Hello people, I'm very new to Splunk and I'm trying to create a dashboard with the "Statistics Table" Visualisation, that is more compact and takes up less space than what was there before. In order to achieve this, I'm concatenating several strings from different fields, kind of like this: | eval compactfield="1. ".field1." 2. ".field2." 3. ".field3 and while that looks fine and works, it'd be great if I could add some kind of color tag (or maybe even bold, italic and so on) so that there'd be a different color for each line, making it easier to differentiate for people looking at the dashboard. I'm imagining something like this: | eval compactfield="<col="blue">1. ".field1." </col><col="red">2. ".field2." </col><col="purple">3. ".field3."</col>" Is there a way to achieve this? I'm really sorry if this question has been asked before, but I couldn't find anything. Thanks for your time, Cyd 

Hello, I have some issues writing PROPS configuration for XML source file. Sample XML events (2 Events) are given below. Any help will be highly appreciated. Thank you so much. TIME_PREFIX= TIME_FORMAT= LINE_BREAKER= -------------------------------- <a2ETraceEvent xmlns=http://schemas.test.com/2014/06/a2ETraceEvent>     <System xmlns=http://schemas.test.com/2014/08/windows/events/systems>         <EventID>0</EventID>         <Type>3</Type>         <SubType Name="Error">0</SubType>         <Level>2</Level>         <TimeCreated SystemTime="2021-07-20T04:00:53.4370283Z" />         <Source Name="ATech.Notifications" />         <Correlation ActivityID="{975c26b1-7acd-4ea0-8ad6-d7be1358e5fc}" />         <Execution ProcessName="ATech.JobFramework.Job" ProcessID="292132" ThreadID="1" />         <AssemblyVersion>6.4.10100.1051</AssemblyVersion>         <Channel />         <Computer>XVL0SMEMAPPAGR14</Computer>     </System>     <ApplicationData>         <TraceData>             <DataItem>                 <TraceRecord Severity="Error" xmlns=http://schemas.test.com/2014/10/a2ETraceEvent/TraceRecord>                     <TraceIdentifier>ATech.Notifications</TraceIdentifier>                     <Description>Error sending the email message generated for notification template 'Employee Training - ' with id = '12552'.</Description>                     <AppDomain>ATech.JobFramework.Job.exe</AppDomain>                     <Exception>                         <ExceptionType>ATech.Common.Exceptions.SendEmailNotificationException, ATech.Common, Version=6.4.10100.1051, Culture=neutral, PublicKeyToken=null</ExceptionType>                         <Message>Error sending the email message generated for notification template 'Employee Training - with id = '12552'.</Message>                         <Source />                         <ContextData>                             <Resolution>Please verify that the server configured in the ECPSA is reachable. For further support, please contact your system administrator.</Resolution>                             <ServerAddress>Changeit-mail-relay</ServerAddress>                         </ContextData>                         <StackTrace />                         <InnerException>                             <ExceptionType>System.Net.Mail.SmtpException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934a19</ExceptionType>                             <Message>Failure sending mail.</Message>                             <Source>System</Source>                             <StackTrace>   at System.Net.Mail.SmtpClient.Send(MailMessage message)    at ATech.Notifications.Providers.Mail.DefaultSmtpProvider.Send(MailMessage mailMessage, Notification notification)</StackTrace>                             <InnerException>                                 <ExceptionType>System.Net.WebException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=c77a52161934e08</ExceptionType>                                 <Message>The remote name could not be resolved</Message>                                 <Source>System</Source>                                 <StackTrace>       at System.Net.Mail.SmtpConnection.GetConnection(ServicePoint servicePoint)    at System.Net.Mail.SmtpClient.GetConnection()    at System.Net.Mail.SmtpClient.Send(MailMessage message)</StackTrace>                             </InnerException>                         </InnerException>                     </Exception>                 </TraceRecord>             </DataItem>         </TraceData>     </ApplicationData> </a2ETraceEvent> <a2ETraceEvent xmlns=http://schemas.test.com/2014/06/a2ETraceEvent>     <System xmlns=http://schemas.test.com/2014/08/windows/events/systems>         <EventID>1</EventID>         <Type>3</Type>         <SubType Name="Error">2</SubType>         <Level>1</Level>         <TimeCreated SystemTime="2021-07-20T04:00:54.4370283Z" />         <Source Name="ATech.Notifications" />         <Correlation ActivityID="{875c26b1-7acd-2ea0-8ad6-d7be1358e5f1}" />         <Execution ProcessName="ATech.JobFramework.Job" ProcessID="122132" ThreadID="1" />         <AssemblyVersion>6.4.10101.1061</AssemblyVersion>         <Channel />         <Computer>XVL0SMEMAPPAGR14</Computer>     </System>     <ApplicationData>         <TraceData>             <DataItem>                 <TraceRecord Severity="Error" xmlns=http://schemas.test.com/2014/10/a2ETraceEvent/TraceRecord>                     <TraceIdentifier>ATech.Notifications</TraceIdentifier>                     <Description>Error sending the email message generated for notification template 'Employee Training - ' with id = '237521.</Description>                     <AppDomain>ATech.JobFramework.Job.exe</AppDomain>                     <Exception>                         <ExceptionType>ATech.Common.Exceptions.SendEmailNotificationException, ATech.Common, Version=6.4.10100.1051, Culture=neutral, PublicKeyToken=null</ExceptionType>                         <Message>Error sending the email message generated for notification template 'Employee Training - with id = '237521'.</Message>                         <Source />                         <ContextData>                             <Resolution>Please verify that the server configured in the ECPSA is reachable. For further support, please contact your system administrator.</Resolution>                             <ServerAddress>Changeit-mail-relay</ServerAddress>                         </ContextData>                         <StackTrace />                         <InnerException>                             <ExceptionType>System.Net.Mail.SmtpException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=g77a5c561944t16</ExceptionType>                             <Message>Failure sending mail.</Message>                             <Source>System</Source>                             <StackTrace>      at ATech.Notifications.Providers.Mail.DefaultSmtpProvider.Send(MailMessage mailMessage, Notification notification)</StackTrace>                             <InnerException>                                 <ExceptionType>System.Net.WebException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=c77c52161934r19</ExceptionType>                                 <Message>The remote name could not be resolved</Message>                                 <Source>System</Source>                                 <StackTrace>   at System.Net.ServicePoint.GetConnection(PooledStream PooledStream, Object owner, Boolean async, IPAddress&amp; address, Socket&amp; abortSocket, Socket&amp;)    at System.Net.Mail.SmtpConnection.GetConnection(ServicePoint servicePoint)    at System.Net.Mail.SmtpClient.GetConnection()    at System.Net.Mail.SmtpClient.Send(MailMessage message)</StackTrace>                             </InnerException>                         </InnerException>                     </Exception>                 </TraceRecord>             </DataItem>         </TraceData>     </ApplicationData> </a2ETraceEvent>

Hello support, I'm planning to use edit_tcp to send data for indexing to an REST endpoint in Splunk (no need to use a forwarder). My question: - Is it possible the send data to a specific Index or by default, it will send to all indexes ? - Is it possible to restrict sending data to only one index ?   Thank you.

Hello, I have a requirement to find the rolling average  and variance % as per below requirement. If there is no event for any date then we should have an 0 events for that missing date so that we've continuously dates in our report. The "7d Rolling average Daily Event Count" column is the average count of events ingested each day for the last 7 days NOT including today (yesterday thru previous 6 days). "Variance" is the difference in count of events between today's event count and the 7d rolling Avg.  (Today's event count minus the 7d rolling average event count). "% Variance" is the percentage difference between today's event count and the 7d rolling average (Variance divided by 7d rolling average ). "average Daily Variance" is the absolute value of the 7d rolling average of the % Variance values, not including today (yesterday thru previous 6 days). Example: data source Last event time Event Count 7d rolling average event count Variance % Variance average Daily Variance test 9/3/2021 2957 2060 897 44% 24% test 9/2/2021 1438 2064 -626 -30% 24% test 9/1/2021 2906 2055 851 41% 23% test 8/31/2021 2753 2036 718 35% 22% test 8/30/2021 2131 2036 95 5% 22% test 8/29/2021 2235 2010 225 11% 23% test 8/28/2021 3126 1961 1165 59% 21% test 8/27/2021 2785 1931 854 44% 20% test 8/26/2021 1331 1939 -608 -31% 20% test 8/25/2021 1685 1950 -265 -14% 20% test 8/24/2021 1426 1984 -558 -28% 20% test 8/23/2021 1939 1965 -26 -1% 21% test 8/22/2021 2467 1966 501 25% 20% test 8/21/2021 1482 2010 -528 -26% 20% test 8/20/2021 2026 2016 10 0% 20%   Thanks for your help in advance.

Hi there, I want to be able to allow a dashboard of my app read the hostname stored in inputs.conf, which is provided by user when setting up the app. Specifically, I have a button on one of my app's dashboard which links to the hostname url user enters. However, I'm not sure how the dashboard can read the hostname so that the button can be dynamically populated with different hostname.  Here is how I store the hostname in inputs.conf. Once done setting up, HOST can be filled in properly.      [modinput://input] API_KEY = HOST = interval = 600     Thank you in advance! 

  Hi everyone,  I'm trying to get a simple text from a raw event, but I can't make it works. The event looks like this: and my regex looks like this: | rex field=_raw "Allow\s(?<GroupName>\w.+)\s+Enroll"  my issue is, that I only going to get a few of those groups, but not all... for example I will get the Domain Users but not the Enterprise Users which is in the same raw file... Could please someone help me with this regex?