Hi, i recently changes a SQL query in Splunk db connect to one of the dashboard. the query ran but i don't see the dashboard getting reflected to new data. as i was checking i see the index did not refresh after the new query is implemented. The last event of the index remians the day i changed the query. the new query had two new columns but i dont see it getting reflected. can anyone please help me with this. Its bit urgent !!!!!!!!!

Hello, What are the best methods to ingest Datadog Log and Metrics Data into Splunk Cloud/HF?  We have a requirement to fetch datadog dashboard and populate it to Splunk Dashboard. Thank you. Regards, Madhav

Hi, So i have below base query : | inputlookup abc.csv where DECOMMISSIONED=N | fields DATABASE DB_VERSION APP_NAME ACTIVE_DC HOST_NAME DB_ROLE COMPLIANCE_FLAG PII PCI SOX | rename DATABASE as Database | join type=left Database [| metadata type=hosts index=data | fields host, lastTime, totalCount | eval Database=Upper(host)| search totalCount&gt;1 | stats max(lastTime) as lastTime, last(totalCount) as totalCount by Database | eval age=round((now()-lastTime)/3600,1) | eval Status=case( lastTime&gt;(now()-(3600*2)),"Low", lastTime&lt;(now()-(3600*2+1)) AND lastTime&gt;(now()-(3600*8)) ,"Medium", lastTime&lt;(now()-(3600*8+1)) AND lastTime&gt;(now()-(3600*24)),"High", 1=1,"Critical") | convert ctime(lastTime) timeformat="%d-%m-%Y %H:%M:%S" | eval Reference="SPL"] | rex mode=sed field=HOST_NAME "s/\..*$//g" | fields Database Reference DB_VERSION APP_NAME ACTIVE_DC HOST_NAME Status DB_ROLE COMPLIANCE_FLAG | fillnull value=Missing Status | fillnull value=Null Now i need to add field let say Privacy with PII PCI and SOX as filter but i don't need the value of these fields to be come as filter in Privacy filed and reflect same in summary tab  <row> <panel> <table> <title>Summary</title> <search base="base"> <query>| search APP_NAME="$application$" Database="$database$" HOST_NAME="$host$" DB_VERSION="$version$" Status="$status$" COMPLIANCE_FLAG="$compliance$" Privacy="$privacyFilter$" | eval StatusSort=case(Status="Missing","1",Status="Critical","2",Status="High","3",Status="Medium","4",Status="Low","5") | sort StatusSort | table APP_NAME Database HOST_NAME DB_VERSION ACTIVE_DC Status DB_ROLE COMPLIANCE_FLAG PII PCI SOX | rename APP_NAME as Application, DB_VERSION as Version, ACTIVE_DC as DC, HOST_NAME as HOST</query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="number" field="FileSize"> <option name="precision">0</option> </format> <format type="color" field="Status"> <colorPalette type="map">{"Missing":#DC4E41,"Critical":#F1813F,"High":#F8BE34,"Medium":#62B3B2,"Low":#53A051}</colorPalette> </format> </table> </panel> </row> </form>   can someone help how i can get i added this panel <!-- New Privacy Filter Panel --> <input type="multiselect" token="privacyFilter" searchWhenChanged="true"> <label>Privacy</label> <choice value="*">All</choice> <choice value="PII">PII</choice> <choice value="PCI">PCI</choice> <choice value="SOX">SOX</choice> <fieldForLabel>Privacy</fieldForLabel> <fieldForValue>Privacy</fieldForValue> <default>*</default> <initialValue>*</initialValue> </input> </fieldset> and this <row> <panel> <table> <title>Summary</title> <search base="base"> <query>| search APP_NAME="$application$" Database="$database$" HOST_NAME="$host$" DB_VERSION="$version$" Status="$status$" COMPLIANCE_FLAG="$compliance$" Privacy="$privacyFilter$" | eval StatusSort=case(Status="Missing","1",Status="Critical","2",Status="High","3",Status="Medium","4",Status="Low","5") | sort StatusSort | table APP_NAME Database HOST_NAME DB_VERSION ACTIVE_DC Status DB_ROLE COMPLIANCE_FLAG PII PCI SOX | rename APP_NAME as Application, DB_VERSION as Version, ACTIVE_DC as DC, HOST_NAME as HOST</query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="number" field="FileSize"> <option name="precision">0</option> </format> <format type="color" field="Status"> <colorPalette type="map">{"Missing":#DC4E41,"Critical":#F1813F,"High":#F8BE34,"Medium":#62B3B2,"Low":#53A051}</colorPalette> </format> </table> </panel> </row> </form>   but getting no result found 

We could see only 10 hosts in index=os sourcetype=cpu & index=os source=vmstat. We should get all the unix/linux hosts on the mentioned sourcetype & source. We are using this to generate high cpu utilization, High memory utilization incidents. Like till August end we are able to see 100+ host for the mentioned source and sourcetype but after August we are not able to see 100+ host like we could see only 10.15,7  Please help me on this