You don't mention where the field department comes from (the csv file or the events), so I'm going to assume it's in the csv file. This will need some slight adjustment if department is in the base events. index=unix_security [| inputlookup accounts.csv | fields userid | eval userid=userid."@*"] | stats latest(_time) AS last_login BY userid | rex field=userid "^(?<userid>[^@]+)" | append [| inputlookup accounts.csv | eval last_login=0 ] | stats max(last_login) AS last_login, latest(username) AS name, latest(department) AS department BY userid | sort - userid As you mentioned that you're still learning, I'll walk through it, chunk by chunk. First, we gather events relating only to the users in the csv by using a subsearch to gather the userid values and adding "@*" to the end of each one, as you mentioned that the raw events contain the full email address but the csv file contains the username (portion of the email before the @ sign). If all the userids belong to the same domain, you might replace "@*" with "@yourdomain.com" or whatnot. index=unix_security [| inputlookup accounts.csv | fields userid | eval userid=userid."@*"] After that, I replaced your dedup command with this stats call: | stats latest(_time) AS last_login BY userid This more efficiently returns the latest value of _time for each userid, which also dedups the results. I next truncate the userid values from the raw events: | rex field=userid "^(?<userid>[^@]+)" Then I append in the whole list from the csv, and add last_login=0 to each user so that this call: | stats max(last_login) AS last_login, latest(username) AS name, latest(department) AS department BY userid can either preserve the 0 (if the user was not seen in the raw events) or carry through the last_login value from the events. This also preserves the username and department if they were in the csv. If you need to extract them from the raw events, you'll need to add latest(username) AS name, latest(department) AS department to the first stats call, as well. Finally, I preserve the sorting you intended: | sort - userid I hope this is helpful! ... View more

Do you mean you want them to use a CAC to log in without having some kind of SSO identity provider, such as ADFS? I don't know of any such way to do that. But if Splunk is running in a traditional enterprise environment where users a logging into their workstations with a CAC, then integration with ADFS is pretty straightforward. ... View more

You can run this on your search head: | rest /servicesNS/-/-/saved/searches splunk_server=local | search search="* some_lookup_here *" | table title search ... View more

How about this: base search | rex field=_raw "(?<date>[^ ]+$)" Here's a demo: https://regex101.com/r/Y06SsX/1 This regex is collecting everything between the last space and the end of the line and assigning it to a field called date . ... View more

If you are wondering why you need to rename them at all, it's because Splunk uses underscores to identify internal fields: https://docs.splunk.com/Splexicon:Internalfield http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Knowledge/Usedefaultfields ... View more

Hmm, well I found this doc: http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZH It says: The key ID field By default, each KV Store record has a unique key ID, which is stored in the internal "_key" field. When you use outputlookup to write to the KV Store, a key ID is autogenerated if you don't specify one explicitly. If you want to modify a specific record, you need to provide its key ID. To view the key ID field in lookups, add "_key" to the fields_list in the lookup definition. So you might need to edit transforms.conf and add _key to the fields_list. ... View more

You can rename the field to not start with an underscore, and then Splunk will display it: | makeresults | eval _msg="Hello World" | rename "_msg" AS "msg" If you have many fields that start with underscores, you could do this: | makeresults | eval _msg="Hello World" | rename "_*" AS "*" Note that this will also display and convert other internal fields, like _time. ... View more

Is there any chance that the search populating that dashboard panel is changing the content/format of the _time field? I'm suspicious about it when you say "This doesn't convert _time to epoch though like I would expect." If you haven't done any calculations or eval s on the _time field, it will already be in epoch and won't need converting. ... View more

If you're looking to go from the first chart above (three columns: operator , Month , and Count ) to the second chart, then you should be able to append this to your current search: | xyseries operator Month Count | addcoltotals label="Grand Total" labelfield="operator" ... View more

The code for getting and setting token values via JavaScript looks like this: // Access the "default" token model var tokens = mvc.Components.get("default"); // Retrieve the value of a token $mytoken$ var tokenValue = tokens.get("mytoken"); // Change the value of a token $mytoken$ tokens.set("mytoken", "this is the new value"); Those are taken directly from the Splunk developer guide. I'd recommend starting at the section called "Bind data using tokens". It's pretty short and straightforward. ... View more

According to @martin_mueller, both of these should be outputting events per second. ... View more

Have you had a chance to try these queries? Did they work for you? ... View more

Ahh, ok. I didn't really test deeply enough to fully validate, so I wasn't sure. I played around for a bit with the navigation elements at the bottom of a dashboard panel to see if I could figure out where the search option in that menu is finding the full search query, but alas. No luck. ... View more

By the way, I assume that when you say: I defined a key as "key" for a KVStore that you mean you did something like this: | outputlookup my_kvstore_name key_field="key" That won't force the kvstore to store its keys in a field named key . It will output a kvstore and copy the values in the existing field named key into a hidden field called _key and use those as the keys. ... View more

The kvstore is using a field called _key to store the key. You can see the values by doing this: | inputlookup my_kvstore_name | eval view_key=_key By default, Splunk is hiding this internal value from you, but you can see it by putting the value into another field. ... View more

In our environment, users log in to their workstations with a card that is similar to DOD CAC. Their authentication is done with an ADFS server. When they access Splunk, we are using SAML authentication to verify their identity. Is this what you're looking for? If so, there are a few options: Your users are all in the same "user" role bucket and don't need a lot of specialized roles - in this case, you can use Splunk SAML authentication to pass UPN values. Your users have different roles, and those roles can be maintained in your ADFS records - in this case, you can still use Splunk SAML authentication, and ADFS will pass UPN and role info. Your users have different roles, and those roles need to be managed within Splunk, because you can't be bothering the ADFS team to manage those roles - in this case, you can wrap Splunk with Apache, acting as a reverse proxy, and shibboleth, which manages the SAML. ... View more

Ahh, man. And here I thought I was so clever with this sid workaround. I've been playing with this and trying to find another solution, but no dice yet. Here's what I think is happening with the base/post-process search. Splunk is being too smart by half. Since the base search is not returning any results, it never bothers to execute the post-process search and just optimizes it away. If I massage this dashboard a little so that it generates actual results in my environment, then the $job.sid$ approach leads to a query that has both the base search and the post-process query. Of course, that's of no help to you in your actual use case, since you only want this if there are no results...! So I'll keep playing a little and let you know if I find anything that works. ... View more

Is that the value of a single field? Is it a multivalue field? ... View more

I believe you need to replace this: | eval usage=stats.hypervisor_cpu_usage_ppm / 10000 with this: | eval usage='stats.hypervisor_cpu_usage_ppm' / 10000 Splunk has some quirks about when field names must be wrapped with quotes in order to reference them, and field names with non-alphanumeric characters often trigger those. ... View more

In the first panel, you are taking the value from one field, adding a second slash to the value in that field, and putting it into the token user.name . Let's say the field in the first panel is called name_field . Then in the dropdown you show above, you'd change "Set" to "Eval", leave "user.user" in the first text entry box, and put this into the second: mvjoin(split($row.name_field$, "\\"), "\\\\") That should take the value from name_field in the first panel, add a second slash, and put it all into the user.user token. ... View more

How about using an eval to add a second slash before passing it to the other dashboard? Here's a sample: | makeresults | eval a="pf\something" | eval b=mvjoin(split(a, "\\"), "\\\\") This guide documents how to use <eval> elements to modify values being passed in a drilldown: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting ... View more