I see you have not added the exact string in the props. Can you just copy the regex string within the "" and then try? I mean try adding: \((?<cve>CVE[\w-]+) ... View more

Even though it's a very crude way, but I think it will get your job done. You may create a lookup file to store the count of users each day by reading the user list files each day (See below) and compare the counts from the previous day in your alert query. | makeresults | eval x="{ 1: tom 2: nick 3: potter 4: aina }" | rex field=yourlist mode=sed "s/\n/|/g" | rex field=yourlist "\{\|(?P<name>[\w\d\s|:]*)\|\}" | makemv name delim="|" | mvexpand name|stats count as x ... View more

If you run the following search at 09:37 AM: index=_internal earliest=-1h@h lastest=now, then earliest time will be: 08:00 AM and latest time will be: 09:37 AM If you run the following search at 09:37 AM: index=_internal earliest=-1h lastest=now, then earliest time will be: 08:37 AM and latest time will be: 09:37 AM ... View more

Please check whether or not you are using the correct serverclass. Perhaps the configuration is not even getting pushed into the forwarder. Hence even if you change on the DS, the FWD still shows the older version. ... View more

Hi @evinasco Please refer to this answer of mine and let me know if this helps. My requirement was a little different but I guess it will serve your purpose. https://answers.splunk.com/answers/749857/how-to-make-a-second-download-button.html#answer-749318 ... View more

Hi @HattrickNZ Please refer to this answer where I have provided an option to download a csv file. I had created this as part of a very similar requirement. See if this helps you. https://answers.splunk.com/answers/749857/how-to-make-a-second-download-button.html#answer-749318 If you think this is helpful and you need help in implementing this, do let me know. ... View more

Did it help? Were you looking for anything else? ... View more

Hi @jsmorgan1it, you can refer to this app for your problem. It has a few examples that may cover it up: https://splunkbase.splunk.com/app/1603/ ... View more

You can try to use CSS for this there is already an attribute given called: background-image for this. Also if you want o make a panel transparent, you can play with the attribute opacity (you can set the value to about .5 to .6 to get a good balance) ... View more

Hi @marxsabandana Please refer this question (the requirements was almost similar) and see if it helps: https://answers.splunk.com/answers/749857/how-to-make-a-second-download-button.html#answer-749318 I have provided an example of csv file. But you can try to change the format to xls and see if that works. ... View more

@bhuvanabala, Does this help? | makeresults | eval time_given="2019-06-20T06:08:40.220082Z" | eval time_given_in_epoch_format=strptime(time_given,"%Y-%m-%dT%H:%M:%S.%Q") | eval time_2_days_from_now=relative_time(now(),"+2d") | eval time_2_days_from_now_human_readable=strftime(time_2_days_from_now,"%Y-%m-%d %H:%M:%S.%Q") | eval breach=if(time_given_in_epoch_format>=time_2_days_from_now,1,0) |table breach ... View more

Hi @randomforests09 You can refer the following links for help in building a custom command: http://dev.splunk.com/view/SP-CAAAFFT http://dev.splunk.com/view/custom-spl/SP-CAAAFG3 What I suggest is, you form the whole query directly in your python script. Then execute the search from the script itself. you will find a few examples here: http://dev.splunk.com/view/python-sdk/SP-CAAAEE5 Do let me know if that helps. ... View more

It does not seem to be a splunk problem. Did you try using an extra pair of "? I mean try to populate your result as: ""1, john St."" instead of "1, John St." See if that helps.... ... View more

Ohh okay. I see. you are actually using the result of the search which is run by the dashboard, instead of triggering it through JS. Swell!!!! ... View more

If you had removed the startSearch, then how are you triggering the search? ... View more