By default, reports in your app are shown in your app.  To have them appear in the S&R app the reports must be shared globally and the Reports dashboard must be set to show reports from all apps.  Or your report must be shared within your app and the S&R Reports dashboard must be set to show reports from your app. ... View more

The + quantifier is greedy, meaning it will match as many characters as possible.  So you'll get everything from NameofTeam until the end of the data.  To avoid that, use the non-greedy quantifier +?, even better, change the pattern to match until the next quotation mark. index=test | rex field=_raw "Key\": \"Owner\", \"ValueString\": \"(?<Team>.+?)\"}," index=test | rex field=_raw "Key\": \"Owner\", \"ValueString\": \"(?<Team>[^"]+)\"},"   ... View more

You have the right idea. Here's how to do that in SPL. index=some_index "some search criteria" | eval PODNAME=case(in(SERVERNAME, {list of servernames}), "ONTARIO", in(SERVERNAME, {list of servernames}), "GEORGIA", 1==1, "unknown" ) | timechart span=30min count by PODNAME Now, when servers are added or removed you just need to edit the lookup file rather than change SPL.  I recommend the Splunk App for Lookup File Editing to modify CSV files. There's a better way, though, since the above doesn't scale well with many locations and may become hard to maintain if the code is used in many places. Use a lookup table. Create a CSV file with SERVERNAME and PODNAME columns then use the lookup to map server name to location. index=some_index "some search criteria" | lookup serverlocation.csv SERVERNAME OUTPUT PODNAME | timechart span=30min count by PODNAME ... View more

Splunk can only tell you what it is told by Windows.  Are you running sysmon on the Windows devices?  If so, then you can get detailed user activity; otherwise, you're limited to what's in the event logs (that have been indexed). ... View more

You have to edit the DM to see the values, but it's much easier to read it from the manual. ... View more