Hi  We had a javascript and css created to acknowledge the errors in Splunk dashboard. Reference link is here https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-in-applying-checkbox-in-splunk-table-and-saving-the-on/m-p/503603#M33311 It needs a feature "SELECT ALL" option at the top of the row to select all the errors in that particular page. So that we can acknowledge the errors at one instance. Current logic, we are clicking the tick box one by one before pressing the acknowledge button. Is it possible to append this logic in the existing JS without breaking current logic? Please refer the JS, XML and CSS attached CSS: /* The standalone checkbox square*/ .checkbox { width:0px; height:0px; border: 2px solid #000; display: inline-block; } /* This is what simulates a checkmark icon */ .checkbox.checked:after { content: ''; display: block; width: 2px; height: 7px; /* "Center" the checkmark */ position:relative; top:1px; left:-8px; border: solid black; border-width: 0 2px 2px 0; transform: rotate(45deg); } .checkbox, .radio { min-height: 12px; padding-left: 12px; } td.numeric, th.numeric { text-align: left; } #myTable tr.range-acked td { background-color: #82e566 !important; } #myTable tr.range-not-acked td { background-color: #ff0000b3 !important; } JS:   require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function (_, $, mvc, TableView) { // Access the "default" token model var tokens = mvc.Components.get("default"); var selected_values_array = []; var submittedTokens = mvc.Components.get('submitted'); console.log("This is Multi-select table JS"); // Custom renderer for applying checkbox. var CustomRenderer = TableView.BaseCellRenderer.extend({ canRender: function (cell) { return _(['Tick']).contains(cell.field); }, render: function ($td, cell) { var cell_value = cell.value.split("|")[0]; var ack_value = cell.value.split("|")[1]; var ack_flag = ack_value !== ""; console.log(cell.value,ack_flag,ack_value); var div = (ack_flag ? $('<div>') :$('<div>').attr({ "id": "chk-number" + cell_value, "value": cell_value }).addClass('checkbox').click(function () { if ($(this).attr('class') === "checkbox") { selected_values_array.push($(this).attr('value')); $(this).removeClass(); $(this).addClass("checkbox checked"); console.log(selected_values_array); } else { $(this).removeClass(); $(this).addClass("checkbox"); var i = selected_values_array.indexOf($(this).attr('value')); if (i != -1) { selected_values_array.splice(i, 1); } console.log(selected_values_array); } })) var b = (ack_flag ? $td.addClass('range-cell').addClass('range-acked') : $td.addClass('range-cell').addClass('range-not-acked')); div.appendTo($td); } }); //List of table ID var sh = mvc.Components.get("myTable"); if (typeof(sh) != "undefined") { sh.getVisualization(function (tableView) { tableView.on('rendered', function() { console.log("Output 1"); setTimeout(function(){ // Apply class of the cells to the parent row in order to color the whole row tableView.$el.find('td.range-cell').each(function() { console.log("Output 2"); $(this).parents('tr').addClass(this.className); console.log(this.className); }); console.log("Output 3"); },100); }); // Add custom cell renderer and force re-render tableView.table.addCellRenderer(new CustomRenderer()); tableView.table.render(); }); } // Disabling button while search is running var mysearch = mvc.Components.get('mysearch'); var mainSearch = mvc.Components.get('mainSearch'); var myrevertsearch = mvc.Components.get('myrevertsearch'); var myjirasearch = mvc.Components.get('myjirasearch'); mysearch.on('search:start', function (properties) { $("#mybutton").attr('disabled', true); }); mysearch.on('search:done', function (properties) { $("#mybutton").attr('disabled', false); mainSearch.startSearch(); }); myrevertsearch.on('search:done', function (properties) { console.log("Revert Search Done"); $("#myrevertbutton").attr('disabled', false); mainSearch.startSearch(); console.log("Main Search Done"); }); myjirasearch.on('search:start', function (properties) { $("#myjirabutton").attr('disabled', true); }); myjirasearch.on('search:done', function (properties) { $("#myjirabutton").attr('disabled', false); mainSearch.startSearch(); }); $(document).ready(function () { //setting up tokens with selected value. $("#mybutton").on("click", function (e) { e.preventDefault(); tokens.set("mytoken", selected_values_array.join()); submittedTokens.set(tokens.toJSON()); $("#mybutton").attr('disabled', true); }); $("#myrevertbutton").on("click", function (e) { e.preventDefault(); myrevertsearch.startSearch(); $("#myrevertbutton").attr('disabled', true); console.log("Hiee"); }); $("#myjirabutton").on("click", function (e) { e.preventDefault(); tokens.set("myjiratoken", selected_values_array.join()); submittedTokens.set(tokens.toJSON()); $("#myjirabutton").attr('disabled', true); }); }); });   XML:     <form version="1.1" script="jiraselect.js" stylesheet="multiselect_color.css" hideEdit="true" isVisible="true" hideAppBar="true"> <label>Error Acknowledgment UI</label> <search id="ram_inst_search" ref="rpt_ram_institution"></search> <search id="mysearch"> <query> |inputlookup $dash$ | dedup ID | where ID IN ($mytoken$) | eval Ack=now(),Ack_time="UPD",Ack_By="$env:user_email$"+","+strftime(Ack,"%c") | outputlookup $dash$ append=True</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <search id="myjirasearch"> <query> |inputlookup $dash$ | dedup ID | where ID IN ($myjiratoken$) | eval Ack=now(),Ack_time="JIRA",Ack_By="$env:user_email$"+","+strftime(Ack,"%c") | eval Message_Text = "Update from SD to raise JIRA ticket - "+Message_Text | eval Message_Text= if(isnull(Ack_By) AND LIKE(Message_Text,"%Update from SD to raise JIRA%"),substr(Message_Text,39,len(Message_Text)),Message_Text) | outputlookup $dash$ append=True</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <search id="myrevertsearch"> <query> |inputlookup $dash$ | where ID = "$UnAckID$" | eval Ack="",Ack_time="",Ack_By="" | eval Message_Text= if(LIKE(Message_Text,"%Update from SD to raise JIRA%"),substr(Message_Text,39,len(Message_Text)),Message_Text) | outputlookup $dash$ append=True</query> </search> <!-- Information panel --> <fieldset submitButton="true" autoRun="false"> <input type="radio" token="dash" searchWhenChanged="true"> <label>Choose Current/Historic Data</label> <choice value="ram_error_ack_kv">Monthly</choice> <choice value="ram_error_ack_kv_bkup">Historic</choice> <default>ram_error_ack_kv</default> <initialValue>ram_error_ack_kv</initialValue> </input> <input type="time" token="time1" searchWhenChanged="true"> <label>Time Window</label> <default> <earliest>-2h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="inst" searchWhenChanged="true"> <label>Institution EMEA</label> <choice value="*">ALL</choice> <default>*</default> <fieldForLabel>Institution_name</fieldForLabel> <fieldForValue>Institution</fieldForValue> <search> <query>|inputlookup emea_institution_kv_data | join type=outer Institution [ | inputlookup institution_name.csv | sort institution_number | eval Institution=institution_number] | eval Institution_name=if(isnull(institution_name),substr(Institution,7,2)+" "+"Inst",institution_name) | table Inst_desc Institution Institution_name</query> <earliest>-15m</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="ackby" searchWhenChanged="true"> <label>Acknowledged By</label> <choice value="*">ALL</choice> <default>*</default> <fieldForLabel>Ack_name</fieldForLabel> <fieldForValue>Ack_name</fieldForValue> <search> <query>|inputlookup acknowledged_names.csv</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="ackflag" searchWhenChanged="true"> <label>Acknowledged (Y/N)</label> <choice value="*">ALL</choice> <choice value="Yes">Yes</choice> <choice value="No">No</choice> <default>*</default> <initialValue>Yes</initialValue> </input> <input type="text" token="UnAckID" searchWhenChanged="true"> <label>Enter Un Ack ID</label> </input> <input type="text" token="error" searchWhenChanged="true"> <label>Type Error String here</label> <default></default> </input> </fieldset> <row> <panel> <html> <h3> <a href="https://de-splunk.1dc.com/en-US/manager/TA-omnipay-platform/admin/macros/error_skiplist?f_ns=TA-omnipay-platform&amp;uri=%2FservicesNS%2Fnobody%2FTA-omnipay-platform%2Fadmin%2Fmacros%2Ferror_skiplist&amp;action=edit&amp;ns=TA-omnipay-platform" target="blank"> <font color="blue">Click to Update Error Skip List</font> </a> </h3> <style> div.fieldset.dashboard-form-globalfieldset div.dashboard-element.html.dashboard-element-html { display: inline-block; } </style> <div> <input type="button" id="mybutton" value="Ack Selected Rows"/> <input type="button" id="myrevertbutton" value="Un Ack Entered Id"/> <input type="button" id="myjirabutton" value="Ack and Create Jira Ticket"/> <a href="https://de-splunk.1dc.com/en-US/app/TA-omnipay-platform/ram_error_dashboard" class="btn btn-primary" text-align="right">Refresh</a> </div> </html> </panel> </row> <row> <panel> <html> <div class="imgheader"> <div style="text-align: right;"> <h4> <a data-toggle="modal" data-target="#Help_modal"> <font color="blue">Help, information for this dashboard</font> </a> </h4> </div> </div> <style> #Help_modal.dropdown-menu { float: left; min-width: 421px; top: -1000% !important; left: 40% !important; } .close { text-align: right; border-radius: 1px 2px 2px 2px; <!--width: 30% !important; height: 600px !important;--> } pre { text-align: left; } .modal-footer { background: #ffe0 !important; padding: 1px 1px 1px 1px; } </style> <!--<div class="modal custom-modal-60 fade" id="Help_modal" tabindex="-1" role="dialog" aria-labelledby="Help_modal_Label">--> <div class="dropdown-menu other-menu shared-poptart close" id="Help_modal" tabindex="-1" role="dialog" aria-labelledby="Help_modal_Label"> <div class="modal-dialog" role="document"> <div class="modal-content"> <div class="modal-header"> <!--<button type="button" class="close" data-dismiss="modal" aria-label="Close"> <span aria-hidden="true"/> </button>--> <div style="text-align: left;"> <h4 class="modal-title" id="Help_modal_Label">Dashboard:</h4> </div> </div> <pre> <b>Dashboard Information</b> This dashboard is for acknowledging or unacknowledge errors <p> <b>For queries or feedback on this dashboard, mail to</b>:<b> </p> </pre> <!--<div class="modal-footer"> <button type="button" class="btn btn-default" data-dismiss="modal">Close</button> </div>--> </div> </div> </div> </html> </panel> </row> <row> <panel> <html> <style> <!--#test h2 { text-align: center !important; background-color: aliceblue; }--> .dashboard-body { padding: 2px 2px 2px 2px; <!--color: #3c444d;--> color: #ce8820; background-color: #ffffff; min-height: 500px; } .dashboard-row .dashboard-panel h2.panel-title { text-align: center !important; background-color: mistyrose; border: 1px solid black; font-size: 21px; font-weight: bold; padding: 12px 2px 12px 2px; margin: 2px 2px 2px 2px; } .dashboard-row .dashboard-panel .panel-head h3 { text-align: center !important; background-color: rgba(0, 164, 253, 0.37); } .dashboard-row .dashboard-panel .panel-body.html, .dashboard-row .dashboard-panel .panel-body.splunk-html { padding: 0px !important; } td.numeric, th.numeric { text-align: center !important; } .table td, .table th { text-align: left; color: black !important; border: 1px solid black !important; font-size: 13.5px; } label { font-weight: bold; } .table .sorts a { color: black; font-weight: 500; font-size: 14.3px; } .fieldset { margin-bottom: -17px; } .dashboard-header h1 { font-size: 30px; font-weight: 700; line-height: 76px; text-align: center; padding: 2px 2px 2px 2px; margin: 2px 2px 2px 2px; background-color: coral; color: #3c444d; } .dashboard-header { margin-bottom: 10px; min-height: 28px; background: chocolate; padding: 2px; } .dashboard-row .dashboard-cell { float: left; <!--background-color: darkslategrey; --> } .results-table { color: black; } .SimpleResultsTable table.simpleResultsTable { white-space:pre-line; } #myTable tr.range-acked td { background-color: #82e566 !important; border: 1px solid black; } #myTable tr.range-not-acked td { background-color: #ff6363 !important; border: 1px solid black; } .modal-header .close { top: 20px; right: -220px; margin-top: -2px; position: unset; background-color: none; border: 1px solid transparent; color: #5c6773; -webkit-box-shadow: none; box-shadow: none; text-decoration: none; text-shadow: none; -webkit-transition: background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s; transition: background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s; transition: background .2s,border .2s,box-shadow .2s,text-decoration .2s; transition: background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s; -webkit-filter: none; filter: none; } </style> </html> <table id="myTable"> <search id="mainSearch"> <query>|inputlookup $dash$ | rename "Package_Name,Procedure_Name,File_Name,Host_Name" AS Package_Name_Procedure_Name_File_Name_Host_Name | search `error_skiplist` | dedup ID | eval fields=split(Ack_By,",") | eval Ack_name=mvindex(fields,0) | eval Ack_name = if(isnotnull(Ack_name),Ack_name,"NA") | eval ack_flag=if(isnotnull(Ack_By),"Yes","No") | search Institution=$inst$ Platform="EMEA" Ack_name=$ackby$ ack_flag=$ackflag$ Message_Text="*$error$*" | eval _time=strptime(Date_Time,"%d-%m-%Y %H:%M:%S") | convert mstime(_time) AS ms_time | addinfo | where ms_time &gt;= info_min_time AND ms_time &lt;= info_max_time | eval Ack=if(isnull(Ack_time),"",Ack_time) | eval Tick=ID."|".Ack | eval "Program_ID Program_Name" = Program_ID+","+Program_Name | makemv delim="," "Program_ID Program_Name" | makemv delim="," Package_Name_Procedure_Name_File_Name_Host_Name | makemv delim="," Ack_By | rex max_match=100 field=Message_Text "(?&lt;split__regex&gt;.{0,100}(?:\s|$)|[^\s]+)" | rename split__regex as Message_Text | table Tick ID ms_time Institution Date_Time Ack Ack_By Ack_time "Program_ID Program_Name", Program_Run_ID Package_Name_Procedure_Name_File_Name_Host_Name Message_Text email | sort 0 - ms_time | eval skip_ram_user=if(like(Package_Name_Procedure_Name_File_Name_Host_Name,"%RAM%"),1,if(like(Package_Name_Procedure_Name_File_Name_Host_Name,"%ram%"),1,0)) | where skip_ram_user != 1 | fields - email Ack ms_time Ack_name Ack_time skip_ram_user</query> <earliest>$time1.earliest$</earliest> <latest>$time1.latest$</latest> <refresh>2m</refresh> <refreshType>delay</refreshType> </search> <option name="count">25</option> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <option name="wrap">true</option> <drilldown> <condition field="*"></condition> </drilldown> </table> </panel> </row> <row depends="noshow"> <panel> <html> <style> .input-dropdown { min-width: 190px !important; width: 190px !important; max-width: 170px !important; } .splunk-dropdown .select2-container { min-width: 190px !important; width: 190px !important; max-width: 170px !important; } .input-text { min-width: 190px !important; width: 190px !important; max-width: 170px !important; } .input-text &gt; input[type="text"] { min-width: 190px !important; width: 190px !important; max-width: 170px !important; } </style> </html> </panel> </row> </form>       ... View more

HI, I am trying to recreate the same structure in Splunk which was created in excel. I have five fields week, total transactions, codes, count of codes and code percentage. Sample data are shown below the first two column in blue should be represented in row wise and next three column in orange should be represented in column wise in Splunk table.   I want to display the week and total transaction in row wise followed by column codes showing the count and percentage of it in column wise for each code like below. Please let me know if it is possible? Thanks ... View more

Hi, I have multiple panels in my dashboard but my line chart and pie chart color in the dashboard gets faded. Could you please let me know any fix for this. I tried multiple option but not sure why its getting fade. When the dashboard gets loaded initially then the actual color in the line chart is good like image 1. But after few seconds it fades like image 2.     ... View more

Hi, I am using heatmap to display the buffer time, it uses only the count for the specific time frame. So, I converted the HH:MM:SS to minutes and used as a count. But I want to show the buffer time in both minutes and HH:MM:SS along with the process name in the tooltip when I mouseover. Currently only the x axis and yaxis values(minutes and date) are shown I want to add more values to the tooltip so that I can see HH:MM:SS, minutes, process name and the date.  Could you please help me to know what are possible changes required in the heatmap js or any alternate solution. Sample screenshot of heatmap showing only the xaxis and yaxis value. Need to show additional values like minutes in HH:MM:SS and process name in this tooltip. The js which I used is the js came with heatmap app in Splunk.   ... View more

Hi, I'm using the Gantt chart visualization from the Gantt chart app to show the status of batch processes. Currently if I click the gantt chart it takes me to the search query instead I want to open another gantt chart. The problem now is I'm having a hard time getting the Gantt chart to drilldown into another Gantt chart when I click the bar(as shown in below image) of the gantt chart. What I'm trying to achieve is to have the user be taken to another Gantt chart that shows the history of the process (say part 7 days) of the bar he clicked on in the original Gantt chart.  Any lead or reference would help 🙂 Below is the main gantt chart which I have, when i click on the bar it should drilldown to another gantt chart and pass the process as token so the new gantt chart where I have the history of processes for past 7 days.   <form script="gantt:autodiscover.js"> <label>Process Monitoring</label> <fieldset submitButton="false"> <input type="dropdown" token="tko_posting_date" searchWhenChanged="true"> <label>Posting Date</label> <search> <query>| gentimes start=-31 end=1 | sort -starttime | eval date=strftime(starttime,"%d-%m-%Y %a") | eval pdate=strftime(starttime,"%Y%m%d") | eval today=strftime(now(), "%d-%m-%Y %a") | eval yesterday=strftime(relative_time(now(),"-1d@d"), "%d-%m-%Y %a") | eval adate=case(date = today, "Today", date = yesterday, "Yesterday", 1=1 , date) | eval sortd=case(date = today, "1", date = yesterday, "2", 1=1 , "0") | eval endtime=endtime+43200 | table pdate adate sortd starttime endtime | sort sortd, pdate desc</query> </search> <fieldForLabel>adate</fieldForLabel> <fieldForValue>pdate</fieldForValue> <selectFirstChoice>true</selectFirstChoice> <change> <set token="tko_set_earliest">$row.starttime$</set> <set token="tko_set_latest">$row.endtime$</set> </change> </input> <input type="dropdown" token="tko_inst" searchWhenChanged="true"> <label>Select Institution</label> <fieldForLabel>institution_name</fieldForLabel> <fieldForValue>institution_number</fieldForValue> <search> <query>| inputlookup institution_name.csv | table institution_name institution_number</query> <earliest>-15m</earliest> <latest>now</latest> </search> <default></default> <initialValue>*</initialValue> <choice value="*">ALL</choice> </input> <input type="dropdown" token="tko_emins" searchWhenChanged="true"> <label>Elapsed Mins</label> <choice value="1">Non-Zero Values</choice> <choice value="0">All Values</choice> <default>1</default> </input> </fieldset> <row> <panel> <html> <h2>Gantt Chart demo</h2> <div id="demo-search" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options="{ &quot;search&quot;: { &quot;type&quot;: &quot;token_safe&quot;, &quot;value&quot;: &quot;| inputlookup jobs.csv | search institution_number=$$tko_inst$$ posting_date=$$tko_posting_date$$ duration&gt;=$$tko_emins$$ &quot; }, &quot;earliest_time&quot;: { &quot;type&quot;: &quot;token_safe&quot;, &quot;value&quot;: &quot;$$tko_set_earliest$$&quot; }, &quot;latest_time&quot;: { &quot;type&quot;: &quot;token_safe&quot;, &quot;value&quot;: &quot;$$tko_set_latest$$&quot; }, &quot;cancelOnUnload&quot;: true, &quot;preview&quot;: true }"> </div> <div id="demo-view" class="splunk-view" data-require="app/gantt/components/gantt/gantt" data-options="{ &quot;managerid&quot;: &quot;demo-search&quot;, &quot;startField&quot;: &quot;startField&quot;, &quot;durationField&quot;: &quot;duration&quot;, &quot;categoryLabel&quot;: &quot;Process&quot;, &quot;categoryField&quot;: &quot;process&quot; }"> </div> </html> </panel> </row> </form>   Any thoughts? ... View more

Hi All, I have an HTML page which is basically created to list the different process run time on a daily basis in a Gantt chart. So when I click on the specific process it will show the 7 days history of the process run time. I tried to use Gantt chart in Splunk apps but that doesn't satisfy my purpose of showing the history when I click on the process.  So I would like to know whether we can append this change to the Splunk Gantt chart  and also is there a way whether we can use the HTML code and recreate the same in Splunk dashboard. Any reference would help. Thanks, ... View more

Hi, Currently I am facing role related issue in ITSI. I installed ITSI 4.3.1 version in Splunk enterprise 8.0.3 and after successful installation when I open the ITSI app the below error pops out saying "Could not load page settings. Check that you have the proper roles and permissions. Details: Page not found!" and when I try to open other options like glass tables, deep-dive etc. it throws another error saying "Deep Dive could not be loaded. Possible cause: connection lost. Try restarting the Splunk platform. Status: 404 (Not Found) Details: Page not found!" Below is my authorise list for role_admin which looks ok but not sure why the above errors occur. Could you please help with your expertise. I have attached the screenshot as well. C:\Program Files\Splunk\bin>splunk btool authorize list role_admin [role_admin] accelerate_datamodel = enabled admin_all_objects = enabled apps_backup = enabled apps_restore = enabled change_authentication = enabled cumulativeRTSrchJobsQuota = 400 cumulativeSrchJobsQuota = 200 dispatch_rest_to_indexers = disabled edit_authentication_extensions = enabled edit_bookmarks_mc = enabled edit_cmd = enabled edit_deployment_client = enabled edit_deployment_server = enabled edit_dist_peer = enabled edit_encryption_key_provider = enabled edit_forwarders = enabled edit_health = enabled edit_httpauths = enabled edit_indexer_cluster = enabled edit_indexerdiscovery = enabled edit_input_defaults = enabled edit_local_apps = enabled edit_metric_schema = enabled edit_metrics_rollup = enabled edit_modinput_admon = enabled edit_modinput_perfmon = enabled edit_modinput_winhostmon = enabled edit_modinput_winnetmon = enabled edit_modinput_winprintmon = enabled edit_monitor = enabled edit_restmap = enabled edit_roles = enabled edit_scripted = enabled edit_search_concurrency_all = enabled edit_search_head_clustering = enabled edit_search_schedule_priority = enabled edit_search_scheduler = enabled edit_search_server = enabled edit_server = enabled edit_server_crl = enabled edit_splunktcp = enabled edit_splunktcp_ssl = enabled edit_splunktcp_token = enabled edit_tcp = enabled edit_tcp_stream = enabled edit_telemetry_settings = enabled edit_token_http = disabled edit_tokens_all = enabled edit_tokens_own = enabled edit_tokens_settings = enabled edit_udp = enabled edit_upload_and_index = enabled edit_user = enabled edit_view_html = enabled edit_web_settings = enabled edit_win_eventlogs = enabled edit_win_regmon = enabled edit_win_wmiconf = enabled edit_workload_pools = enabled edit_workload_rules = enabled get_diag = enabled grantableRoles = admin importRoles = itoa_admin;itoa_analyst;itoa_user;power;user indexes_edit = enabled install_apps = enabled license_edit = enabled license_tab = enabled license_view_warnings = enabled list_cascading_plans = enabled list_deployment_client = enabled list_deployment_server = enabled list_dist_peer = enabled list_forwarders = enabled list_health = enabled list_httpauths = enabled list_indexer_cluster = enabled list_indexerdiscovery = enabled list_pdfserver = enabled list_pipeline_sets = enabled list_search_head_clustering = disabled list_search_scheduler = enabled list_settings = disabled list_storage_passwords = disabled list_tokens_all = enabled list_win_localavailablelogs = enabled list_workload_pools = enabled list_workload_rules = enabled never_expire = enabled never_lockout = enabled read_metric_ad = disabled refresh_application_licenses = enabled rest_apps_management = enabled restart_reason = enabled restart_splunkd = enabled rtSrchJobsQuota = 100 run_collect = enabled run_debug_commands = enabled run_mcollect = enabled run_msearch = enabled schedule_rtsearch = enabled select_workload_pools = enabled srchDiskQuota = 25000 srchFilter = * srchFilterSelecting = true srchIndexesAllowed = *;_*;itsi_grouped_alerts;itsi_notable_archive;itsi_notable_audit;itsi_summary;itsi_tracked_alerts srchIndexesDefault = main srchJobsQuota = 50 srchMaxTime = 8640000 srchTimeWin = 0 web_debug = enabled write_metric_ad = disabled write_pdfserver = enabled     ... View more