Hi @ITWhisperer, Thanks to both you and @bowesmana . I have attached my search below, can you please check and assist in tweaking based on your above response? Thanks in -advance!!!!   index=nessus sourcetype="tenable:sc:vuln" severity!=informational ip=* dnsName=* | fields - index, source, sourcetype, splunk_server, splunk_server_group, host, eventtype, field, linecount, punct, tag, tag::eventtype, _raw | fields ip, dnsName, firstSeen, plugin_id, cve, cvss2_base_score, cvssV3BaseScore, severity, vprScore, state | makemv delim="," cve | stats dc(ip) AS Affected_IP_Count, dc(dnsName) AS Affected_DNS_Count, latest(firstSeen) AS First_Seen_Date, latest(state) AS State, latest(vprScore) AS VPR_Score, latest(severity) AS Tenable_Severity, latest(cvss2_base_score) AS cvss2_base_score, latest(cvssV3BaseScore) AS cvssV3BaseScore by plugin_id, cve | lookup vuln_affected_entities_info CVE AS cve OUTPUT Scan_Type, CATEGORY, KISAM_OS_Grouped, Nessus_OS_Grouped, EOPS_Assignment_Group, Responsible_Organization, KISAM_GSS, Project_Type, KISAM_Projects, UCMDB_Environment, Boundary_Name, Boundary_System | eval Asset_Category=mvrange(0,mvcount(CATEGORY)) | mvexpand Asset_Category | eval Scan_Type=mvindex(Scan_Type,Asset_Category) | eval CATEGORY=mvindex(CATEGORY,Asset_Category) | eval KISAM_OS_Grouped=mvindex(KISAM_OS_Grouped,Asset_Category) | eval Nessus_OS_Grouped=mvindex(Nessus_OS_Grouped,Asset_Category) | eval EOPS_Assignment_Group=mvindex(EOPS_Assignment_Group,Asset_Category) | eval Responsible_Organization=mvindex(Responsible_Organization,Asset_Category) | eval KISAM_GSS=mvindex(KISAM_GSS,Asset_Category) | eval Project_Type=mvindex(Project_Type,Asset_Category) | eval KISAM_Projects=mvindex(KISAM_Projects,Asset_Category) | eval UCMDB_Environment=mvindex(UCMDB_Environment,Asset_Category) | eval Boundary_Name=mvindex(Boundary_Name,Asset_Category) | eval Boundary_System=mvindex(Boundary_System,Asset_Category) | rename cvss2_base_score AS CVSS_Score_v2, cvssV3BaseScore AS CVSS_Score_v3, cve AS CVE, plugin_id AS Plugin_ID | lookup cvss_score_v2_nvd_severity CVSS_Score_v2 AS CVSS_Score_v2 OUTPUT NVD_Severity_v2 | lookup cvss_score_v3_nvd_severity CVSS_Score_v3 AS CVSS_Score_v3 OUTPUT NVD_Severity_v3 | eval First_Seen_Date=strftime(First_Seen_Date,"%m/%d/%y %H:%M:%S") | eval Age_Days=ceiling((now()-strptime(First_Seen_Date,"%m/%d/%y"))/86400) | eval CVE_Age=case( Age_Days<30,"A_0 to 29 Days", Age_Days>=365,"G_365 Days+", Age_Days>=180,"F_180 to 364 Days", Age_Days>=120,"E_120 to 179 Days", Age_Days>=90,"D_90 to 119 Days", Age_Days>=60,"C_60 to 89 Days", Age_Days>=30,"B_30 to 59 Days", 0==0,"H_No Age Data") | eval Remediation_Status=case( State="fixed","Remediated", State="open","Not_Remediated", State="reopened","Not_Remediated") | eval Time_to_Remediation_Days=if(Remediation_Status=="Remediated",'Age_Days',"Not_Remediated_Yet") | eval CVE_Age_Remediation=case( Time_to_Remediation_Days<30,"A_0 to 29 Days", Time_to_Remediation_Days>=365,"G_365 Days+", Time_to_Remediation_Days>=180,"F_180 to 364 Days", Time_to_Remediation_Days>=120,"E_120 to 179 Days", Time_to_Remediation_Days>=90,"D_90 to 119 Days", Time_to_Remediation_Days>=60,"C_60 to 89 Days", Time_to_Remediation_Days>=30,"B_30 to 59 Days", 0==0,"H_Not Remediated Yet") | eval Tenable_Severity = upper(Tenable_Severity) | fields Plugin_ID, CVE, CVSS_Score_v2, CVSS_Score_v3, NVD_Severity_v2, NVD_Severity_v3, Tenable_Severity, VPR_Score, First_Seen_Date, Age_Days, CVE_Age, State, Remediation_Status, Time_to_Remediation_Days, CVE_Age_Remediation, Affected_IP_Count, Affected_DNS_Count, Scan_Type, CATEGORY, KISAM_OS_Grouped, Nessus_OS_Grouped, EOPS_Assignment_Group, Responsible_Organization, KISAM_GSS, Project_Type, KISAM_Projects, UCMDB_Environment, Boundary_Name, Boundary_System   ... View more

Hi @bowesmana , I have tried all that but to no avail. See my search below: index=nessus sourcetype="tenable:sc:vuln" severity!=informational ip=* dnsName=* | fields - index, source, sourcetype, splunk_server, splunk_server_group, host, eventtype, field, linecount, punct, tag, tag::eventtype, _raw | fields ip, dnsName, firstSeen, plugin_id, cve, cvss2_base_score, cvssV3BaseScore, severity, vprScore, state | makemv delim="," cve | stats dc(ip) AS Affected_IP_Count, dc(dnsName) AS Affected_DNS_Count, latest(firstSeen) AS First_Seen_Date, latest(state) AS State, latest(vprScore) AS VPR_Score, latest(severity) AS Tenable_Severity, latest(cvss2_base_score) AS cvss2_base_score, latest(cvssV3BaseScore) AS cvssV3BaseScore by plugin_id, cve | lookup vuln_affected_entities_info CVE AS cve OUTPUT Scan_Type, CATEGORY, KISAM_OS_Grouped, Nessus_OS_Grouped, EOPS_Assignment_Group, Responsible_Organization, KISAM_GSS, Project_Type, KISAM_Projects, UCMDB_Environment, Boundary_Name, Boundary_System | eval Asset_Category=mvrange(0,mvcount(CATEGORY)) | mvexpand Asset_Category | eval Scan_Type=mvindex(Scan_Type,Asset_Category) | eval CATEGORY=mvindex(CATEGORY,Asset_Category) | eval KISAM_OS_Grouped=mvindex(KISAM_OS_Grouped,Asset_Category) | eval Nessus_OS_Grouped=mvindex(Nessus_OS_Grouped,Asset_Category) | eval EOPS_Assignment_Group=mvindex(EOPS_Assignment_Group,Asset_Category) | eval Responsible_Organization=mvindex(Responsible_Organization,Asset_Category) | eval KISAM_GSS=mvindex(KISAM_GSS,Asset_Category) | eval Project_Type=mvindex(Project_Type,Asset_Category) | eval KISAM_Projects=mvindex(KISAM_Projects,Asset_Category) | eval UCMDB_Environment=mvindex(UCMDB_Environment,Asset_Category) | eval Boundary_Name=mvindex(Boundary_Name,Asset_Category) | eval Boundary_System=mvindex(Boundary_System,Asset_Category) | rename cvss2_base_score AS CVSS_Score_v2, cvssV3BaseScore AS CVSS_Score_v3, cve AS CVE, plugin_id AS Plugin_ID | lookup cvss_score_v2_nvd_severity CVSS_Score_v2 AS CVSS_Score_v2 OUTPUT NVD_Severity_v2 | lookup cvss_score_v3_nvd_severity CVSS_Score_v3 AS CVSS_Score_v3 OUTPUT NVD_Severity_v3 | eval First_Seen_Date=strftime(First_Seen_Date,"%m/%d/%y %H:%M:%S") | eval Age_Days=ceiling((now()-strptime(First_Seen_Date,"%m/%d/%y"))/86400) | eval CVE_Age=case( Age_Days<30,"A_0 to 29 Days", Age_Days>=365,"G_365 Days+", Age_Days>=180,"F_180 to 364 Days", Age_Days>=120,"E_120 to 179 Days", Age_Days>=90,"D_90 to 119 Days", Age_Days>=60,"C_60 to 89 Days", Age_Days>=30,"B_30 to 59 Days", 0==0,"H_No Age Data") | eval Remediation_Status=case( State="fixed","Remediated", State="open","Not_Remediated", State="reopened","Not_Remediated") | eval Time_to_Remediation_Days=if(Remediation_Status=="Remediated",'Age_Days',"Not_Remediated_Yet") | eval CVE_Age_Remediation=case( Time_to_Remediation_Days<30,"A_0 to 29 Days", Time_to_Remediation_Days>=365,"G_365 Days+", Time_to_Remediation_Days>=180,"F_180 to 364 Days", Time_to_Remediation_Days>=120,"E_120 to 179 Days", Time_to_Remediation_Days>=90,"D_90 to 119 Days", Time_to_Remediation_Days>=60,"C_60 to 89 Days", Time_to_Remediation_Days>=30,"B_30 to 59 Days", 0==0,"H_Not Remediated Yet") | eval Tenable_Severity = upper(Tenable_Severity) | fields Plugin_ID, CVE, CVSS_Score_v2, CVSS_Score_v3, NVD_Severity_v2, NVD_Severity_v3, Tenable_Severity, VPR_Score, First_Seen_Date, Age_Days, CVE_Age, State, Remediation_Status, Time_to_Remediation_Days, CVE_Age_Remediation, Affected_IP_Count, Affected_DNS_Count, Scan_Type, CATEGORY, KISAM_OS_Grouped, Nessus_OS_Grouped, EOPS_Assignment_Group, Responsible_Organization, KISAM_GSS, Project_Type, KISAM_Projects, UCMDB_Environment, Boundary_Name, Boundary_System ... View more

Hi @ bowesmana, To test your "*" suggestion, I created another job that used below eval to create another field where % is replaced by * and output to a new lookup table which I then used to create new lookup definition. | eval TEXT_Updated = replace (TEXT, "%", "*") So all the Test value below became like this: *Cas is required to perform this test.* *Cas is required* *Cas is required * this test.* * Match Type as WILDCARD(TEXT_Updated) Then I adjusted and re-ran below query index=sample sourcetype=sample_vuln TEXT IN ("*Cas is required*") | stats count by TEXT | lookup sample_rules_updated TEXT_Updated AS TEXT OUTPUT TEXT_Updated, Priority Result was: TEXT=Cas is required to perform this test. TEXT_Updated=* At least a value (*) appeared this time. So it did not match. Feedback pls? ... View more

@ scelikok, Doing some testing so will respond back shortly. ... View more

Hi @scelikok, Append has max results limit of 50,000. I have a lot more than this. Any join option? Thanks. ... View more

I tried many things with up until Splunk 7.x. Finally, we upgraded to 8.0.6 (8.x) and below worked. No custom stylesheets etc. needed. Just use the below code and adjust for your need as needed.  If it works for you all, don't forget to thumbs up. Thanks.     <form theme="light"> <label>Sample Text Box Sizing</label> <fieldset submitButton="true" autoRun="false"> <input id="splunk_input_text_1" type="text" token="text1" searchWhenChanged="false"> <label>2 values</label> <default>A,B</default> </input> <input id="splunk_input_text_2" type="text" token="text2" searchWhenChanged="false"> <label>5 values</label> <default>A,B,C,D,E</default> </input> <input id="splunk_input_text_3" type="text" token="text3" searchWhenChanged="false"> <label>8 values</label> <default>A,B,C,D,E,F,G,H</default> </input> <html> <style> #splunk_input_text_1{ width: 200px !important; } </style> </html> <html> <style> #splunk_input_text_2{ width: 300px !important; } </style> </html> <html> <style> #splunk_input_text_3{ width: 600px !important; } </style> </html> </fieldset>     ... View more

Hi @ bowesmana, Below worked, | makeresults | eval netbiosName="ABC\HOST" | rex fieldName=netbiosName "(?<NETBIOS_Domain>\w+)\\\(?<NETBIOS_Host>\w+)" I ended up using below evals in props, | makeresults | eval netbiosName="ABC\HOST" | eval splitHost=mvindex(split(netbiosName,"\\"),1) | eval splitDomain=mvindex(split(netbiosName,"\\"),0)   ... View more

Hi bowesmana, How to consolidate an additional field for netbiosDomain in your below eval please?     | makeresults | eval netbiosName="ABC\HOST" | eval netbiosHost=replace(netbiosName,"[^\\\]*\\\(.*)","\1") | eval netbiosDomain=???     I have also tried below and this one works as well. However, which one will be a better approach?     | eval Split=split(netbiosName,"\\") | eval SplitHost=mvindex(Split,1) | eval SplitDomain=mvindex(Split,0)     By using * in place of UNKNOWN as you suggest produces below error: Regex: UTF-8 error: isolated byte with 0x80 bit set. Can you provide a RegEx option to extract both Domain and Host that I can add in props.conf and have the fields extracted at the backend so I can do my searches and calculations as normal? ... View more

Hi Rich, The issue is that users are creating clones of KOs and due to the lack of their training and knowledge, they try tweaking the cloned KOs in an un-optimized manner which is causing heavy load on infrastructure. We are asked by management to shutdown the cloning for users with read only access so they are unable to take clones to begin with. Thanks. ... View more

Perfect. Thank you!!!! ... View more

Hi ITWhisperer,   So first solution produces results and I am testing them. I tried using the second one as well to test as well and it is giving error that mvmap is unsupported or undefined. I am @ Splunk Enterprise 7.x. Thanks. ... View more

dedup does not work for me because I am dealing with a lot of data and stats runs the fastest. The drilldown dashboard is also used as an individual dashboard. USing your approach, tokens do get transferred now. The problem is if a value A is selected on dashboard A, filter logic is passing on value C or D. There is something in |n logic or something else causing this which I am not getting.   ... View more

Hi @ ITWhisperer, So I used your method below,  made progress and multiselect started passing the value from multiselect filter from dashboard A and drilldown stats table panel to filters in dashboard B.  Now the issue is, the value that is selected on dashboard A is not the one that is getting transferred to dashboard B. A different value is getting passed which seems odd because the selected one needs to be passed over. Here is my code snippet for the filters: Dashboard A:     <input type="dropdown" token="scantype" searchWhenChanged="false"> <label>Scan Type</label> <fieldForLabel>Scan_Type</fieldForLabel> <fieldForValue>Scan_Type</fieldForValue> <search base="menus"> <query>| stats dc(Scan_Type) AS Total by Scan_Type | fields - Total</query> </search> <default>*</default> <initialValue>*</initialValue> <choice value="*">All</choice> </input> <input type="multiselect" token="resporg" searchWhenChanged="false"> <label>Responsible Organization</label> <fieldForLabel>Responsible_Organization</fieldForLabel> <fieldForValue>Responsible_Organization</fieldForValue> <search base="menus"> <query>| search Scan_Type="$scantype$" | stats dc(Responsible_Organization) AS Total by Responsible_Organization | fields - Total</query> </search> <default>*</default> <initialValue>*</initialValue> <choice value="*">All</choice> <prefix>Responsible_Organization IN (</prefix> <suffix>)</suffix> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>,</delimiter> <change> <eval token="drilldownmultiorg">mvjoin('form.resporg',"&amp;form.drilldownmultiorg=")</eval> </change> </input>     Stats Panel A:     <drilldown> <link target="_blank">/app/sample_app/drilldown_dashboard?form.cves=$row.CVE$&amp;form.scantype=$scantype$&amp;form.resporg=$drilldownmultiorg|n$</link> </drilldown>     Dashboard B:     <input type="text" token="cves"> <label>Select CVE</label> <default>CVE-2015-6550</default> <initialValue>CVE-2015-6550</initialValue> </input> <input type="multiselect" token="plugin" searchWhenChanged="false"> <label>Plugin ID/s</label> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> <fieldForLabel>Plugin_ID</fieldForLabel> <fieldForValue>Plugin_ID</fieldForValue> <search base="vulninfo"> <query>| search CVE="$cves$" | stats dc(Plugin_ID) AS count BY Plugin_ID | fields Plugin_ID</query> </search> <prefix>Plugin_ID IN (</prefix> <suffix>)</suffix> <delimiter>,</delimiter> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> </input> <input type="dropdown" token="scantype" searchWhenChanged="false"> <label>Scan Type</label> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> <fieldForLabel>Scan_Type</fieldForLabel> <fieldForValue>Scan_Type</fieldForValue> <search base="vulninfo"> <query>| search CVE="$cves$" AND $plugin$ | stats dc(Scan_Type) AS count BY Scan_Type | fields Scan_Type</query> </search> </input> <input type="multiselect" token="drilldownmultiorg" searchWhenChanged="false"> <label>Responsbile Organization</label> <choice value="*">All</choice> <fieldForLabel>KISAM_Responsible_Organization</fieldForLabel> <fieldForValue>KISAM_Responsible_Organization</fieldForValue> <search base="vulninfo"> <query>| search CVE="$cves$" AND $plugin$ AND Scan_Type="$scantype$" | stats dc(KISAM_Responsible_Organization) AS count BY KISAM_Responsible_Organization | fields KISAM_Responsible_Organization</query> </search> <prefix>KISAM_Responsible_Organization IN (</prefix> <suffix>)</suffix> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>,</delimiter> <initialValue>*</initialValue> <default>*</default> </input>       ... View more

Hi @ ITWhisperer, Sorry, I was away from home. Will be posting my code snippet for filters today. Thanks! ... View more

H @ ITWhisperer,   Quick question, for one filter which was my original ask, this solution works great. But when I have tried to use it with multiple filters for multiple fields to be passed, it is not. What am I missing pls? I did adjust the logic as in this solution for the rest. Thanks!!! ... View more

Hi @ ITWhisperer, That is exactly what I am dealing with. ... View more

That's correct. I need regex that will take a name (PrimaryName or SecondaryName) and split it into First, Middle and Last? As per question about how to distinguish between names which have first and middle only and first and last only; they are still under Primary/Secondary for each. So as far as Primary and Secondary are broken down, it looks like that all will be broken down fine wouldn't they?   ... View more