Help us to help you.  What is the error?  What version of UF?  What platform are you installing it on?  What installation method are you using? ... View more

Try filtered__results.json$ ... View more

Have you made the suggested code changes?  Once you do that the app should pass the readiness check. ... View more

Once onboarded from the database, "New", "Closed" and "In progress" will be stored in the field ("variable") called 'Status'. ... View more

The inline table and the attached CSV will contain the same results - those produced by the report.  Go to https://ideas.splunk.com to make a case for alternatives. ... View more

The values function returns unique values of a field in alphabetical order.  You can't change that. Try the list function, instead, which return all values in the order they were found.  Only 100 values are returned, however. ... View more

The only place you'll find Splunk-supported apps is splunkbase.  If you're unwilling to use a third-party app then your only option is to create your own. ... View more

It's hard to know what the best way to integrate a product is without knowing what the product itself is.  Check splunkbase to see if there's an existing app/add-on to help integrate.  Perhaps you can use the REST API Modular Input (https://splunkbase.splunk.com/app/1546).  In the worst case, you may need to write your own modular input (it's not that difficult). ... View more

I am NOT suggesting replacing KPIs with searches. Every KPI is powered by a search.  It's possible that those searches could be made more efficient (faster), therefore making the GT load faster. ... View more

The search schedule cannot be less than 1 minute. If it takes 3 minutes to render the Glass Table then perhaps the searches in the GT could be made more efficient. ... View more

Looking up times is not straightforward.  For the most part, lookups do exact string matches (except for wildcard and CIDR matching, if defined).  Timestamps are even trickier since Splunk can't do much with them in string format.  That means something like | inputlookup mylookup.csv where Last_Scan_Datetime > someValue won't work.  You'd have to convert the timestamp to epoch form and then compare it. | inputlookup mylookup.csv | eval epoch = strptime(Last_Scan_Datetime, "%Y-%m-%d-%H:%M:%S") | where epoch > relative_time(now(), "-3d") This assumes your use case works with the inputlookup command.  I know of no similar solution using lookup. ... View more

Have you run the multisearch query from the GUI to verify it works? ... View more

If the field name in the subsearch doesn't match that in the index then the return command can be used to create an alias.  See my modified answer. ... View more

Try using a subsearch to set the variable.   | tstats count as count where index="myindex" [ | inputlookup lookuptable.csv | sort 10 -dm | table oper, dm | transpose 10 | rename "row "* AS "value_in*" | eval top1=value_in1 | return id=top1 ] by _time CAUSE_VALUE span=5m | timechart sum(count) as total_count span=5min   ... View more

Allow time for events to be indexed by searching earliest=-6m latest=-1m instead of earliest=-5m latest=now. ... View more

Make sure the ODBC user has the role(s) necessary to access the desired saved searches and the indexes that feed them. ... View more

That error message do not mean you cannot access the saved search.  It means the saved search ran successfully, but produced no results.  Depending on the search, that my be completely normal. ... View more

Please tell us more about what you don't understand about the command.  What part of the documentation is unclear? ... View more

Assuming you set INDEXED_EXTRACTIONS = csv then TIMESTAMP_FIELDS is what you should use.  However, you also will need TIME_FORMAT.  The value of TIME_FORMAT depends on how we should interpret the example content.  Is "10.Hour" literal text or some representation of time of day?  If the former then is there another field with time of day in it?  If there is no time information then use this setting TIME_FORMAT = 10.Hour %b %d, %Y ... View more

This should do, at least with the sample event. | rex "target service (?<targetService>[^,]+), the account (?<account>\S+)" ... View more