This is definitely a divergence in behavior and IMHO a bug (but perhaps splunk will say it is a feature). You *D*E*F*I*N*T*E*L*Y need to open a support case! ... View more

Try the following run anywhere example. You can use <progress> or <done> search event handler depending on your use case to capture the number of results returned by a search using a predefined token $job.resultCount$ <dashboard> <label>Table Result Count</label> <row> <panel> <title>My Search (Results: $tokResultCount$)</title> <table> <search> <query>index=_internal sourcetype=splunkd | stats count by component </query> <earliest>-1h@h</earliest> <latest>now</latest> <progress> <set token="tokResultCount">$job.resultCount$</set> </progress> </search> </table> </panel> </row> </dashboard> Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Search_event_elements_and_job_properties ... View more

To run a second NetWitness query using this app, netwitness_query, you can copy the nwsdk_query.conf file to a new file like nwsdk_query_dns.conf . Configure the query and last_mid_file values and then create a stanza for this file in inputs.conf. [script://./bin/nwsdk_query.py nwsdk_query_dns] . @rataide provided this answer in the comments, I only expanded on it slightly. There is no need to copy or modify the script. ... View more

By including edit_roles_grantable as a capability you have specified that any user assigned to that role will be limited to the capabilities that were included in that role. The result is that all the users who already existed and have been assigned to a role that has MORE capabilities than the role 'Pulsenewuser' will no longer be accessible. General behavior and configuration guidance for edit_roles_grantable: In the UI create a role called subadmin [or name of your choice] and make sure the following options are configured: [role_subadmin] edit_roles_grantable = enabled edit_roles = disabled edit_users = enabled When the new role is created, the following change will be made in Splunk/etc/system/local/authorize.conf: grantableRoles = subadmin [you should confirm this - if the entry doesn't match that, make the change. ** After any manual edits of authorize.conf, use Settings > Access control > Authentication method > Reload authentication configuration or changes won’t be applied.] Configure the subadmin role in the UI to include/exclude the capabilities to meet the specific limitations you want to impose on the subadmin. Create a newadmin user and assign them to the subadmin role. The user newadmin will only be able to see and use the capabilities that are included in the subadmin role. For example, if you want to remove access to the delete_by_keyword capability, configure the subadmin role as described above but without the delete_by_keyword capability. When the newadmin user logs into Splunk, they will not have that option in their list of capabilities. ... View more

Hi, Yes its almost same with only difference is my query is preserving the total memory and then divide among sub memories. Anyways glad that it resolves your issue 🙂 Sid ... View more

Cool....I edited my main answer as well ... View more

@jip31 , If you have given your panel id as "abc" then try in css- div#abc { background-color: #FFD501 !important; } after saving this css to take effect bump the server using - http://localhost:8000/en-GB/_bump click bump button ... View more

Note, the code was just pseudo code. If you really use append like that it will not work, as append adds it as extra lines, so you cannot filter this. It might help if you give a more concrete example of what your search looks like (without the filter). Something like this works: | makeresults | eval A=1 | table A | appendcols [ | makeresults | eval A=1 | appendcols [ | makeresults | eval b=1,c=2,d=3 ] | where A>0 | table b,c,d ] This returns all 4 fields. When running the same example but with A=0, it only returns A: | makeresults | eval A=0 | table A | appendcols [ | makeresults | eval A=0 | appendcols [ | makeresults | eval b=1,c=2,d=3 ] | where A>0 | table b,c,d ] ... View more

hi @csharm21 make a property for all panels drilldown:none; ... View more

hi @ndaniel88 try liek this | inputlookup my_names.csv | fields Name | rename Name as names |append [search index=my_index sourcetype=my_st names=* | fields number names] | reverse |dedup name |sort name |fillnull value="Not Found" number ... View more

Never mind,this is resolved.fields should be before lookup not at the end as the filter(where clause) is getting null created_date if we put fields at end that fails the query. ... View more

hi @asplunk789 try with split("-") ... View more

What he said. ... View more

hi @cmorrall try like this index="_internal" |head 2 |eval Apples=50,Bananas=44,results="Logout" |append [|makeresults |eval Apples=50,Bananas=44,results="Logout" ] |append [|makeresults |eval Apples=50,Bananas=44,results="Logout" ] |append [|makeresults |eval Apples=50,Bananas=44,results="Logging starting" ] |append [|makeresults |eval Apples=50,Bananas=44,results="Logout" ] |table Apples Bananas results |streamstats count as counting |where counting > [search index="_internal" |head 2 |eval Apples=50,Bananas=44,results="Logout" |append [|makeresults |eval Apples=50,Bananas=44,results="Logout" ] |append [|makeresults |eval Apples=50,Bananas=44,results="Logout" ] |append [|makeresults |eval Apples=50,Bananas=44,results="Logging starting" ] |append [|makeresults |eval Apples=50,Bananas=44,results="Logout" ] |table Apples Bananas results |streamstats count as counting1 |where results="Logging starting"|return $counting1] ... View more

I specified curl -vk -u admin:password --request DELETE https://sh-ip-address:8089/servicesNS///data/lookup-table-files/test.csv Anyone got the following in a clustered SH env? <msg type="ERROR">Object id=test.csv cannot be deleted in config=lookups.</msg> ... View more

hi @harishalipaka, Did the answer below solve your problem? If so, please resolve this post by approving it! ... View more

It would help to see sample events. Adding parentheses to your query will help tell Splunk how to interpret your desires. For exanple, (index=indexA OR index=indexB OR indexC) (user=alex OR ip=255.255.255.255 OR os= win95)|... . ... View more

In the report I have 4 columns in that I need to take only 2 columns and create a dashboard for that, but I doesn't know how to create a dashboard with only two columns please help ... View more

hi @nkchaitanya As @493669 answer follow that end of your query add this | makeresults |eval hari="working_condition_check - status - Stopped" |rex field=hari ".*status - (?<status>\w+)" |where status="Stopped" ... View more

Hi @avisri Sorry, your accepted answer not reflected to my karma points. Can you please do it again ... View more

If that is the case then you need stats/dedup by each hour so that you can identify two events. Any reason why you dont want to use either one? Is there a way to filter each of the two events per hour uniquely? ... View more

I have the same issue. We don’t want to disable trellis. We want to use trellis and have the table fit in the panel or move to the next page and not have a vertical scroll bar. ... View more

If you don't want to sort, then you can use tail before streamstats. By default 10 gives 10 event count, if you have an idea about the maximum number of events in that time frame you can use that (eg. tail 100000) ... View more