If you modify the permissions of the lookup and remove read access from that user's role then they will not be able to see it in the list of available lookups. ... View more

What are some things you've already covered? Tstats is important, when to use stats instead of a transaction, "advanced" use of lookups, visualization tips like customizing drilldowns via the UI in later versions. ... View more

Here's an example of what our config events look like in production. {"fileVersion":"1.0","configurationItems":[{"relatedEvents":[],"relationships":[{"resourceId":"eni-xxxxxxxx","resourceType":"AWS::EC2::NetworkInterface","name":"Contains NetworkInterface"},{"resourceId":"sg-xxxxxxxx","resourceType":"AWS::EC2::SecurityGroup","name":"Is associated with SecurityGroup"},{"resourceId":"sg-xxxxxxxx","resourceType":"AWS::EC2::SecurityGroup","name":"Is associated with SecurityGroup"},{"resourceId":"sg-xxxxxxxx","resourceType":"AWS::EC2::SecurityGroup","name":"Is associated with SecurityGroup"},{"resourceId":"sg-xxxxxxxx","resourceType":"AWS::EC2::SecurityGroup","name":"Is associated with SecurityGroup"},{"resourceId":"subnet-xxxxxxxx","resourceType":"AWS::EC2::Subnet","name":"Is contained in Subnet"},{"resourceId":"vol-xxxxxxxx","resourceType":"AWS::EC2::Volume","name":"Is attached to Volume"},{"resourceId":"vol-xxxxxxxx","resourceType":"AWS::EC2::Volume","name":"Is attached to Volume"},{"resourceId":"vpc-xxxxxxxx","resourceType":"AWS::EC2::VPC","name":"Is contained in Vpc"}],"configuration":{"amiLaunchIndex":0,"imageId":"ami-xxxxxxxxxxxx","instanceId":"i-xxxxxxxxxx","instanceType":"r4.large","keyName":"<Value>","launchTime":"2019-01-24T19:21:59.000Z","monitoring":{"state":"enabled"},"placement":{"availabilityZone":"us-east-1resourceValue","groupName":"","tenancy":"default"},"privateDnsName":"ip-xxxxxxxx","privateIpAddress":"xxx.xxx.xxx.xxx","productCodes":[],"publicDnsName":"","state":{"code":16,"name":"running"},"stateTransitionReason":"","subnetId":"subnet-0bea2f017db0fe8b9","vpcId":"vpc-xxxxxxxxxx","architecture":"x86_64","blockDeviceMappings":[{"deviceName":"/dev/sda1","ebs":{"attachTime":"2019-01-24T19:22:00.000Z","deleteOnTermination":true,"status":"attached","volumeId":"vol-xxxxxxxxxxxx"}},{"deviceName":"/dev/sdk","ebs":{"attachTime":"2019-01-24T19:22:00.000Z","deleteOnTermination":true,"status":"attached","volumeId":"vol-xxxxxxxxxxxx"}}],"clientToken":"xxxxxxxx","ebsOptimized":false,"enaSupport":true,"hypervisor":"xen","iamInstanceProfile":{"arn":"arn:arnvalue","id":"AIPAJTUJJMCJC3H2CNWUE"},"instanceLifecycle":"spot","networkInterfaces":[{"attachment":{"attachTime":"2019-01-24T19:21:59.000Z","attachmentId":"eni-xxxxxxxx","deleteOnTermination":true,"deviceIndex":0,"status":"attached"},"description":"","groups":[{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"}],"ipv6Addresses":[],"macAddress":"xxx.xxx.xxx.xxx","networkInterfaceId":"eni-xxxxxxxx","ownerId":"xxxxxxxx","privateDnsName":"ip-xxxxxxxx","privateIpAddress":"xxx.xxx.xxx.xxx","privateIpAddresses":[{"primary":true,"privateDnsName":"ip-xxxxxxxx","privateIpAddress":"xxx.xxx.xxx.xxx"}],"sourceDestCheck":true,"status":"in-use","subnetId":"subnet-0bea2f017db0fe8b9","vpcId":"vpc-xxxxxxxxxx"}],"rootDeviceName":"/dev/sda1","rootDeviceType":"ebs","securityGroups":[{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"}],"sourceDestCheck":true,"spotInstanceRequestId":"sir-xxxxxxx","tags":[{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue:aws:cloudformation:us-east-1resourceValue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"}],"virtualizationType":"hvm","cpuOptions":{"coreCount":1,"threadsPerCore":2}},"supplementaryConfiguration":{},"tags":{"XXXXXXXX":"im0021","aws:autoscaling:groupName":"groupName","aws:cloudformation:stack-name":"SymphonyComputeNodeTier-AMI-xxxxxxxxxxxx","aws:cloudformation:stack-id":"arn:arnvalue","XXXXXXXX":"ubuntu18","XXXXXXXX":"sf","XXXXXXXX":"xxxxxxxx","aws:cloudformation:logical-id":"Group","XXXXXXXX":"internal-poc","kubernetes.io/cluster/LOGICAL_NULL":"owned","XXXXXXXX":"private","Name":"ComputeNode-im0021-test"},"configurationItemVersion":"1.3","configurationItemCaptureTime":"2019-01-24T19:23:33.648Z","configurationStateId":XXXXXXXX"awsAccountId":"XXXXXXXXXXXX","configurationItemStatus":"ResourceDiscovered","resourceType":"AWS::EC2::Instance","resourceId":"i-xxxxxxxx","ARN":"arn:arnvalue","awsRegion":"us-east-1","availabilityZone":"us-east-1resourceValue","configurationStateMd5Hash":"","resourceCreationTime":"2019-01-24T19:21:59.000Z"},{"relatedEvents":[],"relationships":[],"supplementaryConfiguration":{},"tags":{},"configurationItemVersion":"1.3","configurationItemCaptureTime":"2019-01-24T19:53:39.437Z","configurationStateId":XXXXXXXX"awsAccountId":"XXXXXXXXXXXX","configurationItemStatus":"ResourceDeleted","resourceType":"AWS::EC2::Instance","resourceId":"i-xxxxxxxx","ARN":"arn:arnvalue","awsRegion":"us-east-1","configurationStateMd5Hash":""},{"relatedEvents":[],"relationships":[{"resourceId":"eni-xxxxxxxx","resourceType":"AWS::EC2::NetworkInterface","name":"Contains NetworkInterface"},{"resourceId":"sg-xxxxxxxx","resourceType":"AWS::EC2::SecurityGroup","name":"Is associated with SecurityGroup"},{"resourceId":"sg-xxxxxxxx","resourceType":"AWS::EC2::SecurityGroup","name":"Is associated with SecurityGroup"},{"resourceId":"sg-xxxxxxxx","resourceType":"AWS::EC2::SecurityGroup","name":"Is associated with SecurityGroup"},{"resourceId":"sg-xxxxxxxx","resourceType":"AWS::EC2::SecurityGroup","name":"Is associated with SecurityGroup"},{"resourceId":"subnet-xxxxxxxx","resourceType":"AWS::EC2::Subnet","name":"Is contained in Subnet"},{"resourceId":"vol-xxxxxxxx","resourceType":"AWS::EC2::Volume","name":"Is attached to Volume"},{"resourceId":"vol-xxxxxxxx","resourceType":"AWS::EC2::Volume","name":"Is attached to Volume"},{"resourceId":"vpc-xxxxxxxx","resourceType":"AWS::EC2::VPC","name":"Is contained in Vpc"}],"configuration":{"amiLaunchIndex":0,"imageId":"ami-xxxxxxxxxxxx","instanceId":"i-xxxxxxxxxx","instanceType":"r4.large","keyName":"<Value>","launchTime":"2019-01-24T20:02:38.000Z","monitoring":{"state":"enabled"},"placement":{"availabilityZone":"us-east-1resourceValue","groupName":"","tenancy":"default"},"privateDnsName":"ip-xxxxxxxx","privateIpAddress":"xxx.xxx.xxx.xxx","productCodes":[],"publicDnsName":"","state":{"code":16,"name":"running"},"stateTransitionReason":"","subnetId":"subnet-0ced7ba8f9f4be8ab","vpcId":"vpc-xxxxxxxxxx","architecture":"x86_64","blockDeviceMappings":[{"deviceName":"/dev/sda1","ebs":{"attachTime":"2019-01-24T20:02:39.000Z","deleteOnTermination":true,"status":"attached","volumeId":"vol-xxxxxxxxxxxx"}},{"deviceName":"/dev/sdk","ebs":{"attachTime":"2019-01-24T20:02:39.000Z","deleteOnTermination":true,"status":"attached","volumeId":"vol-xxxxxxxxxxxx"}}],"clientToken":"xxxxxxxx","ebsOptimized":false,"enaSupport":true,"hypervisor":"xen","iamInstanceProfile":{"arn":"arn:arnvalue","id":"XXXXXXXXXXXX"},"instanceLifecycle":"spot","networkInterfaces":[{"attachment":{"attachTime":"2019-01-24T20:02:38.000Z","attachmentId":"eni-xxxxxxxx","deleteOnTermination":true,"deviceIndex":0,"status":"attached"},"description":"","groups":[{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"}],"ipv6Addresses":[],"macAddress":"xxx.xxx.xxx.xxx","networkInterfaceId":"eni-xxxxxxxx","ownerId":"xxxxxxxx","privateDnsName":"ip-xxxxxxxx","privateIpAddress":"xxx.xxx.xxx.xxx","privateIpAddresses":[{"primary":true,"privateDnsName":"ip-xxxxxxxx","privateIpAddress":"xxx.xxx.xxx.xxx"}],"sourceDestCheck":true,"status":"in-use","subnetId":"subnet-0ced7ba8f9f4be8ab","vpcId":"vpc-xxxxxxxxxx"}],"rootDeviceName":"/dev/sda1","rootDeviceType":"ebs","securityGroups":[{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"},{"groupName":"groupName","groupId":"sg-xxxxxxxxxxxxxxxxx"}],"sourceDestCheck":true,"spotInstanceRequestId":"sir-254i5fpg","tags":[{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue:aws:cloudformation:us-east-1resourceValue"},{"key":"<keyvalue>","value":"privateresourcevalue"},{"key":"<keyvalue>","value":"privateresourcevalue"}],"virtualizationType":"hvm","cpuOptions":{"coreCount":1,"threadsPerCore":2}},"supplementaryConfiguration":{},"tags":{"XXXXXXXX":"im0021","aws:autoscaling:groupName":"groupName","aws:cloudformation:stack-name":"XXXXXXXX-AMI-xxxxxxxxxxxx","aws:cloudformation:stack-id":"arn:arnvalue","XXXXXXXX":"sf","XXXXXXXX":"ubuntu18","XXXXXXXX":"xxxxxxxx","XXXXXXXX":"internal-poc","aws:cloudformation:logical-id":"Group","XXXXXXXX":"private","kubernetes.io/cluster/LOGICAL_NULL":"owned","Name":"ComputeNode-im0021-test"},"configurationItemVersion":"1.3","configurationItemCaptureTime":"2019-01-24T20:04:10.190Z","configurationStateId":XXXXXXXX"awsAccountId":"XXXXXXXXXXXX","configurationItemStatus":"ResourceDiscovered","resourceType":"AWS::EC2::Instance","resourceId":"i-xxxxxxxx","ARN":"arn:arnvalue","awsRegion":"us-east-1","availabilityZone":"us-east-1resourceValue","configurationStateMd5Hash"...truncated due to input box limit} ... View more

Here's an example of what an aws:config event looks like in my lab: {"awsRegion": "us-east-1", "relatedEvents": [], "tags": {}, "resourceType": "AWS::EC2::NetworkInterface", "relationships": [{"resourceId": "i-xxxxxxxxxxx", "resourceType": "AWS::EC2::Instance", "name": "Is attached to Instance"}, {"resourceId": "sg-xxxxxxxxxxxx", "resourceType": "AWS::EC2::SecurityGroup", "name": "Is associated with SecurityGroup"}, {"resourceId": "subnet-xxxxx", "resourceType": "AWS::EC2::Subnet", "name": "Is contained in Subnet"}, {"resourceId": "vpc-xxxxxx", "resourceType": "AWS::EC2::VPC", "name": "Is contained in Vpc"}], "configurationItemVersion": "1.3", "configurationItemStatus": "OK", "configuration": {"sourceDestCheck": true, "subnetId": "subnet-xxxxxx", "availabilityZone": "us-east-1d", "status": "in-use", "attachment": {"instanceId": "i-xxxxxx", "status": "attached", "attachTime": "2019-01-11T02:47:21.000Z", "instanceOwnerId": "812653813035", "attachmentId": "eni-attach-xxxxxxxxx", "deleteOnTermination": true, "deviceIndex": 0}, "networkInterfaceId": "eni-xxxxxxx", "privateDnsName": "ip-172-xx-xx-xx.ec2.internal", "interfaceType": "interface", "requesterManaged": false, "description": "", "macAddress": "12:ee:c2:e2:dd:0c", "ipv6Addresses": [], "vpcId": "vpc-xxxxxx", "privateIpAddress": "172.xx.xx.xx", "ownerId": "XXXXXXXXXXXX", "privateIpAddresses": [{"privateIpAddress": "172.xx.xx.xx", "primary": true, "privateDnsName": "ip-172-xx-xx-xx.ec2.internal"}], "groups": [{"groupId": "sg-xxxxxxxxxxxxxxxxx", "groupName": "launch-wizard-2"}], "tagSet": []}, "supplementaryConfiguration": {}, "configurationItemCaptureTime": "2019-01-14T16:23:04.206Z", "ARN": "arn:aws:ec2:us-east-1:xxxxxxxxxxxx:network-interface/eni-xxxxxxxxxxxxxxxx", "resourceId": "eni-xxxxxxxxxxxxxxx", "configurationStateId": 1547482984206, "configurationStateMd5Hash": "", "availabilityZone": "us-east-1d", "awsAccountId": "XXXXXXXXXXXX"} These topology searches have no issue digesting this and anything I see in config I can see in my topology dashboard. ... View more

We see some global assets like IAM details for our account and it's group and policy and our load balancers. So that gives you an idea that it is somewhat functional. The app is unable to parse out our VPCs, that dropdown returns no results. ... View more

I appreciate the comment. I've configured the app successfully in my own AWS environment and yes I've enabled the searches in my production environment to make the dashboard work. The issue I'm facing is that the searches populating the snapshot indexes do not work with the config data we're receiving. I've definitely opened a support case but figured I'd try my luck here while support ... does their thing. ... View more

Does your datamodel tstats search work without groupby ? ... View more

I think this answer will solve your issue: https://answers.splunk.com/answers/129148/simple-xml-drilldown-to-new-window.html ... View more

You can use 'addcoltotals' to display a total for your megabyte column. Add this to the end of your search | addcoltotals labelfield=dest_ip label= "total(megabyte)" megabyte It won't display like you're showing with a merged cell though. ... View more

It looks like your events are many lines. Is that true in the source file? You may need a custom LINE_BREAKER if these are multi-line events. ... View more

Can you give an example of what is different when you ingest this file with a UF? Are the fields not being parsed properly? ... View more

I'm not sure why this hasn't been accepted as the answer. It does appear that mvexpand negates any results where the value of the target field is null. I read your answer before looking at your query and ended up replacing my ... | eval filed=if(isnull(field), ... with the coalesce you used. Much appreciated. ... View more

Can you include the code for your dropdown as it currently is? If this list is being populated dynamically the solution will be different than if you're supplying a static list of options. ... View more

Are you using an admin account? I saw the option(s) to set up the app when logged in as an admin but not when logged in as a 'user' role. When I installed the app I was presented with a screen asking me to set up the app I also see the "Set Up" link in 'manage apss' ... View more

The IP address appears in the raw event but is it being parsed out into a field? In your search you're making a table with these fields | table source host host_ip If you're not seing any values in host_ip perhaps the field has a different name. ... View more

You can do this by adding a <change> element to your time input. Here is an example of this where the token I'm unsetting is called "tok" <fieldset submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> <change> <unset token="var"></unset> </change> </input> </fieldset> ... View more

Splunk can ingest the logs from these tools provided there is a way for you to access them. If the application stores its logs in a database you might need an app like DBConnect, syslog feeds are easily ingested by Splunk, and you can create your own modular input to interface with the application's API if that is needed to retrieve logs. It doesn't look like there is an app specifically for Blue Prism on http://www.splunkbase.splunk.com Have a look at these links: http://docs.splunk.com/Documentation/Splunk/7.1.0/Data/Getstartedwithgettingdatain http://dev.splunk.com/view/dev-guide/SP-CAAAE3A ... View more

Is "a.b.c.d" a field and "a.b" another field? In the second search you are saying search for a field, "a", with the value "xyz" and then you're counting by that value, "xyz" again. I think your example isn't reflecting what you're actually doing. ... View more

What have you done so far? ... View more

Have a look at this app's tags.conf. Check out the tag combinations listed for each eventtype and compare to what is required for each CIM data model. It looks like this app tags events to match the following data models: Authentication, Network Traffic, Web, Data Loss Prevention, Intrusion Detection, Malware, Network Session, Network Resolution, and Performance. Before rebuilding every data model you might want to check the logs you're getting to see if every eventtype is being sent to Splunk and that the logs are being parsed/tagged properly. This app is tagging by eventtype. `[eventtype=Zscaler_DNS] dns = enabled network = enabled resolution = enabled [eventtype=Zscaler_CFW] communicate = enabled network = enabled [eventtype=Zscaler_Proxy_General] communicate = enabled end = enabled network = enabled performance = enabled proxy = enabled session = enabled start = enabled web = enabled [eventtype=Zscaler_Proxy_Malware] attack = enabled ids = enabled malware = enabled [eventtype=Zscaler_Proxy_DLP] dlp = enabled incident = enabled [eventtype=Zscaler_ZPA] authentication = enabled communicate = enabled end = enabled network = enabled performance = enabled session = enabled start = enabled vpn = enabled` The tags required for each data model are listed here http://docs.splunk.com/Documentation/CIM/4.11.0/User/Howtousethesereferencetables ... View more

Can you post the XML code for your dropdown input? ... View more