Sorry to dig this up from the past, but I used your advice here and it worked great (specifically the in search version) however, I have a question. My scenario is that I have a dashboard set up to search data based on Userid. We wanted to be able to enter multiple userids into a text box to search. This worked for us, however, say I have 6 users A, B, C, D, E, F and I enter A,B,C in to my search, I get everything for A B and C, but also 1 or two events for D and F, even though I didn't say anything in my query about D or F. Any idea why I'd be getting extra events in my results? ... View more

also, same goes for indexes and transforms so: | rest /services/configs/conf-indexes | rest /services/configs/conf-transforms and then filter however you like ... View more

Try ... | stats count(field), values(field) | ... . If that doesn't solve your problem, please be more specific in your question. ... View more

Indeed, my answer was not complete. Refere to the other answer and follow the three steps after the base search and you should get it working. ... View more

First create searches that will provide the needed information or results to be able to determine the status of the component or service. Next take a look at this App https://splunkbase.splunk.com/app/1923/#/overview and use it together with your search. Try something simple and easy to start with, like Apache status codes. If there are more than 10 x 404 error codes within one minute set the ample to yellow, else it's green. cheers, MuS ... View more