Please tell me why the first test form works, and the second one does not. By works, I mean that they default time picker is set to the value assigned to the num_of_days token. <form script="showtokens.js"> <label>Test</label> <init> <set token="num_of_days">Last 30 days</set> </init> <fieldset autoRun="true" submitButton="false"> <input type="time" searchWhenChanged="true"> <label>Select a time:</label> <default>$num_of_days$</default> </input> </fieldset> <row> <chart> <title>Events</title> <search> <query>index=_internal</query> </search> </chart> </row> <row> <table> <title>Table</title> <search> <query>index=_internal</query> </search> </table> </row> </form> The showtokens.js results are: Token Default Submitted URL $earliest$ -30d@d -30d@d -30d@d $latest$ now now now $num_of_days$ Last 30 days Last 30 days undefined The second test form changes only the num_of_days token to 90 days as follows: <form script="showtokens.js"> <label>Test</label> <init> <set token="num_of_days">Last 90 days</set> </init> <fieldset autoRun="true" submitButton="false"> <input type="time" searchWhenChanged="true"> <label>Select a time:</label> <default>$num_of_days$</default> </input> </fieldset> <row> <chart> <title>Events</title> <search> <query>index=_internal</query> </search> </chart> </row> <row> <table> <title>Table</title> <search> <query>index=_internal</query> </search> </table> </row> </form> However the output from showtoken.js is now: $earliest$ 0 0 undefined $latest$ undefined $num_of_days$ Last 90 days Last 90 days undefined It appears that "Last 90 days" is not a valid choice, but if I try -90d@d I get the same results. It is as if the tokens are not setting correctly, or being interrupted properly. What I am trying to accomplish is to have an input form that is called by several forms that require different default time frames for the time picker. Any advice would be greatly appreciated! ... View more

I would like to have a discussion about the best practices relating to a multi-tenant environment and how to best create access control as well as use off the shelf apps. Background: I work for a company that has 7 subsidiary companies. I am in charge of security monitoring for the entire corporation. We have deployed Splunk indexing and searching at the top corporate level (Linux based). Each of the 7 subsidiaries feed their log data to this centralized Splunk system via intermediate forwarders. Bandwidth is not an issue and this works well. Each of the 7 subsidiaries has their own types of networks and equipment. Some are Windows based, others Linux and Mac. Some use one brand of firewalls while others use different brands. Some of this equipment has apps built by their respective vendors that can be installed on Splunk. In order to provide access control for the 7 companies, I have created an index for each company's data. Roles are then created for the users in those companies and they are restricted to only see the data in their respective index. This has worked great so far, and I have began to build apps and dashboards for them. HOWEVER…. When I go to install an APP such as Palo Alto's app, Cisco's app, or Splunk for *nix apps I continually run into the fact that they are hard coded to use specific indexes. Some of them allow you to change the index in the settings, but I want to be able to use the app against the company indexes that I have defined. I do use the deployment server and have a set of apps that can be deployed depending on the criteria there. I know that I can get right down into the code of the apps and tweak a lot of things, but I worry about the ability to keep upgrades simple in the future. My recent experiences with apps has me questioning whether the separate indexes is a good idea or not. The major benefits of them is that each one can have it's own retention (hot to warm, etc) settings, and that access control is easier. It does not seem that current day apps are designed with this kind of structure in mind. Please share with me your experience and help me understand the pitfalls of the direction I am currently going, or how I can make it more scalable and usable for the various levels. How do you do it? Thanks! ... View more