Hi, In the old XML dashboards we used to have the "x" to close the submit buttons of inputs: Whereas in Dashboard studio there isn't. Does anybody know if the button can be hidden and the dashboard made so that the default inputs are automatically executed, without hitting submit? Thanks a lot!

Hi Splunkers, I use many alerts where the result contains the username. Then a map search looks for this user, in the user list index, checks the group memberships, and will send the alert to the corresponding IT department. (there are many countries and there is a lookup that tells the support email by the user's country group). If the user is not a member of any country-group support email eval to the central one. That is working fine... until the user is in the user's index. If the user cannot be found there, the whole search is not working. Example: index=logons action=failure | stats dc(action) as failures by username | where failures > 20 | map maxsearches=50 search=" search index=users user=\"$username$\" | spath memberOf{}.displayName output=groupName | eval username=\"$usernam$\", failures=\"$failures$\" | lookup support.csv group as groupName output support" | eval support = if(isnull(support) OR support="", "central@example.com", support) | table username, failures, support So if a user failed to log in more than 20 times the alert triggers and sends an email to support - assigned by the group membership, if there is no membership, it will send to central IT. If the user cannot be found in index=users for some reason, the alert will not trigger at all. I would like it if the alert triggers and send to central@example.com (since a not existing user, has no group ...) with the username from the base search included.

Hi all, I need to extract some fields for authentication events from different log types, here below some example: LOG1 : AddSenaoLog%Client-6:LINUX_device(00:00:00:00:00:00/1.1.1.1) joins WLAN(WIFI) from MY-WIFI-0000-INT(00:00:00:00:00:00) LOG2 : AddSenaoLog%Client-6:(00:00:00:00:00:00) joins WLAN(WIFI-CITYLIFE) from MY-WIFI-0000-INT(00:00:00:00:00:00) LOG3 %Client-6:LINUX_device(00:00:00:00:00:00/1.1.1.1) joins WLAN(WIFI-OSPITI) from MY-WIFI-0000-INT(00:00:00:00:00:00) LOG4 %Client-6:(00:00:00:00:00:00) joins WLAN(WIFI-OSPITI) from MY-WIFI-0000-INT(00:00:00:00:00:00) As you can see in some case (LOG2 and LOG4) in the first parenthesis I have only the MAC address, in other cases (LOG1 and LOG3) I have both the IP and the MAC address, so I need to extract this two information (or only the MAC if the IP is missig as for LOG2 and LOG4) when I have "joins" in the logs. Thanks in advance!

Hi Splunkers, Im having problems with the "EXTRACT" functions in props.conf. Im trying to extract the fields from a log that is formatted like this (values are changed for privacy reasons): DateTime: 2022-12-05T08:00:37 InterchangeId: asdf12-asdf12-asdf12-asdf12-asdf12 DocumentId: Sender: foobar Receiver: barfoo MessageType: foo RequesterId: bar Status: Running Filename: file.json DateTime: 2022-12-05T08:00:37 InterchangeId: asdf12-asdf12-asdf12-asdf12-asdf12 DocumentId: Sender: foobar Receiver: barfoo MessageType: foo RequesterId: bar Status: Running Filename: file.json I uploaded this data into Splunk, and i wrote the regexes that extracts the value. This search works perfectly: index=* sourcetype=test-sourcetype | rex "InterchangeId:\s(?<InterchangeId>[^\n\r]+)" | rex "DocumentId:\s(?<DocumentId>[^\n\r]+)" | rex "Sender:\s(?<Sender>[^\n\r]+)" | rex "Receiver:\s(?<Receiver>[^\n\r]+)" | rex "MessageType:\s(?<MessageType>[^\n\r]+)" | rex "Status:\s(?<Status>[^\n\r]+)" | rex "Filename:\s(?<Filename>[^\n\r]+)" | rex "RequesterName:\s(?<RequesterName>[^\n\r]+)" However, when i try to implement this using the "EXTRACT" config in props.conf, it does not work: [test-sourcetype] EXTRACT-InterchangeId = InterchangeId:\s(?<InterchangeId>[^\n\r]+) EXTRACT-DocumentId = DocumentId:\s(?<DocumentId>[^\n\r]+) EXTRACT-Sender = Sender:\s(?<Sender>[^\n\r]+) EXTRACT-Receiver = Receiver:\s(?<Receiver>[^\n\r]+) EXTRACT-MessageType = MessageType:\s(?<MessageType>[^\n\r]+) EXTRACT-Status = Status:\s(?<Status>[^\n\r]+) EXTRACT-Filename = Filename:\s(?<Filename>[^\n\r]+) EXTRACT-RequesterName = RequesterName:\s(?<RequesterName>[^\n\r]+) I have used btool to verify this is picked up on the search head. I can also see this config in the GUI: "Settings" -> "fields" I have tried applying "KV_MODE = none" aswell, without any difference. And yes, this code is deployed to an app on a Search head, since its an search time extraction. I've tried with many different regex'es, to debug if that is the problem, but without any luck. Does anyone have any idea on what im doing wrong here?

Hi, I'm new to Splunk and maybe I didn't follow the instructions right from a post 2 years ago I'm trying to figure out how to reset my login credentials for the Enterprise Admin Console. Can someone possibly give me the correct updated solution? Regards,