This may be an answer 6 years later (almost to the date), but thought I'd post for future visitors. I was searching this today and found some info in Splunk dev docs: Splunk Dev - Manage access to a custom search command in Splunk Cloud Platform or Splunk Enterprise  Not sure if .meta allows all commands to be controlled via the stanza like in the original question, but each command can be added using the following: [commands/command_name] access = read : [ * ], write : [ admin ] export = system Seems like it requires a stanza per command and doesn't allow mass command sharing.  The comment from MuS seems to be the other option for mass sharing, but exports all objects in the app. ... View more

Hi @splunker1981, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

hope this helps, I build out my dashboard panels and then, I edit the XML and remove  </panel> </row> <row> <panel> between the panels I want to stack into into one panel. i am on- 8.2.0 ... View more

Try mvexpand on po_id so you can lookup against each value separately ... View more

@jacobevans nailed it. ... View more

Hi splunker1981, if you're satisfied by this answer, please accept and/or upvote it. Bye, see next time. Giuseppe ... View more

Hi there, Give this a shot : index=A OR index=B | stats values(contact) as contact values(index) as index by e_id | search index=A AND index=B That will give you contacts that have their e_id in both indexes. Add the other values you need after the stats. Cheers, David ... View more

There may be a better way to do this but I think this works. | eventstats count as T1count by T1 | eventstats count as T2count by T2 | eventstats count as T3count by T3 | eventstats count as T4count by T4 | eval T1 = T1."!".T1count | eval T2 = T2."!".T2count | eval T3 = T3."!".T3count | eval T4 = T4."!".T4count | stats values(T1) as T1values values(T2) as T2values values(T3) as T3values values(T4) as T4values | rex field=T1values "(?<T1>.*?)!(?<T1_count>.*?)$" | rex field=T2values "(?<T2>.*?)!(?<T2_count>.*?)$" | rex field=T3values "(?<T3>.*?)!(?<T3_count>.*?)$" | rex field=T4values "(?<T4>.*?)!(?<T4_count>.*?)$" | table T1 T1_count T2 T2_count T3 T3_count T4 T4_count ... View more

@splunker1981 Apology for a delay in reply. Can you please share more information regarding your search and samples? ... View more

That worked, thanks! ... View more

This partially works, I think. rec values populate but the fields and values that should be returned by the script never actually come back when run inside the appendpipe. Is there a way for that? ... View more

Right, I've just showed you an example of how to make that happen. You use the time picker to pick the WHOLE time range, both hours, and feed it into earliest=$timepickerEarliest$ latest=$timepickerLatest$ then split it into first-half and second-half by using addinfo and calculating the midpoint. If you absolutely HAVE to have the time-picker picking only the later of the two ranges, then you'll need a macro that will recalculate the desired value for earliest based on macroDesiredEarliest=($timepickerEarliest$+$timepickerEarliest$-$timepickerLatest$) Of course, you could just have a single timepicker for the start of the second hour,then use the macro to calculate earliest=$timepickerValue$-1440 and latest=$timepickerValue$+1440 . ... View more

thanks for the reply, made some updates to the question, hopefully that clears things up ... View more

Hi @splunker1981 - Did one of sundareshr's updated queries help answer your question? If yes, please don't forget to click "Accept" to resolve this post. If no, please leave a comment with some feedback. Thanks! ... View more

There shouldn't be a reason why when the span is 7d, there should be groupings of dates which are not 7 days apart, unless month end is playing a role for the dates 11/01 groupings to show up even though previous grouping of 10/28 is not 7 days apart. Somesoni's answer actually tricks all the time values to get assigned to as one of the two values and should work then. ... View more

See if the following generic option helps. You can ignore everything up to foreach, as this is what I used to replicate your issue in my lab. | stats count | fields - count | eval _raw = " { \"oderNumber\": 23994, \"orderDelay\": 120, \"orderedDate\": \"2016/03/01 18:47:22\", \"processedDate\": \"\", \"orderDetails\": \"Account:11111, AccountName:1111-xxx, OrderIpAddress:1.1.1.1\", \"orderProcessor\": \"user\", \"orderErrors\": \"\", \"acknowledgedErrors\": \"\", \"orderId\": { \"value\": 97655 } } " | spath | foreach * [ | eval temp = split('<<FIELD>>', ",") | eval size = mvcount(temp) | mvexpand temp | rex field=temp "^(?<key>[^:]+)\s?:\s?(?<value>.+)$" | eval {key} = if (size > 1, value, null()) | fields - key, value, size, temp ] | stats first(*) as * by _raw ... View more

You da man, that did the trick. Thanks! ... View more