Yes, it does support dynamic values.  The content of $click.value2$ is dynamic. ... View more

The drilldown URL is created by the dashboard. All token substitutions happen at that time, not in the target search query.  The target query has no idea what "$click.value$" is. <drilldown> <link target="_blank">https://example.com?foo=$click.value$</link> </drilldown> See https://docs.splunk.com/Documentation/Splunk/9.0.4/Viz/DrilldownLinkToURL for more information. ... View more

The evals use the Error field, but have you confirmed the field exists?  Please show the SPL prior to the eval. ... View more

That query looks right.  Can you share some sample events so we can verify the SPL is correct for the data? ... View more

Can you please share example (sanitized) events, both success and failure?  It may help us to see the full query, also. ... View more

Splunk process events sequentially, one at a time.  There is no such thing as a "next row" or "previous row". What problem are you trying to solve?  Perhaps there is another way. ... View more

Perhaps this will help. <<your current search for events>> | eventstats latest(check_date) as max_check_date by src_name | where check_date=max_check_date | fields - max_check_date ... View more

Where did you put the settings (which instance, which file path)?  Have you used btool to verify the settings are in effect? ... View more

It all comes down to reducing the amount of data stored.  Ingest less data and/or allow indexed data to expire sooner.   ... View more

Edit the dashboard and click on the edit icon for the dropdown.  Put the query into the search box in the Dynamic Options section.   ... View more

The audittrail sourcetype is like any other.  Its settings can be overridden by another app - subject to precedence. Please describe the problem you are trying to solve. ... View more

The SingleValue visualization displays one value.  If the results are from the timechart command then the SV also can show a sparkline of previous values and the difference between the current value and the previous one.  There is no provision for displaying 2 values. ... View more

We don't have enough data to solve the problem.  While we have a time of day of each calculation, we do not have the duration of each calculation.  If we have start and end timestamps then we can determine the duration. | eval radius = sqrt(pow(x,2)+pow(y,2)) |where radius > 0.8 |stats sum(duration) as total_time by Machineid |sort 0 total_time ... View more

When you created the template did you run splunk clone-prep-clear-config first?  That command removes the unique identifiers for the UF so it can be replicated to multiple target systems.  See https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Integrateauniversalforwarderontoasystemimage ... View more

How does that query work for you? The OP mentioned "probe" and "device" and said there could be more than one probe ID for each device.  The example results table shows "Machineid" and "probeid" columns.  So, again I ask: What uniquely identifies a device? The _time field in Splunk is in Linux epoch form - the number of seconds that have elapsed since 1 Jan 1970.  Adding up _time for several devices will produce a total_time value in the hundreds of years, which is unlikely to be correct or even helpful. ... View more

Static values are pre-defined and cannot use search results.  It's the dynamic dropdowns that use searches. ... View more

What have you tried so far and how did those results not meet expectations? What is the unique identifier of a device? ... View more

Go to Settings->Source types and select your sourcetype.  Click on the Advanced tab and you'll see the props.conf settings for that sourcetype. To see them using REST, try this  | rest /services/configs/conf-props | search eai:acl.app=<<your app>> ... View more

DBX uses a system-level Java installation.  You can find it at Configuration->Settings in DB Connect. ... View more

Specify the name of the count field in the stats commands. ...| append [search index="pd" "successful" "notif/output/" | stats count as DtransferCount by _raw |fields DtransferCount | rename _raw as Dtransfer] | append [search index="pd" "SBID=nr" "DM" "PAM=sende" "notif/archive/" | stats count as DDMCopyCount by _raw |fields DDMCopyCount | rename _raw as DMCopy]   ... View more

Splunk Cloud users do not have file system access, but they still have access to config files through the apps they install.  They also can use REST calls and the GUI to examine many settings. Yes, "TA" and "add-on" mean the same thing.  A TA is a Technical Add-on and is a term used to describe an app that help onboard data, typically by extracting fields. I'm not even going to try to read those tiny screenshots.  If the tstats command can find fields then they must be extracted.  Try searching in Verbose Mode to see if they show up in your other searches. ... View more

If you still aren't getting fields extracted from your data then either you have the wrong TA or you need an additional TA.  You may need to create your own TA if one does not exist in splunkbase. Have you confirmed the sourcetype in your inputs.conf file matches the sourcetype in props.conf (in a TA or created by you) and also matches the sourcetype expected by the apps you are using? ... View more