Hi @lcguilfoil  You need to use "form.rule_token" in the set token like this: <set token="form.rule_token">$click.value$</set>   Updated:  If you want to append to existing selections then use: <eval token="form.rule_token">mvappend($form.rule_token$,$click.value$)</eval> Here is a full example to demonstrate if it helps <form version="1.1" theme="light"> <label>AnswersTesting</label> <fieldset submitButton="false"> <input type="multiselect" token="rule_token" searchWhenChanged="true"> <label>Rule</label> <choice value="*">All Rules</choice> <default>*</default> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> <search> <query>| tstats count where index=_internal by host</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <prefix>host IN (</prefix> <delimiter>,</delimiter> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> </input> </fieldset> <row> <panel> <table> <search> <query>|tstats count where index=_internal by host</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <drilldown> <eval token="form.rule_token">mvappend($form.rule_token$,$click.value$)</eval> </drilldown> </table> </panel> </row> </form> Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @ssanplunk  This app actually uses the python Requests library under the hood and looking through the curl.py script (where it emulates curl requests via SPL command) it does not reference proxy anywhere, and also doesnt support passing additional flags, therefore unfortunately it is not currently possible to pass the curl proxy option to the command. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @SN1  Are you wanting to get rid of duplicates? e.g. so that only EMEA only appears once for bar-t1001.homag-group? If so I think the following might help | stats values(*) AS * by DeviceName Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @Poojitha  It sounds like your search is running to 11am UTC which I believe is 16:30 IST? (UTC+5.5hr) This is likely because the owner of the search has their timezone set to UTC - Is the search owned by your account, or a service account? Can you confirm that the account has the timezone set correctly to IST? Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @tchamp  Check out my other response first, but you may also be able to achieve this with an INGEST_EVAL == props.conf == [yourSourceType] TRANSFORMS-extractMessage = myExtract == transforms.comf == [myExtract] INGEST_EVAL = _raw:=json_extract(_raw,"message") Visualised as SPL this would be Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will   ... View more

Hi @dtaylor  I think something like the following might work for you? Ive tried to recreate it using some old dns/pihole data I have:   In the screenshot you can see that there were 2 hosts which resolved google.com, and based on the earliest/latest of 60 seconds either side of those events, the 2 hosts also queried mask.icloud.com This is the query I used,  the query is fairly obvious, the "src_ip" field is the client IP in this case.  The return command returns the first <n> (100) src_ip/earliest/latest fields as an OR statement like this: (src_ip="192.168.0.197" earliest="1726212774" latest="1726212894") OR (src_ip="192.168.0.226" earliest="1726213512" latest="1726213632") That is fed into the main query as a subsearch, you then use stats to get a distinct count of src_ip and a count of src_ip by query to match the sources and queries, sort in descending order and your common domains should float to the top! index=pihole [search index=pihole query=google.com | dedup src_ip | eval earliest=_time-60, latest=_time+60 | return 100 src_ip earliest latest] | stats dc(src_ip) as hostCount, values(src_ip) as hosts by query Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @molla  Im glad this helped - this change means that it runs on the SH you are running the search on, rather than on the search peers (indexers) -  if you move from a SH to SHC then the lookup will replicate to the other nodes (quite quickly) so hopefully you wont see this issue! Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @rnayak  Would something like this work for you?  index=_internal [ search index=_internal | dedup source | head 2 | stats list(source) as source | fields source ] In this example it gets 2 sources from _internal and ultimately passes them back in as source="a" OR source="b" Using this approach I think you should get the same output as using an IN clause?  You can also add a format if you wanted to visualise this differently, but I dont think this will make much difference to your search! | format "" "" "AND" "" "OR" "" Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @kallsjon  You could look to add your knowledge base link into the "Short Description" or "Custom Fields" section of the alert action which raises the event in ServiceNow? (See https://splunk.github.io/splunk-add-on-for-servicenow/Usecustomalertactions/#:~:text=not%20be%20reflected.-,Short%20Description,-Data%20Leak%3A%20off) In order to populate the field you'll need the value to be defined in your results, you might find that a lookup CSV to lookup between your service name/ID and output your KB URL would be good for this, and then feed the field with that URL into your alert action. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards ... View more

Hi @BookerRick  Are you able to confirm the sha512 of the 9.4.1 AIX UF File matches the sha512 below? SHA512(splunkforwarder-9.4.1-2f7817798b5d-aix-powerpc.tgz)= be590a8d4704d8f68260a79d8bdda46f3f7b19d2de30991c8a4cc5f8e48d76cad429c2a674fca903bfb8f3df3a8b21786d478e175accefbff2a717a300e61b62%  Also, do you have plenty of space on the device for the file to be extracted? Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @KKuser  For the first, are you wanting to know the number of raw events Splunk searched by Enterprise Security in order to produce your notables? If so, something llike this should work but may need modifying to meet your needs: index=_audit search=* info=completed action=search savedsearch_name=* provenance=scheduler (app=SplunkEnterpriseSecuritySuite OR app=SA-*) | timechart span=1d sum(event_count) as events_scanned sum(result_count) as results_found Regarding your other points, I think it would be best to check out Analytics->Executive Summary dashboard from within Enterprise Security as I think this covers what you are looking for, this dashboard can be cloned and tweaked to your needs.  Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @Nraj87  Check out the following, using makeresults to create a sample event: | makeresults count=1 | fields - _time | eval last_seen="2025-03-13T11:03:38Z" | eval Lastevent=strftime(strptime(last_seen, "%Y-%m-%dT%H:%M:%SZ"), "%d/%m/%Y %I:%M:%S %p") The reason your original command didn't work is because: You need to first parse the input format using strptime Then convert it to your desired format using strftime The strptime function tells Splunk how to read the input date format, similarly to the strftime %Y: Full 4 digit Year with century (2025) %m: Month (03) %d: Day (13) T: Literal 'T' %H: Hour in 24-hour format (11) %M: Minute (03) %S: Second (38) Z: Literal 'Z' for UTC timezone If you want to include AM/PM, keep the %p in the output format. If you don't need it, you can remove it - although you may wish to use %H to return 24hour format instead of %I for 12 hour format. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will   ... View more

Hi @srinidh  I believe cProfile is included in the standard python distribution with Splunk Enterprise as 'profile.py' in /opt/splunk/lib/python3.9 (and python3.7)/profile.py Try importing it using  import profile as cProfile to see if this resolves for you and allows you to use it as you would expect? Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @tchamp  There are a few of limits configurations which may be affecting this, these are in limits.conf The first is [kv]/maxchars - see  https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf#:~:text=time.%0A*%20Default%3A%20200-,maxchars,-%3D%20%3Cinteger%3E%0A*%20When%20non This limits the automatic key/value extraction when searching which by default is 10,240. The other is [rex]/depth_limit - see https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf#:~:text=pattern.%0A*%20Default%3A%20100000-,depth_limit,-%3D%20%3Cinteger%3E%0A*%20Limits%20the however I am not sure if this applies to REGEX in transforms or only the rex SPL command, someone else may be able to confirm. Finally there is [spath]/extraction_cutoff - see https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf#:~:text=extracted.%0A*%20Default%3A%20true-,extraction_cutoff,-%3D%20%3Cinteger%3E%0A*%20For%20%27extract - this setting applies extraction only to the first 5000 characters, but again may only be specific to spath,. Finally, in transforms.conf you have LOOKAHEAD, which defaults to 4096 - see https://docs.splunk.com/Documentation/Splunk/9.4.1/Admin/Transformsconf#:~:text=etc%20as%20above.-,LOOKAHEAD,-%3D%20%3Cinteger%3E%0A*%20NOTE%3A%20This which is the maximum distance from the start of your SOURCE_KEY that REGEX will look to start matching your REGEX. You may need to increase this if your expression does not match anything in the first 4096 characters (by default) - I'd probably start by checking this one! Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will   ... View more

Hi @AJH2000  I assume you havent adjusted the default macros in the app, so they are pointing to the same cloudflare index you mentioned (Which is the default). There looks to be two types of search in the app dashboard - one which looks at the custom "cloudflare" datamodel and the other being adhoc searches against the cloudflare index. The datamodel looks to have sourcetype=cloudflare:json - Can you confirm you have this? Most of the sourcetype props in the app look to be search-time based, but there are some settings which are index-time parsing settings, such as line merging, truncation etc. You mentioned that you're using Splunk Cloud - is the data landing directly on Splunk Cloud or is it going via a HF beforehand? If so, please can you confirm if you have the TA installed on your HF(s) where the data lands? If you could "open in search" one of the failing dashboard searches so that we can see whats going on then this might help further. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

I just came on to suggest an mvindex/split approach as an alternative @yuanliu, but as you say, rex is probably most effective here! Different ways for doing things, ultimately depends on the situation 🙂  Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @vpantangi  Thanks for the reply - hopefully the combination of searches in the thread have helped.  One thing that just sprung to mind which I meant to mention earlier was if you dont have access to the conf files (e.g. on Splunk Cloud) then its worth looking at the "Admins Little Helper" app on Splunkbase. It allows you to run btool commands from the Splunk search box, so you can run  btool savedsearches btool macros for an easily digestible and familiar output! Dont forget to take an export of your KV stores, Threat Intel feed configuration and Assets and Identities mappings! Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @vpantangi  Below is a trimmed down export query that you could use to pull in Savedsearches (Including Correlation searches - which are ultimately saved searches),lookup files, lookup definitions, automatic lookups and macros. This is part of a much bigger search which you can find at https://github.com/paychex/Splunk.Conf19/blob/master/CYA_Export_For_Core_Splunk_Query which was part of a Conf talk in 2019 given by Paychex which you can see the slides for here (https://conf.splunk.com/files/2019/slides/FN1315.pdf) and video of here (https://conf.splunk.com/files/2019/recordings/FN1315.mp4) The the search below might generate quite a bit of data which might be hard to read, but you can strip out particular rest calls and run them individually. | union maxtime=300 timeout=300 [| rest splunk_server="local" "/servicesNS/-/-/saved/searches" | search NOT search="| noop" | eval Type="Saved Searches/Alerts/Reports" | fields - type] [| rest splunk_server="local" "/servicesNS/-/-/data/lookup-table-files" | eval Type="lookup table files" | fields - type] [| rest splunk_server="local" "/servicesNS/-/-/data/transforms/lookups" | eval Type="Lookup Definitions" | fields - type fields_array] [| rest splunk_server="local" "/servicesNS/-/-/data/props/lookups" | eval Type="Automatic lookups" | fields - type value | rex field=title " : [^\-]+-(?<title>[^\e]+)"] [| rest splunk_server="local" "/servicesNS/-/-/admin/macros" | eval Type="Search Macros" | fields - type] | eval updated=round(strptime(updated, "%Y-%m-%dT%H:%M:%S"),0) | fieldformat updated= strftime(updated, "%x %X") | eval _time=now() | foreach title "eai:data" "eai:acl.sharing" "eai:acl.perms.read" "eai:acl.perms.write" search definition stanza value transform tag* filename fields_list collection external_type description *cron* is_scheduled schedule_window action* alert* args errormsg validation earliest_time latest_time header_label order display_location fields eventtypes REGEX link.* search.* display.* [ eval "<<FIELD>>"=if(mvcount('<<FIELD>>')>1, mvjoin('<<FIELD>>', ","), '<<FIELD>>')] | table _time Type title eai:acl.appauthor eai:acl.perms.read eai:acl.perms.write eai:* * Also - I wondered if this is what you were really looking for? Or if you just need a list of those enabled then you might find adding the reduces the noise! | table _time Type title disabled | where disabled!=1   Remember that with ES not all the knowledge objects will be in the "SplunkEnterpriseSecuritySuite" app - infact barely any will be, this is because ES uses a collection of apps (often, but not always starting with SA-) so be careful not to exclude these if you end up scoping particular apps in part of the above, or other, queries! Let us know if you need more info or have a slightly different intended view of the results and I can work through it. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @saichandjawari  Have a look at the example below, I have included the dashboard config further down. I am using the original cluster dropdown value with a query (called myvar) displayed as a table (hidden out of view) and then using $myvar:result.<field>$ where we need to use the value.   { "title": "Answers - testing", "description": "", "inputs": { "input_mwKjgBTB": { "options": { "items": [ { "label": "useast01", "value": "useast01" }, { "label": "uswest01", "value": "uswest01" }, { "label": "usqaf01", "value": "usqaf01" } ], "selectFirstSearchResult": true, "token": "cluster" }, "title": "Cluster", "type": "input.dropdown" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } } }, "visualizations": { "viz_2uQp06o5": { "dataSources": { "primary": "ds_c8AfQapt" }, "type": "splunk.table" }, "viz_JQgp3c9c": { "containerOptions": {}, "dataSources": { "primary": "ds_eGOCKAoM_ds_qBGlESX2" }, "eventHandlers": [ { "options": { "tokens": [ { "key": "name", "token": "method" } ] }, "type": "drilldown.setToken" } ], "options": { "majorValue": "> sparklineValues | lastPoint()", "trendValue": "> sparklineValues | delta(-2)" }, "showLastUpdated": false, "showProgressBar": false, "title": "Cluster", "type": "splunk.singlevalue" }, "viz_bxuHwYLl": { "containerOptions": {}, "dataSources": { "primary": "ds_FKvGrvZ4_ds_qBGlESX2" }, "eventHandlers": [ { "options": { "tokens": [ { "key": "name", "token": "method" } ] }, "type": "drilldown.setToken" } ], "options": { "majorValue": "> sparklineValues | lastPoint()", "trendValue": "> sparklineValues | delta(-2)" }, "showLastUpdated": false, "showProgressBar": false, "title": "Space", "type": "splunk.singlevalue" }, "viz_column_chart": { "containerOptions": {}, "dataSources": { "primary": "ds_qBGlESX2" }, "eventHandlers": [ { "options": { "tokens": [ { "key": "name", "token": "method" } ] }, "type": "drilldown.setToken" } ], "options": { "majorValue": "> sparklineValues | lastPoint()", "trendValue": "> sparklineValues | delta(-2)" }, "showLastUpdated": false, "showProgressBar": false, "title": "Region", "type": "splunk.singlevalue" } }, "dataSources": { "ds_FKvGrvZ4_ds_qBGlESX2": { "name": "get_space", "options": { "enableSmartSources": true, "query": "| makeresults\n| eval space=\"$myvars:result.space$\"" }, "type": "ds.search" }, "ds_c8AfQapt": { "name": "myvars", "options": { "enableSmartSources": true, "query": "| makeresults\n| eval cluster=\"$cluster$\"\n| eval space=CASE(cluster==\"usqaf01\", \"abs-qff\", cluster==\"uswest01\",\"abs-qpp1\",cluster==\"useast01\",\"abs-qpp1\")\n| eval region=CASE(cluster==\"usqaf01\", \"QAF\", cluster==\"uswest01\",\"QAWEST\",cluster==\"useast01\",\"QAEAST\")", "queryParameters": { "earliest": "-24h@h", "latest": "now" } }, "type": "ds.search" }, "ds_eGOCKAoM_ds_qBGlESX2": { "name": "get_cluster", "options": { "enableSmartSources": true, "query": "| makeresults\n| eval cluster=\"$myvars:result.cluster$\"" }, "type": "ds.search" }, "ds_qBGlESX2": { "name": "Search_1", "options": { "enableSmartSources": true, "query": "| makeresults\n| eval region=\"$myvars:result.region$\"" }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_mwKjgBTB" ], "layoutDefinitions": { "layout_1": { "options": { "display": "auto", "height": 960, "width": 1440 }, "structure": [ { "item": "viz_column_chart", "position": { "h": 250, "w": 350, "x": 370, "y": 0 }, "type": "block" }, { "item": "viz_2uQp06o5", "position": { "h": 100, "w": 580, "x": 1480, "y": 70 }, "type": "block" }, { "item": "viz_JQgp3c9c", "position": { "h": 250, "w": 350, "x": 0, "y": 0 }, "type": "block" }, { "item": "viz_bxuHwYLl", "position": { "h": 250, "w": 350, "x": 740, "y": 0 }, "type": "block" } ], "type": "absolute" } }, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } } }   Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @christophenet  No - the Event Timeline Viz does not work with Dashboard Studio. Custom visualisations are less common in Dashboard Studio because it isnt possible to render them in the Dashboard editing window. Hopefully in the future there will be more options to enable custom visualisations in Dashboard Studio and then developers will be able to migrate their legacy XML viz add-ons into Dashboard Studio. Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Hi @Germaine1989  So you say that Splunk is running on this server but the kvstore-status check says Splunk isnt running?? Is Splunk definitely not installed into 2 locations on that server (e.g. onto another drive/partition/location) ? If you run restart Splunk and then run that command, what do you get? cd C:\Program Files\Splunk\bin splunk restart Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more