That makes sense.  When you have a change tag, you have to use the condition tag as well to set the token. This could also take the place of your case statement.  Here is what I used as a rudimentary test.  Hopefully it gets you down the road for your solution:   <input type="dropdown" token="span" searchWhenChanged="true"> <label>Granularity</label> <choice value="">Default</choice> <choice value="span=1m">1 min</choice> <choice value="span=15m">15 min</choice> <choice value="span=30m">30 min</choice> <choice value="span=1h">1 hour</choice> <choice value="span=1d">1 day</choice> <change> <condition value="span=1m"> <set token="PivotPeriodAutoSolo">1m</set> </condition> <condition value="span=15m"> <set token="PivotPeriodAutoSolo">15m</set> </condition> <condition value="span=30m"> <set token="PivotPeriodAutoSolo">30m</set> </condition> <condition value="span=1h"> <set token="PivotPeriodAutoSolo">1h</set> </condition> <condition value="span=1d"> <set token="PivotPeriodAutoSolo">1d</set> </condition> <condition value=""> <set token="PivotPeriodAutoSolo">auto</set> </condition> </change> </input> ... View more

Per the Overview here: "We highly recommend that customers either purchase IT Service Intelligence and utilize the Content Library and Content Packs for pre-built service-level dashboards and KPIs, or use the latest version of Splunk IT Essentials Work 4.9 (available May 2021) to monitor host level data. For more details on this announcement and migration options, please refer to our blog post and contact your sales representative with any questions." ... View more

You will have to go into the role settings and make sure that the index you are wanting to search is within the default indexes for the role that you are under: You can see/change this under Settings » Users and Authentication » Roles » < Your Role > » Default indexes The menus are a little different between 7.x and 8.x. In 8.x you will select your role and find the indexes tab. Then choose the index and make sure that "Default" is checked. In 7.x you will scroll to the bottom of the page for your role and make sure that the index you are needing is selected for "Indexes searched by default" ... View more

So, even if the _raw is not truncated, there is still a limit set in limits.conf for KV. [kv] maxchars = <integer> * Truncate _raw to this size and then do auto KV. * Default: 10240 characters What is I believe is happening in your case is that the _raw is being truncated before auto KV, so those fields at the end are not being extracted, Maybe you can increase that and try again? Source: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Bkv.5D ... View more

<base search> | stats count as Count by Region, Disabled | eventstats sum(Count) as Total by Region | eval "State Percentages"=round(Count*100/Total,2) | fields - Total Would something like this work? ... View more

Kind of. There are pipelines and queues that data travels through before it is stored. At a high level, Universal Forwarders are only able to the input layer in that it will read the data and add some metadata to it (like index, sourcetype, source) and then send it to the indexer for the data to go through the rest of the process. So, it's not that it has precedence or is higher priority, it just does that function because the Universal Forwarder can't. If you had a scenario where you were using a Heavy Forwarder, you could perform that functionality on the Heavy Forwarder and the configurations on the indexer wouldn't apply to the data at that point. Some resources: https://www.aplura.com/assets/pdf/props_conf_order.pdf https://wiki.splunk.com/Community:HowIndexingWorks ... View more