is ingested into Splunk, I need to create a dashboard with the different API's and their traffic fields extracted are having the the timestamp as well and it makes it difficult to be used directly for the dashboard queries data{}.fca-accounts-metrics-api-v1.08/23/2021.Number of Failure Traffic Below is the extract of the JSON content { "org": "xxx", "env": "prod", "from_date": "08/23/2021 00:00:00", "curr_date": "08/23/2021 23:59:59", "data": [ { "management-api-v1": { "08/23/2021": { "Total Number of Traffic": "0.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "0.0" } } }, { "sXXXX-api-v1": { "08/23/2021": { "Total Number of Traffic": "2113.0", "Average Request Turnaround(ms)": "57.68", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "2108.0" } } }, { "sXX-api-v1": { "08/23/2021": { "Total Number of Traffic": "0.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "0.0" } } }, { "open-banking-v31": { "08/23/2021": { "Total Number of Traffic": "0.0", "Average Request Turnaround(ms)": "0.0", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "0.0" } } }, { "fca-accounting-metrics-api-v1": { "08/23/2021": { "Total Number of Traffic": "135.0", "Average Request Turnaround(ms)": "57.66", "Number of Failure Traffic": "0.0", "Number of Success Traffic": "136.0" } } } ] } Is there a way to extract the API names and the traffic details. if this could be made to a tabular form with the date and api names and its traffic details it would be great to create a dashboard or chart.

ashrafsj · ‎02-08-2021

Hi @scelikok , Im trying to add the condition to compare the SMS_RECORD output among 3 different source types and only output SMS_RECORD entry that didnt reconcile between the 3 sourcetypes index=month source=XYZ (sourcetype=OVERDRAFT_REC1 OR sourcetype=OVERDRAFT_REC2 OR sourcetype=OVERDRAFT_REC3) | eval TIMESTAMP=coalesce(strptime(TIMESTAMP,"%d-%b-%y %H:%M:%S"),strptime(TIMESTAMP,"%Y-%m-%d %H:%M:%S.%6Q")) | bin span=1min TIMESTAMP | stats values(SMS_RECORD) AS SMS_RECORD BY TIMESTAMP sourcetype | mvexpand SMS_RECORD | where <<check SMS_RECORD that doesnt reconcile from the 3 different sourcetypes>>

ashrafsj · ‎02-08-2021

@to4kawa is there a way i can implement a condition which says the SMS_RECORD is not available in any one of the sourcetype. Pardon me for the syntax, but some thing like this | where NOT SMS_RECORD IN (sourcetype=OVERDRAFT_REC1 OR sourcetype=OVERDRAFT_REC2 OR sourcetype=OVERDRAFT_REC3)

ashrafsj · ‎02-08-2021

@to4kawa - the timestamp of sourcetype1 and 2&3 are different. sourcetype1 - %d-%b-%y %H:%M:%S sourcetype2&3 - %Y-%m-%d %H:%M:%S.%6Q once I convert them to same timestamp - %d-%m-%Y %H:%M , it would be easier to reconcile the events. if the entries from each of the sourcetypes are not equal, then it needs to display the SMS_RECORD (difference)

ashrafsj · ‎02-08-2021

Hi All, I have an issue while trying to reconcile events from 3 different source types, the events from each sourcetype below is from DBConnect, they run every 1 hour. I tried to schedule the alert to look into events last 3 hours, i get all the events instead of just the difference. tried mvexpand as well but didnt help much. the whole idea is to reconcile events from 3 different sourcetypes and get the result od missing SMS_RECORD out to team to look into. index=month source=XYZ sourcetype=OVERDRAFT_REC1 | dedup SMS_RECORD | eval TIMESTAMP=strftime(strptime(TIMESTAMP,"%d-%b-%y %H:%M:%S"),"%d-%m-%Y %H:%M") | stats values(SMS_RECORD) AS IN_T1 BY TIMESTAMP | append [ search index=month source=XYZ sourcetype=OVERDRAFT_REC2 | dedup SMS_RECORD | eval TIMESTAMP=strftime(strptime(TIMESTAMP,"%Y-%m-%d %H:%M:%S.%6Q"),"%d-%m-%Y %H:%M") | stats values(SMS_RECORD) AS IN_I1 BY TIMESTAMP ] | append [ search index=month source=XYZ sourcetype=OVERDRAFT_REC3 | dedup SMS_RECORD | eval TIMESTAMP=strftime(strptime(TIMESTAMP,"%Y-%m-%d %H:%M:%S.%6Q"),"%d-%m-%Y %H:%M") | stats values(SMS_RECORD) AS IN_TXT1 BY TIMESTAMP ] | mvexpand IN_T1 | mvexpand IN_I1 | mvexpand IN_TXT1 | stats values(IN_T1) AS T1,values(IN_I1) AS I1,values(IN_TXT1) AS TXT1 BY TIMESTAMP | where T1!=I1 OR I1!=TXT1 OR TXT1!=T1

ashrafsj · ‎11-05-2020

HI All, I need to reconcile 2 different swift messages from Splunk DB connect The key pattern should be <<YYYYMMDD>>#SWIFTRACKER#*#*#*#INFO The three * are UETR Number, ToSwift/FromIIB and status. Each combination of UETR Number and FromIIB record must have a corresponding record with UETR Number and ToSwift combination. For e.g., 20200715#SWIFTRACKER#FromIIB#abcdfghif#Accepted#INFO 20200715#SWIFTRACKER#ToSwift#abcdfghif#Accepted#INFO I have extracted the fields from the table, its a single filed in DB which holds this data | dbxquery connection=CONN query="select RECID from Schema.table" shortnames=true | rex field=RECID "(?<date>\d+)#(?<swift>\w+)#(?<source>\w+)#(?<uetr>\w+\-+\w+\-+\w+\-+\w+\-+\w+)#(?<status>\w+)#(?<loglevel>\w+)" | table date,swift,source,uetr,status,loglevel I need help with the reconciliation part, way to compare both the records and see if there was a corresponding entry for each ToSwift/FromIIB entry with the same UETR number.

ashrafsj · ‎09-15-2020

Just for the information - I have resolved the issue I had by adding <default></default> to the ip address as well. Hope this helps anyone who have similar issues. <input type="text" token="ip_address" searchWhenChanged="true"> <label>IP Address</label> <default></default> </input>

ashrafsj · ‎09-15-2020

When I enter the ID and choose the previous days and hit enter, there is no response. I tried to give IP address instead and there is response. then later I tried with ID and it gives the result once I hit the submit button. I have tried to refresh the dashboard and gave the ID and tried again, tried opening the search it shows undefined from the dashboard. Not sure whats happening with ID field.

ashrafsj · ‎09-15-2020

Hi All, I hope someone could help, search is waiting for inputs when I try to first load the dashboard and even search doesn't work. <form hideAppBar="false" hideEdit="false" hideFooter="true" hideSplunkBar="false" hideTitle="false"> <label>Activity by ID or IP ADDRESS</label> <fieldset submitButton="true" autoRun="false"> <input type="text" token="id" searchWhenChanged="false"> <label>ID</label> <default></default> </input> <input type="text" token="ip_address" searchWhenChanged="true"> <label>IP Address</label> </input> <input type="dropdown" token="timespan" searchWhenChanged="true"> <label>Previous Days</label> <choice value="7">7</choice> <choice value="14">14</choice> <choice value="30">30</choice> <choice value="60">60</choice> <choice value="90">90</choice> <choice value="120">120</choice> <choice value="180">180</choice> <choice value="9999">All</choice> <default>30</default> <initialValue>30</initialValue> </input> </fieldset> <search id="baseSearch"> <query>| dbxquery connection=XXX maxrows=2000 query="select \"timeLoRes\" as ACTIVITY_TIMESTAMP, \"category\",\"applicationId\",\"userId\",\"action\",\"action2\",\"action3\",\"policyId\",\"policyVersionId\",\"deviceId\",\"deviceHardwareId\",\"deviceOsType\",\"deviceOsVersion\",\"deviceModel\",\"sessionId\",\"deviceSessionId\",\"clientIp\",\"host\",\"errorCode\",\"errorMessage\",\"failure\" from REPORTS.REPORTS WHERE (\"userId\" = '$id$' OR \"clientIp\" = '$ip_address$') AND \"category\" = 'User' AND \"applicationId\" ='sso' AND \"timeLoRes\" > (sysdate - $timespan$)" shortnames=true</query> </search> <row> <panel> <chart> <title>SAC Successful</title> <search base="baseSearch"> <query>| search action = assert_start AND action2 = token_response | eval _time=strptime( ACTIVITY_TIMESTAMP, "%Y-%m-%d %H:%M:%S" ) | timechart span=1d count by action2</query> </search> <option name="charting.axisLabelsY.majorUnit">1</option> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.chart">column</option> <option name="charting.drilldown">all</option> <option name="charting.legend.placement">bottom</option> </chart> </panel> <panel> <table> <title>SAC Unsuccessful</title> <search base="baseSearch"> <query>| search action = assertion_start AND action2 = reject | chart count by action2</query> </search> <option name="drilldown">cell</option> </table> </panel> </row> <row> <panel> <title>SAC bind successful</title> <table> <title>Results</title> <search base="baseSearch"> <query>| search action = add_device_group | table ACTIVITY_TIMESTAMP, category,applicationId,userId,action,action2,action3,policyId,policyVersionId,deviceId,deviceHardwareId,deviceOsType,deviceOsVersion,deviceModel,sessionId,deviceSessionId,clientIp,host,errorCode,errorMessage,failure</query> </search> <option name="count">30</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> </table> </panel> </row> <row> <panel> <title>SAC form </title> <table> <title>Results</title> <search base="baseSearch"> <query>| search action = assertion_start AND action2 = form AND action3 = action | table ACTIVITY_TIMESTAMP, category,applicationId,userId,action,action2,action3,policyId,policyVersionId,deviceId,deviceHardwareId,deviceOsType,deviceOsVersion,deviceModel,sessionId,deviceSessionId,clientIp,host,errorCode,errorMessage,failure</query> </search> <option name="count">30</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> I was not able to format the code part, apologies for pasting it as it is.

ashrafsj · ‎08-20-2020

Thanks a lot @FrankVl , that worked for me. Many thanks!

ashrafsj · ‎08-19-2020

Thanks @FrankVl , I tried your query. The original query had returned 52 results and this one has returned 152 results and all the PrevQueueSize values shows 4 for all the queues. It doesn't seem to pick the previous queue size of each queue.

ashrafsj · ‎08-17-2020

Hi, I'm trying to reduce the number of alerts in Splunk, at the moment we receive splunk alert on queue size every 30 min. The problem here is the queue size/depth is the same when it triggers every 30 min, I need a solution so that we could check the previous queue size and the current queue size and stop alerting if they are same. index=day sourcetype="mqmon" EventType="QueueDepth" QDepth>0 | eval time=strftime(_time,"%d %b %Y %H:%M %p") | stats latest(QDepth) As QueueSize,max(time) As LastEvent by host, QMan, QName

ashrafsj · ‎05-26-2020

Hi all, I have created a below SPL, which will alert when the RECEIVED =0, but I want this as an alert only when the last 2 hours continuously the RECEIVED=0, if there is data in span of 1 hour in time range of last 2 hours, I dont want to get an alert. index=myIndex source=mySource sourcetype=mySourceType | timechart span=1h count AS Received | stats latest(Received) as RECEIVED by _time | where RECEIVED=0 Please let me know how this can be achieved?

ashrafsj · ‎05-21-2020

Sorry for late reply, my query worked for me, as I tried to test the dashboards separately and integrated the drilldown later. Not sure if there was some spacing issues when I initially tried. So I made a separate dashboard with the drilldown query to test if it worked and then moved that query part into the main drilldown panel. Thanks, Ashraf

ashrafsj · ‎05-18-2020

Hi All, I have an dashboard that has is a time chart and when I drilldown the server name, it has to fetch details from the DBX query. Instead of search servername in the dbx query, i tried to use token value to pass the server name from the timechart. |search $tokvalue_XX$ On Main panel, <drilldown> <set token="tokvalue_XX">$click.name2$</set> <set token="clicked_earliest">$earliest$</set> <set token="clicked_latest">$latest$</set> </drilldown> For the drilldown part, <row depends="$tokvalue_XX$"> <panel> <title>Drilldown - $tokvalue_XX$ from $clicked_earliest$ to $clicked_latest$</title> <table> <search> <query>| dbxquery connection="CONN" query="SELECT QUERY" shortnames=true | search \"\*$$tokvalue_XX$$\*\" | table SERVER, PROCESS,SQL_ID,PREV_SQL_ID,"Lock offset","Elapsed Time Secs"</query> <earliest>$clicked_earliest$</earliest> <latest>$clicked_latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">cell</option> </table> </panel> </row> When I click on the server name from the timechart on the server name, the second window just shows but doesn't pull any data based on the query. The query works when its being passed with the servername in Splunk and DB connect. I have tried passing the value as $$tokvalue_XX$$ or $tokvalue_XX$ or "$tokvalue_XX$"

ashrafsj · ‎05-05-2020

Thanks a lot @gcusello, I will also check out the other option that you have highlighted and get back to you on it. Much appreciated for a quick response.

ashrafsj · ‎05-05-2020

HI All, I have a search query that needs to be excluded to run on a bank holiday. I have created a holidays.csv file as a lookup table with Date,Description Entries as below, Date,Description 05/08/2020,Early May bank holiday 05/25/2020,Spring bank holiday 08/31/2020,Summer bank holiday I'm struggling to get my search to exclude the bank holidays from this list inputlookup holidays.csv | eval holiday = strftime(now(),"%m/%d/%Y") | where Date==holiday if this condition meets my search query should not be run. I tried to test with todays date but still the results are getting returned. search query | search NOT [ inputlookup holidays.csv | eval holiday = strftime(now(),"%m/%d/%Y") | where Date==holiday ] Any help is much appreciated.

ashrafsj · ‎02-18-2020

HI All, I have situation where I need to sum every 5 rows which are for every 10 min data for an hour. so for example I need to sum the rows and columns based on 01/01/2020 00:00:00 to 00:50:00 (6 rows) and i have 5 columns in place. The hourly total should sum all the 6 rows and columns data and should be split after every 6 rows.. as shown in the below example it would be run from 00:00:00 to 23:59:59 _time A B C D E Hourly_Totals 2020-01-01 00:00:00 178 3 0 0 1 2020-01-01 00:10:00 267 4 0 0 0 2020-01-01 00:20:00 250 2 0 0 3 2020-01-01 00:30:00 192 3 0 0 0 2020-01-01 00:40:00 233 4 0 0 0 2020-01-01 00:50:00 183 7 0 0 0 1330 ------------------------------------------------------------------------------ 2020-01-01 01:00:00 160 7 1 0 0 2020-01-01 01:10:00 142 5 0 0 0 2020-01-01 01:20:00 209 12 2 0 0 2020-01-01 01:30:00 399 31 0 0 0 2020-01-01 01:40:00 355 26 0 0 0 2020-01-01 01:50:00 661 15 3 0 1 <Total>

Posts	20
Solutions	1
Karma Given	4
Karma Received	2
Member Since	‎02-18-2020

Online Status	Offline
Date Last Visited	‎08-27-2021 01:41 PM

Splunk cloud - extracting JSON data

Reconciliation from 3 different sourcetypes

reconciliation of field value from Splunk DB conne...

Splunk Dashboard - search is waiting for inputs

Stop splunk alerts when the alert results are same...

Alert only when the count is continuously 0 for la...

Dashboard timechart label does not pass on to dril...

Bank holiday exclusion from search query

Sum after every 5 rows along with column totals

Re: Splunk cloud - extracting JSON data

Re: Splunk cloud - extracting JSON data

Splunk cloud - extracting JSON data

Re: Reconciliation from 3 different sourcetypes

Re: Reconciliation from 3 different sourcetypes

Re: Reconciliation from 3 different sourcetypes

Reconciliation from 3 different sourcetypes

reconciliation of field value from Splunk DB conne...

Re: Splunk Dashboard - search is waiting for input...

Re: Splunk Dashboard - search is waiting for input...

Splunk Dashboard - search is waiting for inputs

Re: Stop splunk alerts when the alert results are ...

Re: Stop splunk alerts when the alert results are ...

Stop splunk alerts when the alert results are same...

Alert only when the count is continuously 0 for la...

Re: Dashboard timechart label does not pass on to ...

Dashboard timechart label does not pass on to dril...

Re: Bank holiday exclusion from search query

Bank holiday exclusion from search query

Sum after every 5 rows along with column totals