As per my understanding, You need the panels to be hidden and it needs to be display when you click on specific row or column value. From your first panel - Edit drilldown -- Manage tokens on this dashboard - Speicfy/update token values. <drilldown> <set token="sample">$row.fieldname1$</set> </drilldown> In your second panel - pass your token like below <row depends="$sample$"> <panel id="myStylings"> <title>Webservice Errors Summary</title> <table> <search> <query> index=A sourcteype=B fieldname1=* </query> <earliest>@d</earliest> <latest>now</latest> </search> </table> </panel> </row> Let me know if it helps. ... View more

Typically yes!!! Editing the transforms.conf file is the only option. ... View more

I am pretty sure they enabled CIDR (match_type) option in recent versions (7.0+ versions) of splunk. We cannot apply CIDR (match_type) in 6.5 version through UI in Advanced options. ... View more

Please check the permissions for your macro "fidelis_get_xps_event". There is a case if the macro is not shared with "All apps" and if you are trying to use the macro somewhere in another application then you will get the Error in SearchParser. Settings » Advanced search » Search macros » » Permissions Change the Permission of macro to All apps. ... View more

"You can try editing the savedsearches.conf ofinvalid user, cut the stanza and paste it in the valid user ".. If the orphaned report has not been shared with other users, it is defined entirely within the savedsearches.conf file at the user level. Cut the stanza for the search out of the savedsearches.conf file for the invalid user and paste it into the savedsearches.conf file for a valid user. In the filesystem of your Splunk deployment, open the the savedsearches.conf file for an invalid user at etc/users//search/local/savedsearches.conf. Locate the stanza for the orphaned scheduled search and cut it out. Save your changes to the file and close it. Open the the savedsearches.conf file for a valid user at etc/users//search/local/savedsearches.conf. Copy the search stanza that you just cut to the savedsearches.conf file for the valid user. Save your changes to the file and close it. Restart your Splunk deployment so the changes take effect. ... View more