I have a use-case where a Splunk end-user should only be allowed to search on a subset of events in an index. For example, restrict the end-user to only be able to search for customer's data which the end-user has authorisation to. Is there a smart way of doing this in Splunk? I looked into different solutions like Splunk Apps, External Lookup, Custom parameters in OAuth... Building a new front-end app and use the Splunk search API is one way, however, that is probably not the smartes ways of doing it.  I guess that I'm not the first one that has this use-case.

Have a dashboard where have a timer input, drop down 1 (DD1) depends on timer input, multi-select drop down 2 (DD2) depends on  DD1. Once all the input is provided, user hits on "Submit" button and the resulting chart should be displayed. All of this works well as long as separate search queries are used in each one of them. Once the timer changes, DD1 is searched and values are displayed. Once DD1 is selected, DD2 search starts, and corresponding values are displayed. All goes well.  Here's a working example:   <form version="1.1" theme="light"> <label>Technical - HTTP Metrics</label> <fieldset submitButton="true" autoRun="false"> <input type="time" token="time_duration_token" searchWhenChanged="false"> <label>Select a time range</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="service_name_token" searchWhenChanged="false"> <label>Select microservice</label> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search> <query> index="cloud_world" | spath source | search event.logger="*CustomLoggingMeterRegistry*" | rex field=event.message "(?&lt;metric_name&gt;[a-z.]+)" | search metric_name="http.server.requests" | dedup source </query> <earliest>$time_duration_token.earliest$</earliest> <latest>$time_duration_token.latest$</latest> </search> </input> <input type="multiselect" token="http_uri_multiselect_token" searchWhenChanged="false"> <label>Select URI</label> <fieldForLabel>http_uri</fieldForLabel> <fieldForValue>http_uri</fieldForValue> <search> <query> index="cloud_world" | spath source | search source=$service_name_token|s$ event.logger="*CustomLoggingMeterRegistry*" | rex field=event.message "(?&lt;metric_name&gt;.*){.*,status=(?&lt;http_status&gt;[\d]{3}),uri=(?&lt;http_uri&gt;.*)}.*mean=(?&lt;mean_time&gt;[\d.]+)s\smax=(?&lt;max_time&gt;[\d.]+)" | search metric_name="http.server.requests" | top http_uri </query> <earliest>$time_duration_token.earliest$</earliest> <latest>$time_duration_token.latest$</latest> </search> <delimiter>,</delimiter> <valueSuffix>"</valueSuffix> <valuePrefix>"</valuePrefix> </input> <input type="checkbox" token="http_status_token"> <label>Select HTTP status</label> <choice value="&quot;200&quot;, &quot;201&quot;">2xx</choice> <choice value="&quot;400&quot;, &quot;401&quot;">4xx</choice> <delimiter> </delimiter> </input> </fieldset> <row> <panel> <title>Mean time by URI</title> <chart> <title>Mean time</title> <search> <query> index="cloud_world" | spath source | search source=$service_name_token|s$ event.logger="*CustomLoggingMeterRegistry*" | rex field=event.message "(?&lt;metric_name&gt;.*){.*,status=(?&lt;http_status&gt;[\d]{3}),uri=(?&lt;http_uri&gt;.*)}.*mean=(?&lt;mean_time&gt;[\d.]+)s\smax=(?&lt;max_time&gt;[\d.]+)" | search metric_name="http.server.requests" | where http_uri in($http_uri_multiselect_token$) AND http_status in($http_status_token$) | chart max(mean_time) over _time by http_uri usenull=f useother=false </query> </search> <option name="charting.axisTitleX.text">Time</option> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.text">Time (in ms)</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.chart">line</option> <option name="charting.chart.nullValueMode">connect</option> <option name="charting.chart.showDataLabels">minmax</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.placement">none</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">1</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> </form>   If you see, the same searches are used everywhere, hence I decided to use base search in input dropdown as below: <form version="1.1" theme="light"> <label>Technical - HTTP Metrics</label> <search id="httpMetricsBaseSearch"> <query> index="cloud_world" | spath source | search event.logger="*CustomLoggingMeterRegistry*" | rex field=event.message "(?&lt;metric_name&gt;[a-z.]+){(?&lt;metric_dimensions&gt;.*)}\s(?&lt;metric_measurements&gt;.*)" | search metric_name="http.server.requests" | rex field=metric_dimensions "status=(?&lt;http_status&gt;[\d]{3}),uri=(?&lt;http_uri&gt;.*)" | rex field=metric_measurements "mean=(?&lt;mean_time&gt;[\d.]+)s\smax=(?&lt;max_time&gt;[\d.]+)" | table source, http_uri, http_status, max_time, mean_time, _time </query> <earliest>$time_duration_token.earliest$</earliest> <latest>$time_duration_token.latest$</latest> </search> <fieldset submitButton="true" autoRun="false"> <input type="time" token="time_duration_token" searchWhenChanged="false"> <label>Select a time range</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="service_name_token" searchWhenChanged="false"> <label>Select microservice</label> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search base="httpMetricsBaseSearch"> <query> | dedup source </query> </search> </input> <input type="multiselect" token="http_uri_multiselect_token" searchWhenChanged="false"> <label>Select URI</label> <fieldForLabel>http_uri</fieldForLabel> <fieldForValue>http_uri</fieldForValue> <search base="httpMetricsBaseSearch"> <query> | where source=$service_name_token|s$ | dedup http_uri </query> </search> <delimiter>,</delimiter> <valueSuffix>"</valueSuffix> <valuePrefix>"</valuePrefix> </input> <input type="checkbox" token="http_status_token"> <label>Select HTTP status</label> <choice value="&quot;200&quot;, &quot;201&quot;">2xx</choice> <choice value="&quot;400&quot;, &quot;401&quot;">4xx</choice> <delimiter> </delimiter> </input> </fieldset> </form> In this case, if I change the time from time picker, the "Select service" dropdown is not researched. This used to happen, when searches were different. But after using base search, this just doesn't work. It actually starts to search, once the "Submit" button is clicked, but I want to reserve that for "final" submit, i.e. when user has provided all his inputs.  Is there a way to fix this, or is it that base search are not supposed to be used in input searches when submitButton="true" ?  

Hello I have few services that today sends data some index via code. We are going to remove this index and create new one but cannot change the code so i want to change the point with transforms.conf + props.conf using regex that extract the service name from source field and the environment from _raw this is my transforms.conf file :   [service_extraction] SOURCE_KEY = source REGEX = \/var\/log\/pods\/(.+?)_ FORMAT = complaince_int_front::@service_$environment DEST_KEY = _MetaData:Index LOOKAHEAD = 40000 [environment_extraction] SOURCE_KEY = sourcetype::kube:container:mockapiservice REGEX = "Region":"(.+?)" FORMAT = complaince_int_front::@service_$1 DEST_KEY = _MetaData:Index LOOKAHEAD = 40000 i guess i did something wrong since its not working