Yes that would work, and not the issue. I should have specified, this is for the Drag and Drop UI to function. | pivot falls under the "we got it working just fine in SPL". I think we are going to just find a different way to handle this. Thanks you guys! ... View more

But when you build a DM, and add a lookup as an attribute, you can't transform that at all. Are you saying to build a another attribute that transforms the lookup attribute? If so, i can't figure out a syntax that would do that. ... View more

How? It's a value in an attribute of the data model. ... View more

Right but the issue isn't in like a tstats or SPL query, we are wanting to somehow break apart this column to use them as splittable for rows so that each one could get their own row in a Pivot table. ... View more

It's a great idea but I can't get it to execute. Since the value comes from a lookup, and not the actual log i can't figure out how to do an eval on them. Is there a way to do something like the following in an attribute definition? -> |inputlookup labelLookup | eval test=split(label, ";") Or since i have the lookup attribute "label" what would the syntax of an eval expression based on that look like and can I do an eval expression on an attribute that comes from a lookup (e.g. is it for sure "looked up" already before that eval is executed?) ... View more

I could be completely missing it, but at the URL in my post i do not see that button right this second. ... View more

Nice to know on the pager! For my project it was a static document we wanted to output, so i had to not use pagers for anything. ... View more

Update here, once we started customizing CSS with the help of google, we were able to make spectacular dynamic reports with Sideview. Custom fonts, space, margins, everything all now work beautifully within Chome print to PDF and gone are the days of the woeful "PDF Renderer" from splunk. Multiplexer improvements in the latest version also opened up a whole new world of dynamic nature by allowing us to have a static "Overall" section, and then have specific "Per Asset" dynamic pages towards the bottom which were fed by an SPL generated list. Be careful here though to | head X any queries that feed these and to not make the multiplexed code too in depth or you will choke the system. Another good note here is to hang a "NullModule" off the multi-plex which you can then string objects off of to have a multi-faceted page get looped. ... View more

To clarify, i already have the capabilities to say add a new rule to a firewall from within our app. This question is in regards to even the most basic ability to say make a specific statistics table on an app only show up if the right user is logged in. ... View more