Hey. How did you return the results of the script to Splunk? ... View more

Thank you! ... View more

I would say no one knows what errors would be expected. Unsupported environment, it is very difficult to identify issue if that's because misconfiguration or not. I had several users spent hours to make VMware app on Windows working because old VMware app doc didn't clearly mentioned Windows is not supported. As a result, customer ended up with bad experience because POC tried not supported architecture. So, if I were you, I would not try that route spending more time and potentially makes unhappy user experience. Or, you spend your own time to try it and only if it worked, you show it to user as POC. Basically you do not want to fail on POC. ... View more

Assuming that: 1) trialsField has trials value 2) testsField has test values 3) trialsToken gets set when the value is selected by trialsDropdown 4) testsToken gets set when the value is selected by testsDropdown Try below: This dropdown below populates the list with trialsField and whatever user will select, the value of trialsField will be saved in trialsToken. "All" is kept as default value which will set "*" as a value. <input type="dropdown" token="trialsToken" searchWhenChanged="true"> <label>Trials Lable</label> <search> <query>query that populates the trials list | stats count by trialsField| table trialsField</query> <earliest>earliest time for query</earliest> <latest>latest time for query</latest> </search> <fieldForLabel>trialsField</fieldForLabel> <fieldForValue>trialsField</fieldForValue> <choice value="*">All</choice> </input> Once the value of trialsField is received in trialsToken then this is used in the second dropdown, where: testsPrefix is evaluated from the testsFields i.e. "1" is extracted from testsField="1A" this testsPrefix is matched with trialsToken so you only receive "1A, 1B..." and populate the testsFields Test Lable your Query to bring up the testsFields | eval testsPrefix=substr(testsField,1,1)| search testsPrefix="$trialsToken$"| stats count by testsField| table testsField earliest time for query latest time for query testsField testsField All You can choose the desired substring indexes substr(testsField,1,1) as this one is actually taking out "1" out of "1A" Also testsToken and trialsToken can then be used in other searches as well. ... View more

I had to show events of only one day and I did it in this way: I created a dropdown as this <input type="dropdown" token="day" searchWhenChanged="true"> <label>Day</label> <search> <query> mysearch | dedup myDay | sort -myDay | eval TokenDay=strftime(strptime(myDay,"%d/%m/%Y"),"%m/%d/%Y") | eval sortDay=strptime(myDay,"%d/%m/%Y") | sort -sortDay | table myDay tokenDay sortDay </query> </search> <fieldForLabel>myDay</fieldForLabel> <fieldForValue>tokenDay</fieldForValue> </input> and my search was mysearch earliest="$day$:00:00:00" latest="$day$:23:59:59" | ... Bye. Giuseppe ... View more

Brilliant, the API params change fixed it. Thanks! ... View more