Escaping prevents using a single <set token> to set multiple values on a multiple select box . You need to use <set token> multiple times for each value to be set. ( https://community.splunk.com/t5/Dashboards-Visualizations/pass-multiple-values-to-multiselect-box-from-radio-input/td-p/531079 )  ... View more

well done HansK ... View more

Check the error logs for datetime.xml for a hint. ... View more

Lots of good technique in here. Thanks for the post! ... View more

Sorry I just saw your question @manekar As to what the hostname is for https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Alertactionsconf Sets the hostname used in the web link (url) sent in alerts. So you would put the search head server name. Can you try that? ... View more

Use values mapping. E.g. : <index and filter> | xmlkv | search "ns0:ApplicationFunction"=NotifyBusinessPartnerUpdate_Update_1 | eval dynvalue=case(ns0:Code="value1","label1", ns0:Code="value2","label2", ....) | timechart count by dynvalue ... View more

Also, as a test, I removed the blacklisting event and I got this event from multiple servers. ... View more