Hey @jbrocks , @SplunkDB2022  Setting conditional drilldowns to set values for token and hiding the panel is not supported in the Dashboard Studio. Here is the reference link for comparing the features between Classic Dashboard and Dashboard Studio - https://docs.splunk.com/Documentation/Splunk/8.2.5/DashStudio/IntroFrame#Dashboard_features  ... View more

@phil_wong Can you please provide the link to the doc you are referring to? Might help understand the use case better ... View more

Additionally, if you want to have the event opened up in a new tab upon clicking on the SLA value in the table, you will need to define drilldown and link it to a search. You can find the related information here - https://docs.splunk.com/Documentation/Splunk/8.2.4/Viz/DrilldownLinkToSearch  Be sure of using variables like $click.value$ and $click.value2$ while using drilldown to achieve proper use case ... View more

Hey @jcorcoran508, You can proceed ahead with further modules. The data seems to be perfect and not sure what is the need for delimiting a white space character in the description field. Also, I can see in the screenshot that the description field is properly extracted by the json sourcetype. ... View more

Hey @lamnguyentt1, Found the same question while exploring community answers and here's your solution - https://community.splunk.com/t5/Getting-Data-In/How-do-you-calculate-the-size-of-indexed-data-as-per-source-type/m-p/441649/highlight/true#M76998  index=_internal source=*license_usage.log* type=Usage idx=<yourindexname> | eval GB=b/1024/1024/1024 | stats sum(GB) by st ... View more

Hey @paramagurukarth, I think you can achieve that in a better way if the results are exported in CSV or JSON or XML format. It would be quite simpler to separate the fields based on delimiter instead of tab characters. If there is any specific use case or reason for exporting the data into rawdata format, please feel free to share the details. ... View more

Hey @jimrp, There is one more workaround that you can try. Instead of one input, you can have two dynamic multi-select inputs defined. One of them with the top 10 values and the other one with the rest. And then in the query, you can include tokens from both the inputs and perform OR operation between them.  I don't have much background in custom javascript and am not sure if it can be helpful to achieve the objective. In this way, you can also achieve the case for selecting the top 10 values or any other value for spID field. ... View more

Concurrent searches can be controlled using base_max_searches and max_searches_per_cpu. But those are global settings only as mentioned by @isoutamo It would be better to restrict the users based on roles and apply the limits globally. Creating roles based on apps can become a complex job for managing roles, current and future users, current and future apps as well.  ... View more

Hey @somari, Found this in one of the accepted answers. You can try that if it works for you. Here is the link to the answer - https://community.splunk.com/t5/All-Apps-and-Add-ons/Unable-to-initialize-modular-input-Webtools-Add-on/m-p/528361/highlight/true#M64122 ... View more

Hey @jimrp, You can achieve this by statically keeping initial and default values to * This will work only if you want the top 10 values in the input. You can place below query in the search for dynamic input as you mentioned to achieve desired input index=* | stats count(spID) as auths by spID | sort -auths limit=10 Along with this, you can set Key to be All and its Value to be *. This will always have top 10 values auto-selected. But you won't be able to have other values to be present in the input. Your XML source code should look something like below: <input type="multiselect" token="spPicker" searchWhenChanged="true"> <label>spPicker</label> <fieldForLabel>spID</fieldForLabel> <fieldForValue>spID</fieldForValue> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <search> <query>index=* | fields spID | dedup spID</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <delimiter>,</delimiter> <choice value="*">All</choice> </input> ... View more

It seems that you have configured the server to forward the data to Splunk.  Installation guide for ITE Work - https://docs.splunk.com/Documentation/ITEWork/4.12.0/Install/Install After installation of ITE Work, you can proceed with the installation of Content Packs (#5391) as mentioned here - https://docs.splunk.com/Documentation/ContentPackApp/1.5.0/Overview/Install For visualizations of AD servers and objects, Content Pack for Windows Dashboards and Reports will be helpful. Configuration steps for Windows Content Pack can be found here - https://docs.splunk.com/Documentation/CPWindowsDash/1.0.0/CP/Install You will also need to create a few indexes and install supporting add-ons like SA-ldapsearch (#1151) and Splunk add-on for Windows (#742) for AD monitoring and data collection. The details have been provided in the above-mentioned docs. ... View more

Hi @hichem_khalfi, You can try installing ITE Work (https://splunkbase.splunk.com/app/5403) and use Content Packs (#5391) to use the content pack for windows infrastructure to get access to dashboards like splunk app for windows infrastructure.  ... View more

Hey @EvansB, You can simply use the below query to get the time field displayed in the stats table | stats values(time) as time by _time  Here, I  have kept _time and time as two different fields as the image displays time as a separate field. If both time and _time are the same fields, then it should not be a problem using either. But if they are different fields, and you want to use _time, then you can replace _time with time in the values function. ... View more

Hi @blbr123, You can get the details of indexes using the below search query. Please specify splunk_server as per your environment | rest services/data/indexes  Similarly, information related to the apps can be found using below rest endpoint |rest services/apps/local ... View more

Hi @anil1432, I couldn't understand much of what do you mean by data usage? If this is in the context of license usage based on sourcetype, you can navigate to Monitoring Console -> Indexing -> License Usage -> License Usage - Previous 30 days dashboard and filter the data to display the dashboard split by "sourcetype". And since it is based on timechart, you can find the usage for different periods of time as per your need.    If this is in the context of event count based on sourcetype, you can run the following search query between specific time intervals to get the count of events for that specific sourcetype for the defined time interval | metadata type=sourcetypes index=* splunk_server_group=dmc_group_indexer splunk_server_group="*" | fields sourcetype, totalCount | sort - totalCount | search sourcetype=gshshsh | rename sourcetype as Sourcetype, totalCount as "Event Count"  ... View more

Hi @vineela, You can create base query without the tcode and then in the panel specific query, you can start your search with | search tcode="1324" OR tcode="234" and then append the rest of your queries.  Alternatively, you can create two base searches with the queries mentioned in the description and use the same for different panels. Directly define the base searches in the source code of XML below the description field as below: <search id="base_1"> <query>index=xyz  sourcetype="dtc:hsj" tcode="1324"</query> </search> <search id="base_2"> <query>index=xyz  sourcetype="dtc:hsj" tcode="1324" OR tcode="234"</query> </search>  Now under the panel, define the queries using the search id as base <row> <panel> <search base="base_1"> <query> | your_query </query> </search> </panel> </row> You can define other panels in similar way using base="base_2"   ... View more

Was trying to understand if the schedule was defined within double quotes or not ... View more

Hey @jotase , Can you confirm that the cron schedule was defined in proper format as mentioned in the inputs.conf doc: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Scripted_Input:  To specify a cron schedule, use the following format: * "<minute> <hour> <day of month> <month> <day of week>" * Cron special characters are acceptable. You can use combinations of "*", ",", "/", and "-" to specify wildcards, separate values, specify ranges of values, and step values.   ... View more

Hey Neeraj,  Thanks for explaining the use case. GET Workflow action will not be able to save the values in a field. It'll just redirect you to another website using the field you specify. And workflow actions would also not be helpful in achieving your objective. Will need to look for another solution to it. ... View more

Hey @neerajs_81, Can you please provide the use case specifically for needing app/TA to find the reputation of IP? I believe this can also be achieved by defining GET Workflow Actions that can fetch the IP from the fields and refer it to web URLs that are available to calculate the reputation score. Here's the link on how to define a GET workflow action: https://docs.splunk.com/Documentation/Splunk/8.2.4/Knowledge/SetupaGETworkflowaction  ... View more

Hey @lenrigodoy, Did you try specifying the outputs in the below manner? [tcpout] defaultGroup = default-autolb-group forwardedindex.0.whitelist =(itsi_grouped_alerts|itsi_im_meta|itsi_im_metrics|itsi_import_objects|itsi_notable_archive|itsi_notable_audit|itsi_summary|itsi_summary_metrics|itsi_tracked_alerts) forwardedindex.1.blacklist = forwardedindex.2.whitelist = indexAndForward = 1 The filters will be working in the sequential manner of the integers provided after the forwardedindex parameter. And in your case, I see there are 2 parameters with forwardedindex.0.whitelist in the outputs.conf. And sequentially, the filter you need is present in the parameter present at the bottom.  ... View more