Hi @diwaly2019, Create app setup page (setup.xml in /default) that accepts user credentials and update python script to read credentials: setup.xml <setup> <block title="Add new credentials" endpoint="storage/passwords" entity="_new"> <input field="name"> <label>Username</label> <type>text</type> </input> <input field="password"> <label>Password</label> <type>password</type> </input> </block> </setup> Python code: import json import splunk.entity as entity if __name__ == "__main__": app = "<app_name>where_credentials_stored" try: settings = json.loads(sys.stdin.read()) config = settings['configuration'] entities = entity.getEntities(['admin', 'passwords'], namespace=app, owner='nobody', sessionKey=settings['session_key']) i, c = entities.items()[0] user, password = c['username'], c['clear_password'] except Exception as e: print >> sys.stderr, "ERROR Unexpected error: %s" % e sys.exit(1) Credentials are stored in passwords.conf in your app. ... View more

You can use one condition element for both the conditions. For second condition use eval element like this. <drilldown> <condition field="field1"> <set token="clicked_field">field1</set> <eval token="temp">if(match("value1", $row.field1$), "v1 v2", "")</eval> </condition> </drilldown> ... View more

I am using below attributes under [settings] stanza in web.conf in an app and it works fine. [settings] # Disable Splunk automatic checking for new app versions updateCheckerBaseURL = 0 You may need to provide read permissions to the app in metadata. Create a metadata directory in your app and create default.meta in it with below content. [] access = read : [ * ], write : [ admin ] export = system ... View more

From Splunk documentation: | sendalert [param.=<"value">] param. Syntax: param. =<"value"> Description: The parameter name and value. You can use this name and value pair to specify a variety of things, such as a threshold value, a team name, or the text of a message. So value should be some number or string or text not a result token. If you want to get alert result in python script then you can read results_file from stdin as below: import sys import csv import json import gzip if __name__ == "__main__": try: settings = json.loads(sys.stdin.read()) config = settings['configuration'] results_file=settings['results_file'] with gzip.open(results_file.rstrip('\r\n'), 'rb') as rfile: reader = csv.DictReader(rfile, lineterminator="\n") for row in reader: print({k: v for k, v in row.items() if not k.startswith("__mv_")}) except Exception as e: print >> sys.stderr, "ERROR Unexpected error: %s" % e sys.exit(1) ... View more

Add delimiter in the input and remove double quotes around the token in search query. ... <fieldForLabel>grade_name</fieldForLabel> <fieldForValue>grade_name</fieldForValue> <delimiter>,</delimiter> Search query: |inputlookup prod_students.csv | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id| where grade_name IN ($grade_name$) And if grade_name is part of prod_students.csv, then query will be(which is much faster): | inputlookup prod_students.csv where grade_name IN ($grade_name$) | table school_name, school_id,grade_name |eventstats max(grade_name) as mx min(grade_name) as mn by school_name,school_id ... View more