Hey @spamarea1, So, where do you see 0 events? On the sourcetype-extraction page of the Add-on Builder? Can you please share a screenshot of it? I assume it is because of the nature of the data flow set up. Your Add-on Builder would be present on one of the Enterprise Servers and the data would be ingested into different server on which Indexer is residing. So, whenever the input runs, it collects the data and sends it to the indexer server. If the indexing happens locally, you would be able to see the events on the Add-on Builder page. Let me know if what I'm understanding is incorrect and screenshot would be better to troubleshoot further. Thanks, Tejas. --- If the above solution helps, an upvote is appreciated..!!  ... View more

Hello @spamarea1, Did you run the test button before saving? If the output shows blank white screen, it'll not ingest any data. Also, try to add more loggers to isolate the problem. Also, for once, add a info log of the response.txt itself. So that you can understand what the output should look like.  Thanks, Tejas.  ... View more

Hello @spamarea1, Would you be able to share the python code to check further why it is not ingesting events? And can you also confirm if ew.write_event(event) has been set properly? Did you also check on the Add-on Builder UI if it is ingesting events when you run the Test button? Thanks, Tejas.  ... View more

Hello @sl, You can alternatively use this wonderful tool developed by Ryan Adler - https://github.com/ryanadler/downloadSplunk I found this one one of the previous answers on Community. Running the bash script will help you download whatever version you wish if Splunk Support doesn't help you better.   Thanks, Tejas. --- If the above solution helps, an upvote is appreciated..!!  ... View more

Hello @EdgarF, The link you have shared ends up in 404. I assume that's because Splunk might have intended to release it earlier, but it seems to have been pushed back. Currently, there's no option such as custom button. However, you can work with icons as custom buttons and use drilldown links for interaction if it satisfies your use case. Thanks, Tejas.  ... View more

Hey @moriteza, I've seen this happen generally when there's a large deployment and the DS is unable to handle the load. I've come across one of the apps that we have developed which is quite fast and easy to manage the deployment clients - https://splunkbase.splunk.com/app/7731. Please give it a try and let us know the feedback. Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated..!!  ... View more

Hello @Nawab, You might want to raise this as a new feature on ideas.splunk.com  Thanks, Tejas.  ... View more

Hey @AsmaF2025, Try using another name for the time token instead of global_time. And use the new name as a token to be passed to the other dashboard. I believe there's a conflict since both of the dashboards have global_time present as a token already. Let us know if it works or not and we can troubleshoot further. Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated.  ... View more

Hey @Rani2, I haven't tested it myself. But can you not combine two conditions using AND? Thanks, Tejas.  ... View more

Hey @lar06, I went through the documentation and it seems that the input is not properly configured and it needs the key to authenticate the request and fetch the data. You need to check on your envrironment if the input is enabled or disabled. From the looks of it, the input should be enabled. If you want to disregard the logs, consider disabling the input. If it needs to be enabled for data ingestion, I suggest reviewing the document and configure all the parameters properly. Document Guide - https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=gso1581445176035&topicId=hvj1633980712678.html&_LANG=enus   Thanks, Tejas.    --- If the above solution helps, an upvote is appreciated..!! ... View more

In addition to @kiran_panchavat, all the components support backward communication to n-3 Splunk versions in decreasing order of significance in architecture components. First tier is Management nodes like cluster manager, search head cluster deployer. Next would be components like Search Head, Indexer, and then comes the forwarders.  ... View more

@captaincool07, it would still be the same situation for the datamodel summaries also. Considering your RBAC situation, I would not use datamodel summaries if you want to restrict the access for indexes. You'll add a hell lot of workload on your systems for accelerating the summaries and keeping them intact.  If you want to just use tstats for faster query, it would be better to use index time field extractions for the new ingestion.  Thanks, Tejas. ... View more

Also, you can use concepts like base search and chained search to restrict the number of searches so that less number of searches will consume the resources. And try to optimize the search to get faster results. ... View more

Hey @meng, You can also check the latest status of your search head cluster using REST endpoint as mentioned here - https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/9.4/cluster-endpoints/cluster-endpoint-descriptions#get-38 It'll always fetch the latest information for your cluster. And as for getting inaccurate information from metadata, as @gcusello mentioned, open up a support case with Splunk. Thanks, Tejas.   ... View more

Hey @Karthikeya, What @ITWhisperer mentioned is correct. I have currently modified that source code of the dashboard to open the same search in a new tab based on the clicked selection. Paste the following code in your dashboard and it should work as per your requirement.  <form version="1.1" theme="light"> <label>Akamai WAF Dashboard</label> <search id="base_search"> <query>index="waf_app_*" sourcetype=akamai_waf |fields * |search attackData.configId=$configid$ source=$source$ </query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <description></description> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="configid" searchWhenChanged="true"> <label>Security Configuration ID</label> <choice value="*">All</choice> <fieldForLabel>attackData.configId</fieldForLabel> <fieldForValue>attackData.configId</fieldForValue> <search> <query>index="waf_app_*" sourcetype=akamai_waf source=$source$ | stats count by attackData.configId</query> <earliest>-5m</earliest> <latest>now</latest> </search> <default>*</default> <initialValue>*</initialValue> </input> <input type="dropdown" token="source" searchWhenChanged="true"> <label>Service Name</label> <choice value="*">All</choice> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search> <query>index="waf_app_*" sourcetype=akamai_waf attackData.configId=$configid$ |stats count by source</query> <earliest>-5m@m</earliest> <latest>now</latest> </search> <default>*</default> <initialValue>*</initialValue> </input> <input type="time" token="time"> <label>Select Time Range</label> <default> <earliest>-5m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Top 10 Attack Rule IDs</title> <chart> <search base="base_search"> <query> | top limit=10 attackData.rules{}.id | rename attackData.rules{}.id as "Rule ID"</query> </search> <option name="charting.chart">bar</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>Top 10 Attack Rule Tags</title> <chart> <search base="base_search"> <query> |stats count by attackData.rules{}.tag |sort - count |head 10</query> </search> <option name="charting.chart">pie</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <title>Rule Messages</title> <table> <search base="base_search"> <query>| stats count by attackData.rules{}.message |sort - count |head 10</query> </search> <option name="dataOverlayMode">heatmap</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> </table> </panel> <panel> <title>Rule Action by Count</title> <chart> <search base="base_search"> <query> | stats count by attackData.rules{}.action |sort - count</query> </search> <option name="charting.chart">column</option> <option name="charting.chart.showDataLabels">minmax</option> <option name="charting.chart.sliceCollapsingThreshold">0.05</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> <drilldown> <set token="clicked_value">$click.value2$</set> <link target="_blank">search?q=index%3D%22waf_app_*%22%20sourcetype%3Dakamai_waf%20%7Cfields%20*%20|search%20attackData.configId%3D$configid$%20source%3D$source$%20%7C%20stats%20count%20by%20attackData.rules%7B%7D.action%20|sort%20-%20count%0A%7C%20search%20attackData.rules%7B%7D.action%3D%22$clicked_value$%22&amp;earliest=$time.earliest$&amp;latest=$time.latest$</link> </drilldown> </chart> </panel> </row> <row> <panel> <title>Rule IDs Trend (5 min)</title> <chart> <search base="base_search"> <query> | timechart count(attackData.rules{}.id) span=5min</query> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <title>Status Code Trend</title> <chart> <search base="base_search"> <query> | stats count by httpMessage.status</query> </search> <option name="charting.chart">pie</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>Top 10 IP Addresses</title> <chart> <search base="base_search"> <query> | stats count by attackData.clientIP |sort - count |head 10</query> </search> <option name="charting.chart">bar</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <title>Top 10 HTTP Path Details</title> <chart> <search base="base_search"> <query> | stats count by httpMessage.path |sort - count |head 10</query> </search> <option name="charting.chart">bar</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>HTTP Method Count</title> <chart> <search base="base_search"> <query> | stats count by httpMessage.method |sort - count </query> </search> <option name="charting.chart">column</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> </chart> </panel> </row> </form>   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated..!! ... View more

Hey @Karthikeya, The other data is coming because of improper drilldown configuration. Can you share the dashboard source code here? Make sure to share it in code block for better visibility.  Thanks, Tejas.  ... View more

Hello @Karthikeya, Can you share a screenshot of how the dashboard looks right now and how it should look ideally? I believe you can use spath command to separate out each rules from the attackData and use mvexpand. But to provide more context, I'll need some more information. Thanks, Tejas.  ... View more

Hello @mwmw, I can see on Splunkbase that the JAMF Pro add-on for Splunk is now cloud compatible. The latest version was released on June only. Thanks, Tejas.  ... View more

Hey @lgsh, Was this solved? If not, following is the reason for the behavior you are facing. geo_countries lookup does not have any field named latitude or longitude if you are using the built-in lookup. Following are the fields in the lookup table:   You'll need to extract the latitude and longitude fields from the geom field and use mvexpand to list record for all the coordinates for the same country as a separate event. You'll then be able to match the latitude and longitude fields from the events with those of the lookup and populate the Country. Hope this helps with your use case. Thanks, Tejas.   --- If the solution helps, an upvote is appreciated..!! ... View more

Hey @Samiul59, I believe you are looking at the wrong place once the workflow action is set up. You should be able to see your workflow action label as per the following screenshot:   You may also want to review the permission and scope of the app where you are trying to search the action and where it has been defined. Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated..!!   ... View more

Hello @Satyams14, If you plan to stream WAF logs to Eventhubs and wish to use Splunk Supported Add-on, you can also consider using Splunk Add-on for Microsoft Cloudservices (#3110 - https://splunkbase.splunk.com/app/3110). It is a supported add-on and can fetch logs directly from the eventhub. Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated..!!  ... View more

Hey @vnetrebko, One of the approach that I can think of considering your scenario is to use REST endpoints to fetch the information. You can run a search that would do an inputlookup to both the lookup tables and then export the search job result and access the data. Also, whenever a search is run from the search head that references the lookup table, the lookup is migrated to the search peers (indexers) as part of the search bundle. All the information for running the search via REST API and getting the output exports are documented here - https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-tutorials/9.4/rest-api-tutorials/creating-searches-using-the-rest-api Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated..!! ... View more

Hello @Namo, There can be multiple reasons for KVStore failure. What version of Splunk did you upgrade from? Also, did you check the expiry of the certificate used by kvstore? Setting enabledSplunkdSSL to false will disconnect secure communication internally throughout the Splunk deployment wherever management port is being used.  Thanks, Tejas.  ... View more

Hello @Jasmine, Is this resolved? ... View more

Hey @rishabhpatel20, I believe it is the html and css styling that's blocking your headers. If there's no particular need to add CSS, I would suggest you to remove it since you'll be able to add all those 4 panels in the same row by just drag and drop using the double ellipses line at the top of your panel. Thanks, Tejas. ... View more