Please forgive me for not explaining in full my idea originally. I was not that clear myself. What I need to do with the multi-select is to have Captions that will lead to "values", the later being instead search strings that I will add, if selected, to the "base" one. That is why I edited the question to ask for least two dynamic options, instead of the original one. best regards Altin ... View more

I did, and it shows SELECT - when Checkbox not checked; * - when Checkbox checked ... View more

resolved by enabling Search on Change on the Time component <input type="time" token="field1" searchWhenChanged="true"> ... View more

@altink you can definitely up vote the comment/s that helped by hovering over the comment/answer and clicking on the up arrow for up vote. JUST FYI 🙂 ... View more

Your answer is correct @493669 remove of the NT_EVENT_ID= made it. I think my initial "Search is waiting for input...." happened because I hadn't refreshed the form. The DB_NAME is OK whenever as a value or as * Thank you very much, best regards Altin ... View more

Hi @DalJeanis - I have a similar trouble.... I have the next source but with users NT, example CUSTOMER\admin_moss and this no show me results. How should be the form? Accesos a BD SQL Server <!-- Create a text box; token is "series" --> <!-- label: Label for the text box --> <!-- default: Default value for the form --> <!-- suffix: All tokens are followed by a * --> <!-- If user does not specify text, then search uses '*' --> <input type="dropdown" token="user" searchWhenChanged="true"> <label>Selecciona un Usuario:</label> <default>*</default> <!-- Define the default value --> <choice value="*">All</choice> <change> <set token="user_label">$label$</set> </change> <!-- Define the choices with a populating search --> <populatingSearch fieldForValue="user" fieldForLabel="user" earliest="-24h" latest="now"> <![CDATA[index=sqlserver_audit | stats count by "user"]]> </populatingSearch> </input> <input type="dropdown" token="estado" searchWhenChanged="true"> <label>Selecciona Resultado Conexión :</label> <default>*</default> <!-- Define the default value --> <choice value="*">All</choice> <!-- Define the choices with a populating search --> <populatingSearch fieldForValue="estado" fieldForLabel="estado" earliest="-24h" latest="now"> <![CDATA[index=sqlserver_audit | stats count by estado]]> </populatingSearch> </input> <input type="dropdown" token="dbname" searchWhenChanged="true"> <label>Selecciona Nombre de la BD:</label> <default>*</default> <!-- Define the default value --> <choice value="*">All</choice> <!-- Define the choices with a populating search --> <populatingSearch fieldForValue="dbname" fieldForLabel="dbname" earliest="-24h" latest="now"> <![CDATA[index=sqlserver_audit | stats count by dbname]]> </populatingSearch> </input> <!-- Add time range picker --> <input type="time" searchWhenChanged="true"> <default> <earliestTime>-25h</earliestTime> <latestTime>now</latestTime> </default> </input> <!-- Show results as a table --> <table> <option name="showPager">true</option> <option name="count">20</option> </table> ... View more

No Sir no third parties only Simple XML my app is meant to be this way - at least in its initial version. I think I will satisfy myself with a: 1. Manual Index install 2. Manual TCP Input creation I might also look to implement both in a setup.xml Let me ask you one more question please. I did the following test. 1. Installed app_name.spl (with built-in index creation) 2. populated the app with some data and confirmed data presence 3. delete the app by stop-splunk and delete app-dir in /etc/app 4. after splunk restart I noticed that the index was not present anymore on the GUI 5. installed the same app_name.spl again. Nothing failed, kind of "index xxxxx already exists" - very good! after this I noticed in the app that the "old" index data were preserved and during the install the existing index's data were not erased by a new empty index. This is very good too, but I need to know: Is this the always behavior of the .spl install ? If yes - will this continue in the future otherwise I think I will go for a manual index create/setup too thanks and best regards Altin ... View more

but always a Splunk software user! ... View more

thank you very much rjthibod ... View more

I did fixed it by replacing the field_db_name input with the un-quoted one: <condition match="'db_name_no_quotes' == &quot;*&quot;"> this made the switching of forms! I would be curious to see how this would work with the original input token - field_db_name thank you very much for your help, best regards Altin ... View more

Did you find an answer to this? I am having the same problem. ... View more

Thank you very much best regards Altin ... View more

Thank you skoelpin, yes, that is the idea, and I am aware of full in Splunkbase vs Directory only My concern is what tool/syntax/code/third-party-apps is "put" inside a splunk apps to make it expire (full or partial) after X days. This sure for Directory listing, because to my knowledge (correct me if wrong) what is fully published in Splunkbase is fully free and opened. I have seen these Directory guys that say: "download full functional 60 day trial "Our Splunk" apps"! How can this be done? Can it be done in Simple XML forms? best regards Altin ... View more

The super-sneaky way to do this is to give the "secret" field a name that begins with an underscore ( _ ) which makes it invisible BUT IT IS STILL THERE. Then you just use it when and where you need it but it will never show to the user. ... View more

The same does not work when the token input elements are removed and remaining only in the search of the target form. no results are found - while there should be - as in the previous try with input elements involved. Details for code is: <form> <label>Scan Item Details 03</label> <fieldset submitButton="false"> <input type="text" token="field1"> <label>field1</label> </input> </fieldset> <row> <panel> <table> <search> <query>index=omega_ds_idx_01 DB_NAME=$form.field_db_name$ SCAN_ID=$form.field_scan_id$ VLN_ID=$form.field_vln_id$ | table DB_NAME SCAN_ID VLN_ID VLN_NAME CTRL_SUMMARY CTRL_OUTPUT</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">3</option> <option name="wrap">true</option> </table> </panel> </row> </form> the input text field1 has been inserted just to have the tag of the form added Problem: The dashboard returns no rows: "No results found. " The URL is: http://192.168.1.71:8000/en-US/app/Omega_DS_App_02/scan_item_details_03?form.field_scan_id=20170714_210278_Ora_DB_T01&form.field_vln_id=204&form.field_db_name=Ora%20DB%20Test%2001 The search should return data: SCAN_ID=20170714_210278_Ora_DB_T01 VLN_ID=204 DB_NAME="Ora DB Test01" index=omega_ds_idx_01 SCAN_ID=20170714_210278_Ora_DB_T01 VLN_ID=204 DB_NAME="Ora DB Test 01" does return from the following Ticket: https://answers.splunk.com/answers/219807/how-to-hide-a-dashboard-panel-containing-inputs-th.html do I have to read that the drill-down at target form (dashboard) - is not supported without visual Input elements in the middle? if not - please advise on how to do without input elements best regards Altin ... View more

thank you very much the command you gave me works and I have the expected results. However (to my knowledge) it is a bit complicated. I can have the same result with: index=omega_ds_idx_01 SCAN_ID="20170703_233304_OraScan" | join VLN_ID type=outer [ SEARCH index=omega_ds_idx_01 SCAN_ID="20170705_135210_OraScan" | rename SCAN_ID as SCAN_ID2, VLN_CTRL_FIND as VLN_CTRL_FIND2 ] | table _time, VLN_ID, SCAN_ID, SCAN_ID2, VLN_CTRL_FIND, VLN_CTRL_FIND2 Is the above approach OK ? I have read the Join syntax, but other than limitations on [SEARCH], found no reason not to use it. I would like to continue with the approach above - if it it technically correct please advise thanks and regards Altin ... View more

got it - string quotation needed. thank you for the pure SQL, :-) regards Altin ... View more

Not the issue. you can do cases in tokens ... View more

Thank you very much for your reply Pduflot I see above you say that code above uses HTML syntax. I have tried your way in Simple XML (my project is limited there - no Javascript/CSS). And furthermore it is a Column chart. I tried to set the same of what you suggested in XML, I added the y2Axis. SCAN_ID is the sole field/column I want to hide in legend (it produces nothing) <chart> <search> <query>`mc_vln` | search DB_NAME=$field_db_name$ | stats count(eval(CTRL_FIND_ID=-1)) as Broken, count(eval(CTRL_FIND_ID=0)) as Correct, count(eval(CTRL_FIND_ID=1)) as Finding, earliest(_time) as SCAN_DT_START by DB_NAME SCAN_ID | sort - SCAN_DT_START | table DB_NAME SCAN_ID SCAN_DT_START Broken Correct Finding | dedup $field_last_x_scan$ DB_NAME | head 15 | sort SCAN_DT_START | fields - SCAN_DT_START | rename DB_NAME as Database</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="charting.chart">column</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisLabelsY2.axisVisibility">hide</option> <option name="charting.axisY2.fields">"SCAN_ID"</option> <option name="charting.axisY2.minimumNumber">0</option> <option name="charting.axisY2.maximumNumber">0</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart.stackMode">default</option> <option name="charting.legend.labels">["Finding","Correct","Broken"]</option> <option name="charting.legend.placement">top</option> <option name="charting.seriesColors">[0xFA4343,0x00579F,0x646464]</option> <option name="charting.legend.masterLegend"></option> <drilldown target="blank"> <link>scan_data?form.field_db_name=$click.value$&amp;form.field_scan_id=$row.SCAN_ID$&amp;form.field_ctrl_find_name=$click.name2$</link> </drilldown> </chart> but I does not work, I still see the SCAN_ID field (the only needed to hide) appear in legend menu Is your solution valid for simple XML, or am I missing something in my code? Can you please advise at this point? thanks and best regards Altin ... View more

Please click "Accept" on the answer that most lead you to your solution.. ... View more

I have the same problem too. ... View more

The two formats are two different Oracle audits: Format 1 Administrative SYSDBA audit - always in OS when *Nix, always in Event Viewer when *Win. When initialization parameter audit_sys_operations=TRUE you will get all SYSDBAs Top-SQL commands, other then normal administrative audits, like instance startup-shutdown and others Format 2 Standard audit. These can go in OS (and is this case) when initialization parameter audit_trail=OS ... View more

Testing 123 code ... View more

Hello everyone let me kindly ask you what happens now that this parameter is deprecated (at least on last version 6.3.3)? Could not find anything to replace it - while it raises a Warning into the XML editor best regards Altin ... View more