Here is a search using the multisearch command allowing you to only look at numbers with less than 3 entries. | multisearch [ search index=YOUR_INDEX sourcetype=YOUR_SOURCETYPE sla_name=*RES* | eval sla_response=has_breached] [ search index=YOUR_INDEX sourcetype=YOUR_SOURCETYPE sla_name=*CON* | eval sla_contract=has_breached] | stats values(sla_response) as sla_response values(sla_contract) as sla_contract count by num | where count < 3 | table num sla_response sla_contract ... View more

By applying a restrictive search you are limiting the data they can see to a subset of the index(es) the role can see. Since index2 does not have a parameter field, you are removing index2 from the scope for that role. You will need to do an OR in the search so that it covers all of the data they can see. For example: (index=index1 parameter=value) OR (index=index2) ... View more

Use the [default] stanza to define any global settings. * You can also define global settings outside of any stanza, at the top of the file. * Each conf file should have at most one default stanza. If there are multiple default stanzas, settings are combined. In the case of multiple definitions of the same setting, the last definition in the file wins. * If an setting is defined at both the global level and in a specific stanza, the value in the specific stanza takes precedence. https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf ... View more

As an alternative, you can utilize the MS Windows AD Objects app https://splunkbase.splunk.com/app/3177/ "This application also provides an efficient, alternative, option for looking up AD Object attributes instead of using the Support Add-On for Active Directory (ie remote LDAP Queries). Since the the Splunk for Windows Infrastructure and Splunk for Microsoft Exchange applications require the SA LDAPSearch add-on by default, the MS Windows AD Objects application provides the needed dashboard files to replace the ones provided within these applications." ... View more

Take a look at Correlation searches: http://docs.splunk.com/Documentation/ITSI/3.1.2/User/Createcorrelationsearch Or Multi-KPI alerts: http://docs.splunk.com/Documentation/ITSI/3.1.2/User/Createmulti-KPIalerts ... View more

You could use scheduled saved searches for your dashboard panels, rather than ad-hoc searches. So if you schedule your reports to run every hour as an example, then add those reports as panels to a dashboard, the data will be from the last run of the scheduled report. You could also use real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report. Take a look at this documentation for more details. A good way to test the benefits is to create a simple dashboard with 2 identical panels. One that is a scheduled report and the other that uses an ad-hoc search. You will see the first panel show up faster. http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/WorkingWithDashboardPanels ... View more