I'm using the Webtools Add-on to do a get request for each row on a keyword field but combine the curl results with the initial data. Ie the initial data returns _time, keyword, hostname, etc and the curl request returns curl_message, curl_status,etc and I want my final table to be _time,keyword,hostname,curl_message,curl_status . Right now I'm able to get the curl response using the map search="uri=.../$keyword$ " but that only returns the curl output.  I do see that you can use datafield without a map command to do multiple curl requests (|curl uri=... datafield=keyword) and it would have the my desired output but that made the uri look like this uri=.../?keyword. I need the uri to look like uri=.../keyword instead.  Any help/tips would be appreciated. ... View more

I see in the docs splunk doc that summary indexing does not count against your license. It also says that summary indexes are built via transforming searches over event data.  If I use a scheduled report that does not use a transforming command and saves the data to an index will that count against the license? Ie I want to extract a subset of data from the main index and save certain fields to a new index so that a role doesn't have access to all the data. ... View more

I want to create a 30 day index of data that changes it's indexed timestamp as each day passes. Therefore the data will always show up when I do a last 30 day search and don't need to pick out the specific 30 days I saved. Ie if I started with January data, in June 1st the original data from January should represent the month of May. Is there any way to change the time of the data in the index every day? Or does it have to be deleted from index and readded?  ... View more

I am using the Splunk Add on for Aws app and using a generic s3 data input. I am unable to get the data into splunk. I get this in the splunk_ta_aws_generic_s3_<data_input_name>.log  phase="fetch_key" | message="Failed to get object." key="filename.json" Any help would be helpful. ... View more

I have one user out of many that gets a red triangle error on a dashboard panel inside an app that uses a subsearch and gives the error:  [subsearch): [name] Search process did not exit cleanly, exit code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. However if I copy the dashboard to the default search app the user does not get the error anymore. Any thoughts on why the behavior changes depending on the app the dashboard is in? I checked the search.log for error messages but there were none ... View more

I am using a scheduled report to save data to a summary index with the following query: index=_internal | stats count by status  | collect index=test_index addtime=true testmode=true marker="sch_rpt_name=Test_Report"  It outputs a _raw value like this : 01/12/2022 20:00:00 +0000, info_min_time=1642017600.000, info_max_time=1642106259.000, info_search_time=1642106259.959, count=63985, status=200, scheduled_report_test=Test_report Is there a way to get rid of the info_search_time field? ... View more

I am struggling to follow the documentation to install the dfs manager app. Is there any better resources to follow? Currently I'm stuck figuring out why when setting the java_home field in the serv.conf upon restart I am getting an error saying it is an invalid key. ... View more

I created a search head and an indexer and the search head is acting as the master license server. I added the tutorial data to the search head https://docs.splunk.com/Documentation/Splunk/8.2.1/SearchTutorial/GetthetutorialdataintoSplunk  The indexer is associated with the master license server. On the search head I am getting the license error of 1 orphaned indexer reported by 1 indexer and the message is "this slave indexed data/sourcetype(s) without a corresponding license pool" and the indexer is the master license server and category is orphan_slave.  I read in other answers related to this that the sourcetypes need to be in a license pool. I added the two host of the search head and indexer to the license pool via the specific indexers option however I am still getting the same error. Will this error go away or am I still in violation? ... View more

I would like to display a table and have the ability to give the data a category via an input field. So each row would have its own input field for the user to enter a value into it. For example the data could be something like this where the category column is the input field. I want to put the brand of the car in the category field and save it to a lookup table.  |Car|Category| |Prius | Toyota| |Mustang | Ford | ... View more

I'm wondering if the data that is being returned for a federated search is encrypted or not. Also is it possible to encrypt splunk indexes at rest? ... View more

I have a query that runs completely fine in the regular search but when it is added to a dashboard in the same app it gives a DAG error. This only happens for one user so far. I have asked other users with the same role to do the same thing and it works fine for them. ... View more

Splunk only has an option for linux to download a rpm, deb, or tgz file for enterprise trial. If I download the rpm file will that work on a centos and redhat system? ... View more

I am trying to set up a restricted search for a role so that they can only see data when a field1=customer01. The default way was to do it by field1::customer01 but that didn't show any results when I previewed the results. Instead I did field1=customer01 and that worked. Is there a reason why field1::customer01 doesn't generate any results? ... View more

Is it possible to do restricted searches for a role based on an extracted field? I can see it can be done by index but I would like to do it for an extracted field. I have roles for each customer and there is a field called customer so customer#1 should only see data when customer=cust01. ... View more

I have a dashboard that uses joins with subsearches and when it runs for me and others it shows no errors. But for a few people when they run it, it runs/completes but has the red warning error with a message like [subsearch] search process did not exit cleanly exit code=255. When I inspect the job it says this  "[subsearch]: No matching fields exist."  I'm confused why this warning isn't showing up from everyone. Is there a way to ensure this message doesn't show up?  ... View more

Is it possible to make a legend wider? I'm trying to use html in the xml file to assign the width to be wider but it doesn't seem to be working. ... View more

I have a timechart that is sorted by a variable that is a combination of two fields. Like field1_field2. I want to drilldown and send only field2 to the next dashboard as a token. Is it possible to do some sort of regex on the drilldown value? ... View more