Yes, it is possible to add parameters to a Splunk URL to pre-populate the search query and make it more user-friendly. This can be helpful for sharing saved searches or dashboards with others so that they don't need to manually format the SPL search. To pre-populate a search query in a Splunk URL, you can use the search parameter. Here's the basic structure of a Splunk URL with a pre-populated search query: https://splunk_server:port/en-US/app/<APP_NAME>/search?q=<URL_ENCODED_SEARCH_QUERY> For example, if you want to pre-populate a search for "error messages," you can encode the query and create a URL like this: https://splunk_server:port/en-US/app/search/search?q=error%20messages When users click this URL, they will be taken to the Splunk search page with the "error messages" query already in the search bar. They can then execute the search or further refine it as needed. To create the <URL_ENCODED_SEARCH_QUERY> part of the Splunk URL, you need to URL-encode the actual SPL query you want to pre-populate in the URL. URL encoding is necessary to make sure that special characters or spaces in the query are correctly formatted for a URL. Here's an example: Let's say your SPL query is: index=myindex sourcetype=mylog "error messages" OR "warning messages" source="/var/log/app.log" To URL-encode this query, you would replace spaces with %20 and leave the rest of the query intact: index%3Dmyindex%20sourcetype%3Dmylog%20%22error%20messages%22%20OR%20%22warning%20messages%22%20source%3D%22%2Fvar%2Flog%2Fapp.log%22 So, your complete Splunk URL with the pre-populated URL-encoded search query would look like: https://splunk_server:port/en-US/app/search/search?q=index%3Dmyindex%20sourcetype%3Dmylog%20%22error%20messages%22%20OR%20%22warning%20messages%22%20source%3D%22%2Fvar%2Flog%2Fapp.log%22 You can use online URL-encoding tools (I am using CyberChef) to automatically encode your SPL query if it contains complex characters. Just paste your query into one of these tools, and it will generate the URL-encoded version for you.

It is a known issue related to SPL-235420. It is fixed in 9.1.0 https://docs.splunk.com/Documentation/Splunk/9.1.0/ReleaseNotes/Fixedissues#Charting.2C_reporting.2C_and_visualization_issues As a workaround, specify the app name directly in the dashboard definition.

Hello, I changed the title.  The CIDR match is used to see if a IP is within a subnet. I was trying to match the same IPv6, but with different format from index with my CSV table. In the example: Index has collapsed format of IPv6:  2001:db8:3333:4444:5555:6666::2101 CSV has expanded format of IPv6:    2001:db8:3333:4444:5555:6666:0:2101 The following lookup can NOT find the IPv6 that has the inconsistent pattern, it only find the exact match | index=vulnerability_index | lookup company.csv ip_address as ip OUTPUTNEW ip_address, company, location I think this is what I am looking for, I just don't know how to implement it https://splunkbase.splunk.com/app/4912 Thank you for your help

Do you mean /app/search/search?q=search%20index%3D_internal%0A%7C%20stats%20count%20by%20component (formatted) as opposed to /app/search/search?q=search%20index%3D_internal%20%7C%20stats%20count%20by%20component (one line)?  You just need to make sure the original URI is formated.

As @gcusello points out you can do this with a subsearch/inputlookup to the outer search or you can do it with a lookup + where clause - try both and use the one that gives you the best performance index="data" sourcetype="entities" ``` This will lookup the EXTERNAL_EMAIL field in the data against the E_MAIL field in the CSV ``` | lookup 20230904_NeverLoggedIn.csv E_MAIL as EXTERNAL_EMAIL OUTPUT E_MAIL as Found ``` If the EXTERNAL_EMAIL is Found in this case, it will give you the result Changed to isnull(Found) to find users that do NOT exist in the CSV ``` | where isnotnull(Found) | table EMAIL EXTERNAL_EMAIL CATEGORY

Try this by combining the two lookups using append for the second lookup index=toto [ | inputlookup test.csv | inputlookup test2.csv append=t | eval user=Domain."\\".Sam | table user] | table _time user I believe there is a missing '.' in your eval statement setting up user  and 'Sam' is a field name?

My example was XML for use in a classic dashboard - so if you take the entire XML below and create a new dashboard and paste in this into the source. <dashboard version="1.1"> <row> <panel> <table> <title>Turning the Time column red if outside hours 18:00 to 06:00</title> <search> <query> index="winlogs" host=* source="WinEventLog:Security" Eventcode=4624 Logon_Type=2 OR Logon_Type=7 NOT dest_nt_domain="Window Manager" NOT dest_nt_domain="Font Driver Host" | sort_time | convert ctime(_time) as timestamp | table timestamp,EventCode,Logon_Type,Account_Name,RecordNumber,status </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="timestamp"> <colorPalette type="expression">if(tonumber(substr(value,12,2))&gt;=18 OR tonumber(substr(value,12,2))&lt;6, "#FF0000", "#FFFFFF")</colorPalette> </format> </table> </panel> </row> </dashboard> This is what an XML dashboard looks like. You can see your search in the <search> section and the <format> section is what defines your colours and testing the time range. That documentation for the format is here https://docs.splunk.com/Documentation/Splunk/9.1.0/Viz/TableFormatsXML