No it's not helping, I sort by host and _time because I need one host at the specific time for all distinct hosts. This code pulling in values from other times to the same host giving false values ... View more

The only possibility I'm seeing is that matched is still 0 inside the foreach . Like a lazy interation ... View more

I removed the eval clause, and all the Properties get populated.. ... View more

Same result.. What was your reasoning ? ... View more

Btw man, what can I do if I want to override a sourcetype that I have already assigned ? Example: For a ".cnf" file I assign a generic sourceType. But sometimes in those files, it comes XML written and I wanted to assign a new sourcetype with "KV_MODE = xml". Any ideas, like a Regex searching inside the file and alert me for a XML match and then assign that very XmlSourceType ? Thanks ... View more

Yeh, I also read this in the docs: Note: If you forward data, and you want to assign a source type for a source, you must assign the source type in props.conf on the forwarder. If you do it in props.conf on the receiver, the override has no effect. So I started using in the props.conf in the UF and it worked. I'll try your version on the HF now. Thanks! ... View more

@kamlesh_vaghela Thanks for your answer, but I know I can do it with Js. Maybe I should have specified that I was looking for a solution in the SimpleXML realm 🙂 ... View more

@kamlesh_vaghela I updated the question, pls do a recheck thanks ... View more

@Kamlest_vaghela I'm not really allowed to share the simpleXml. I could create a mockup example if necessary. ... View more

@tamduong16 Attention that this might not still be right, I need more specifications of your code to make it fully functional. You save this in under the directory: etc/apps/yourApp/appserver/static/myJsFile.js In Simple XML you do <form script="myJsFile.js"> .. ... View more

If you have tokens that you want to include in the searches tell me and I will update the answer accordingly ... View more

So assuming I got your problem right, this should do the trick. If you have more specifications plz tell me, I assumed some things since you didn't specified everything. EDIT: Based on a token from a dropdown, all searches will respond to that value. require([ 'underscore', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!' ], function (_, SearchManager, mvc) { var tokens = mvc.Components.get("default"); mvc.Components.get("my-dropdown-id").on("change", function(this){ // Manually start the searches when the value of the dropdown changes. firstSearch.startSearch(); secondSearch.startSearch(); /* . . . */ }); // Create all the searches you want var firstSearch = new SearchManager({ id: "example-search-1", earliest_time: "-24h@h", latest_time: "now", preview: true, cache: false, autostart: false, search: "index=_internal host=$DropDownToken$| stats count by sourcetype" }, {tokens: true}); var secondSearch = new SearchManager({ id: "example-search-2", earliest_time: "-24h@h", latest_time: "now", preview: true, cache: false, autostart: false, search: "index=_internal host=$DropDownToken$| stats count by source" },{tokens:true}); // Assuming in your panels you have tables you must associate the views to the searches manually mvc.Components.get("myTable1").options.managerid = firstSearch; mvc.Components.get("myTable2").options.managerid = secondSearch; } ... View more

So basically you want 3 or more different searches to run , based on a token that comes from a dropdown ? ... View more

Yep it really works, but I've got no clue what's happening in there haha. Better go read the docs! Do you wish to post this as your answer or should I just accept the other one ? Thanks for your time man! Really apreciated it ... View more

Oh jeez. So that's what's happening... This is what happens in temp. The other UF* remain "Un-Expanded" https://ibb.co/kgBXfR ... View more

Something along these lines: https://ibb.co/hxfiLR And if I try to foreach UF* [mvexpand <<FIELD>> ] this is the result: https://ibb.co/cmiES6 My multi value fields are have tripled.. why ? ... View more

Yep your sample works fine. ... View more

Oh and another difference is that my values also come as a single value sometimes. So it's a mix of arrays or a single value ( which I don't need to expand anymore ofc ) ... View more