@elend  You can pass tokens to a report by running the report using the savedsearch command and passing the values to the report - this assumes the report is set to have replaceable parameters, see the comments about replacement in this page. https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/savedsearch so you would run this in your dashboard to run the report | savedsearch report_name value=$token|s$ where $token$ is token you are passing to the report and it is assigned to the replaceable parameter $value$ in your report ... View more

If you are passing tokens from dashboard A to dashboard B that are inputs in dashboard B, then use &form.token_name=bla where token_name is the name of your token in dashboard B . ... View more

Here's one way you can do it by adding this after your timechart command   | foreach * [ eval productCode="<<FIELD>>" | lookup baseline.csv productCode OUTPUT name dailyBaseline | eval {name}=<<FIELD>>, base_{name}=dailyBaseline | fields - productCode name dailyBaseline "<<FIELD>>" ]   after a split by clause the column name is the productCode, so the foreach * will iterate through the columns and create a field called dailyBaseline_productX for each found value. There will be other ways Edit: Added friendly name mapping ... View more

Another technique you can use is to make use of TERM(xx) search - TERM() searches are much faster than raw data searches and let's assume your uri is  /partner/a/b/c/d you can do  index=tomcat TERM(a) TERM(b) TERM(c) TERM(d) uri=/partner/a/b/c/d it will depend on how unique the terms are, but it will certainly provide a way to reduce the amount of data looked at. In the job properties, look at the scanCount property that will show you the number of events scanned to provide the results.   ... View more

Is the search slow to return just the last 60 minutes of data and does the performance degraded linearly as you increase the time interval. How many events do you get per 24h period? Are you just doing a raw event search for 7 days to demonstrate the problem or is this part of your use case? Take a look at the job properties phase_0 property to see what your expanded search is. You can look at the monitoring console to see what the Splunk server metrics are looking like - perhaps there is a memory issue - take a look at the resource usage dashboards.   ... View more

@yuanliu mvfind() will not work with two potentially MV fields. ... View more

Unfortunately event type searches cannot contain any pipelines, so it has to be simply a raw search fragment   ... View more

I refactored your original search slightly using rename rather than eval, as there's no need to duplicate the fields. I also removed the dc() from the stats as it's not necessary - it can be done later because you are collecting values and is probably more optimal. index="okta" actor.alternateId=*@* authenticationContext.externalSessionId!="unknown" | rename "securityContext.asNumber" as ASN, "authenticationContext.externalSessionId" as "Session ID", "actor.alternateId" as User "debugContext.debugData.risk" as Risk | stats values(user_agent) AS "User Agent" values(ASN) as ASN values(Risk) as Risk by User "Session ID" | lookup asn_user.csv ASN User OUTPUT ASN as found_ASNs ``` Count the ASN's and Agents here and count the number of ASNs found in the lookup and set a new field if there is a new ASN found not seen before ``` | eval "ASN Count"=mvcount(ASN), "Agent Count"=mvcount('User Agent'), hasNewASN=if('ASN Count'>mvcount(found_ASNs), 1, 0) ``` Do the where before the table ``` | where 'ASN Count' > 1 AND 'Agent Count' > 1 AND hasNewASN=1 | table "Session ID", ASN, "ASN Count", "User Agent", "Agent Count", User, Risk The lookup will lookup ALL the ASNs collected and return all those that are found, so to see if there is a new one, you can just compare the counts. Note that if there are more than 100 ASNs then a CSV will only return 100 - you can make a definition that will allow up to 1000, but if that is going to be an issue, then you will need to put the lookup BEFORE the stats and test for the found ASN and set a flag accordingly, e.g. ... | lookup asn_user.csv ASN User OUTPUT ASN as found_ASN | eval newASN=if(isnull(found_AS),1,0) | stats sum(newASN) as newASNs values(user_agent) AS "User Agent" values(ASN) as ASN values(Risk) as Risk by User "Session ID" ... so you can then count the new ASNs for that user, but if you can do it after the stats, it will be more performant. Note field quoting rules. Field names need to be DOUBLE quoted when containing spaces or other odd characters when on left hand side of eval Field names need to be SINGLE quoted when containing spaces or other odd characters when on right hand side of eval Field names need to beDOUBLE quoted when containing spaces or other odd characters when in a stats aggregation     ... View more

The normal way to get data from windows machines is to install the universal forwarder on the machine and pretty much the rest happens as magic. https://www.splunk.com/en_us/blog/learn/splunk-universal-forwarder.html Also, you should install the TAs (Technical Add On) for Windows https://splunkbase.splunk.com/app/742 and then you will have the data in Splunk in a way that can be easily digested.   ... View more

The best way of getting data from the company's systems is generally whatever is the easiest to get them out. Splunk can ingest data in many ways, but there are many standard ways of looking at data. What systems do you have and what logs are available. Do you currently use Splunk?   ... View more

Your lookup command is looking up file.csv, which is NOT the definition. The lookup file contains the data, the lookup definition is the lens through which you interpret the data in the file.   ... View more

Use stats to combine them index=data_set1 OR index=data_set2 | stats values(*) as * by Domain Here uses values(*) as * to collect all fields from both data sources against their common field Domain. You can filter then what you do or don't want, e.g. after the above, do   | where T1_Fld 1="AAB"   ... View more

You possibly want this ... | chart count max(_time) as MaxTime over aRange by aType | eval aRange = aRange+1 | rename "count: 0" AS A, "count: 1" AS B | eval aPercentage = round((A / B) * 100) and then you will have also two columns MaxTime: 0 and MaxTime:1 and then you can do | eval MaxTime=max('MaxTime: 0', 'MaxTime: 1')   ... View more

I'm not sure I understand the question - where is the JS coming from? Are you saying you want to create a list of dropdown choices from the result of that search If so, simply set your input to be <input type="dropdown" token="your_token" searchWhenChanged="true"> <label>Example Dropdown from search</label> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search> <query>index=_internal |stats count by source</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> ... View more

That mvjoin simply turns your list of regexes into  (A|B|C|D|E|F|...) i.e. A OR B OR C OR D... How many regexes do you have - I suspect there is a practical limit and you've probably reached it.   ... View more

What difference are you expecting? Are you trying to say that in your example kb is 1000 based and you want to convert to 1024 based. That is not what memk does. In this case just do | eval KB=round(kb/1.024,3) If they are both 1024 based, then they are the same number, so memk will not do anything.   ... View more

You can do this - here's a simple example where the lookup regexes.csv contains two rows, the first with an IPv6 regex and the second with an IPv4, i.e. made with this SPL | makeresults | fields - _time | eval regex=split("([A-Za-z0-9]{1,4}:){7}##([0-9]{1,3}\.){3}[0-9]{1,3}", "##") | mvexpand regex | fields regex | outputlookup regexes.csv This SPL then creates 3 ip values and matches them against the regexes | makeresults | fields - _time | eval ipv4="bla 10.1.2.3 bla" | eval ipv6="bla 2021:1431:aaaa:bbbb:cccc:dddd:1234:0 bla" | eval ipvbad="bla not an ip address bla" ``` Show how the regexes are evaluated ``` | eval regexes=[ | inputlookup regexes.csv | stats values(regex) as regex | eval regex="\"(".mvjoin(regex, "|").")\"" | return $regex ] | foreach ipv* [ | eval ipv<<MATCHSTR>>_match_direct_from_lookup=if(match(<<FIELD>>, [ | inputlookup regexes.csv | stats values(regex) as regex | eval regex="\"(".mvjoin(regex, "|").")\"" | return $regex ]), 1, 0), ipv<<MATCHSTR>>_match_from_field=if(match(<<FIELD>>, regexes), 1, 0) ] | transpose 0 You can see the ipv4 and 6 match but the bad one does not.   ... View more

Not sure how your token can be * as there is nothing defined like that, but you DO have a mismatch between your defined token in the input and it's use <input type="dropdown" token="Index" searchWhenChanged="true"> where it's upper case Index and you are using it as lower case $index$ ... View more

When your token is expanded in your search, it becomes index IN ("dev_index, sit_index")... so that is actually a SINGLE value, which will never match. There are several ways, but the simplest for you is to just remove the quotes around your search definition, so index IN ($index$)... ... View more