Hi, A Search defined directly on the dashboard will use the quota of the user who opens the dashboard. If you use reports you are able to change the behavior of the search. You have the option to chose between "run as owner" or "run as user". You can find the option in the permission dialogue of the report. If you chose the first option, i think the quota of the owner should be used. Here is a answer which should verify this behavior: https://answers.splunk.com/answers/690906/question-about-run-as-owner-for-saved-searches.html Greetings, Tom ... View more

Hi, append this to your search: ... | where count > 350 to somthing like this: index=blah sourcetype=blah "logged in" | stats count by location | where count > 350 Greetings Tom ... View more

Hi, you simply put some extra " signs in your regex around the { that you do not need. Try this: | rex "\"firstName\":{\"value\":\"(?<idaFName>[^\"]+)" ... View more

According to the documentation, there is a link.visible option property for those links. Take a look here: http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML and search for "link.visible". In your case you need to add a option in simple xml for your chart like this: <option name="link.visible">false</option> Greetings Tom ... View more

Hi, you simply can do this with the rex command. You can restrict the rex command to one field with the field parameter. Here an example for the first name: ... | rex field="detail.cid-repsonse" "\"firstName\":\"(?<firstName>[^\"]+)" | ... I created a user everywhere example, which means, you can copy the follwoing search and paste it to your splunk search line and it will work. This can give you an idea how things work: | stats count | eval "detail.cid-repsonse"="[{\"name\":{\"current\":{\"firstName\":\"JOHN\",\"lastName\":\"SMITH\"}},\"ids\":{\"sut\":\"1234567890\",\"nino\":\"AA111111A\"},\"dateOfBirth\":\"26121973\"}]" | rex field="detail.cid-repsonse" "\"firstName\":\"(?<firstName>[^\"]+)" | rex field="detail.cid-repsonse" "\"lastName\":\"(?<lastName>[^\"]+)" | rex field="detail.cid-repsonse" "\"sut\":\"(?<sut>[^\"]+)" | table "detail.cid-repsonse" firstName lastName sut By the way, it looks like you have valid json in your field, so you might also be able to use the spath command: http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Spath In your case just append this to your search: | spath input="detail.cid-repsonse" and you will get new fields with your needed data. Greetings Tom ... View more

Hi, the simplest way to achieve this, should be the transaction command. I indexed your sample data in my main index and used a simple regex to get the username as a field. This is the resulting search: index=main sourcetype="answer300915" | rex "(?<username>[0-9]{8})" | transaction username startswith="SMS sent to" endswith="logged in with username" The transaction command automatically creates a field called duration, wich is the duration between the first and last event of a transaction. In your case, this is the field you want, and for me it also shows the correct 144 and 50 seconds. Of course you need to adjust the regex for the username, because this one i used is not restrictive enough, but i dont know exactly how your usernames can look like. Usually a solution that uses stats is faster than the transaction command, therefore you could also use something like this: index=main sourcetype="answer300915" "logged in with username" OR "SMS sent to" | rex "(?<username>[0-9]{8})" | stats earliest(_time) as first latest(_time) as last by username | eval duration = last - first But there is a problem in your sample data: The username "45550203" got one "SMS sent" event and two "logged in" events. Which one do you want to use? You need to decide this and then adjust the search to recognize the right event as the "closing" event. For example by using dedup or similar commands to filter out later "logged in" events. Greetings Tom ... View more