@efika wrote: So it seems that the other application is pointed to the var\run\splunk\csv to read the exported files ? One option to tackle your situation is to point the importing application to a different folder and use a cron/scheduled task to read the splunk CSV files, SED the unneeded quotes and write the files to this new folder. The other application runs locally (as does Excel) and we do not allow these local computers to have access to the Splunk server directly.  ... View more

A user clicks the export button from a dashboard and then that file is manually fed into an application that runs on the local computer. Except that application is expecting that all numbers will not be quoted.  As a work-around the users are currently exporting the file from Splunk, opening it in Excel, and then closing/saving as CSV.  Excel seems to automatically resolve the issue during the save by removing all the quotes from numeric fields.  The actual file also includes text columns with spaces that require quotes.  It seems like Excel automatically and correctly maintains the quotes when needed and removes them when not needed. ... View more

Thank you for the reference! I hadn't seen that post yet, but it's not working as expected, or I'm misunderstanding that post, or maybe it's because my problem is with using the Splunk web UI to export the CSV to my local computer. My search doesn't involve the outputcsv command. In any case, the behavior is consistent, if the number contains a decimal then it is quoted. If it doesn't contain a decimal it is not quoted. I think this is related to the UI download behavior itself and maybe I can't overcome it via a change to the search. | makeresults 1 | eval number = 7 | eval decimal = 7.0 | eval never_quotes = trim(decimal, "\"") You'll notice that never_quotes still contains quotes.     ... View more

We have resolved our issue by installing the latest version of the Splunk Python SDK from https://github.com/splunk/splunk-sdk-python. We're still running 3.0.1 on 6.6.2 and everything seems to be OK now. ... View more

This probably doesn't help very much, but we've seen the same issue recently on Splunk 6.6.2 and DBConnect 3.0.1. Everything was working well for ~12 months, but then today we get an error almost identical to your screenshot. We're not sure exactly when the error started occurring for us, but it also seems to be pointing to splunklib.six.moves. We've tried installing the latest version of DBConnect 3.13 but that destroyed our configurations and didn't fix the problem. Reverted to 3.0.1 and restored our configurations (DBXquery command and our identities are working as expected, it's just the Data Lab and Configuration dashboards within the app that are failing. <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="WARN">Traceback (most recent call last): File "/opt/splunk/bin/rest_handler.py", line 79, in &lt;module&gt; print splunk.rest.dispatch(**params) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 149, in dispatch module = __import__('splunk.rest.external.%s' % parts[0], None, None, parts[0]) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxproxy.py", line 6, in &lt;module&gt; from settings import Settings File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/settings.py", line 10, in &lt;module&gt; import splunklib.client as client File "/opt/splunk/etc/system/bin/splunklib/__init__.py", line 18, in &lt;module&gt; from splunklib.six.moves import map ImportError: No module named six.moves </msg> </messages> </response> ... View more

That's clean! Here's a small enhancement: | foreach * [eval <<FIELD>>=if(mvcount('<<FIELD>>')>10, mvappend(mvindex('<<FIELD>>',0,9),"..."), '<<FIELD>>')] This will display the first 10 values and if there are more than that it will display a "..." making it clear that the list was truncated. ... View more

I downvoted this post because sadly this does not work as expected. bins=1000 means that splunk will determine some arbitrary number of bins that is less than 1000. ... View more

Worth noting that in Splunk 6.5.2 there is a typo. When you edit the lookup it says: "Max Matches: Enter a number from 1-1000 to specify the maximum number of matches for each input lookup value. If time-based, default is 1; otherwise, default is 1000." This seems to be incorrect in 6.5.2. It is still defaulted to 100. ... View more

DBX still has a default maxrows = 100,000. If you want to overcome that limitation and return 100,001 rows, use the parameter 'maxrows' like this: '| dbxquery maxrows=100001' ... View more

Note, that if your saved-search is a scheduled report, then the and tags do not apply in the dashboard -as far as I can tell anyway. All of the data created by the scheduled search over the scheduled time-period is displayed. If you remove the schedule from the saved search, then the "earliest" and "latest" tags will be applied in the dashboard as described above. ... View more