Hi All I wanted to build a dashboard that displays some panels only depending on the selection for the drilldown. My approach was the following, but for some reason the condition match is not generating any tokens. Thanks in advance for your help! ... <row> <panel> <chart> <search> <query>index=myindex | timechart count by type</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <drilldown> <condition match="$click.name2$ == type_1"> <set token="mytoken1">true</set> <unset token="mytoken2"></unset> </condition> <condition match="$click.name2$ == type_2"> <set token="mytoken2">true</set> <unset token="mytoken1"></unset> </condition> </drilldown> <option name="charting.chart">line</option> <option name="charting.drilldown">all</option> <...> </chart> </panel> <row> <panel depends="$mytoken1$"> ... </panel> </row> <row> <panel depends="$mytoken2$"> ... </panel> </row> ... View more

Hi, We have the problem that we want Splunk users to be able to change existing CSV files, but every time a user with a user role wants to change a field, the editor returns the forbidden-error, even if the user created the file. So far I tried fidgeting with the rights of the path and the specific file, but without any effect. Is there some configuration wrong or is there a way to achieve this? Best regards, Verena ... View more