/opt/splunkforwarder/etc/system/default/props.conf [_json] /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf description = JavaScript Object Notation format. For more information, visit http://json.org/ /opt/splunkforwarder/etc/apps/armor/local/props.conf [armor_json_02] /opt/splunkforwarder/etc/apps/armor/local/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/apps/armor/local/props.conf description = JavaScript Object Notation format. For more information, visit http://json.org/ /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf [json_no_timestamp] /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/apps/splunk_internal_metrics/default/props.conf [log2metrics_json] /opt/splunkforwarder/etc/apps/splunk_internal_metrics/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/apps/splunk_internal_metrics/default/props.conf METRIC-SCHEMA-TRANSFORMS = metric-schema:log2metrics_default_json /opt/splunkforwarder/etc/apps/splunk_internal_metrics/default/props.conf description = JSON-formatted data. Log-to-metrics processing converts the numeric values in json keys into metric data points. /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json       json only extraction   all props.txt is way too long.

The fill_summary_index.py script referenced in the above link merely runs your saved searches that populate a summary index.  You can use the same script to run other saved searches that populate/update a KVStore.

Hi @ITWhisperer         I tried few way, I didn't got it. <condition match="isnull($office_filter$) == &quot;Front_Office*&quot;"> <set token="office_filter_drilldown">form.office_filter=Front%20Office</set> </condition> <condition match="isnull($office_filter$) == &quot;Back_Office*&quot;"> <eval token="office_filter_drilldown">form.office_filter=Back%20Office</eval> </condition> <condition match="isnull($office_filter$) == &quot;Front_Office*&quot; AND == &quot;Back_Office*&quot;"> <eval token="office_filter_drilldown">form.office_filter=Front%20Office&amp;form.office_filter=Back%20Office</eval> </condition>    can you please share that as well. Thanks in Advance!

It's purposely never set. The javascript is responsible for displaying the panel instead. However, I do believe that my placement in my example was incorrect and the depends clause should be bound to the panel rather than the row.

I don't see how to edit my post, so I'll make a correction here. The "$HIDEME$" token appears to need to be at the panel level, not the row. <row> <panel id="help" depends="$HIDEME$">   There is no issue with using that token otherwise, and I have dashboards where this will work until it just stops working. My feeling is that it functions properly early in the dashboard loading process, but then stops once it's complete. My troubleshooting leads me to believe that it might be the case that using <done> conditions to set tokens on search completion is the culprit, e.g. ... <query> ... </query> <earliest>0</earliest> <latest></latest> <done> <condition match="$job.resultCount$ &gt; 0"> <set token="has_notables">true</set> </condition> <condition> <unset token="has_notables"></unset> </condition> </done> </search>  

Hi @richgalloway , Thank you for your response.  Similar to summary index , I have KV Stores as well , where I am pushing data in similar manner in 10 days batches and appending data in KV Store. Can you please suggest a workaround for KV Stores as well for pushing  2years data in batches without manual intervention.

Try something like this index=* | fields - _time _raw | foreach * [| eval <<FIELD>>=if("<<FIELD>>"=="index",index,if("<<FIELD>>"=="source",source,sourcetype))] | table * | fillnull value="N/A" | foreach * [eval sourcetype=if("<<FIELD>>"!="sourcetype" AND "<<FIELD>>"!="source" AND "<<FIELD>>"!="index",if('<<FIELD>>'!="N/A",mvappend(sourcetype,"<<FIELD>>"),sourcetype),sourcetype)] | dedup sourcetype | table index source sourcetype

I tried to build below SPL so far:- |inputlookup table1.csv |table index, sourcetype |eval key="index=custom_index orig_index=".index." orig_sourcetype=".sourcetype." | timechart span=1d avg(event_count) AS avg_event_count |predict avg_event_count future_timespan=1 |tail 1 | fields prediction(avg_event_count)" With above SPL, I get three columns: index, sourcetype and key. In column key, I get the corresponding SPL of the row. Thus, I need help to execute and generate results for each row. Thank you