Hello, I have a dashboard which is using one token - as a result two things happen: a search is conducted on an index with some static data I want to load data from external source (.txt file available online) which changes every hour This is the source:  https://tgftp.nws.noaa.gov/data/observations/metar/stations/KJFK.TXT Desired state: The dashboard takes airport's ICAO code and displays static information about this airport from the index and also loads external current weather information (which changes very frequently). How to load this external data in a dashboard without saving it in Splunk? I would like to state, that I have no option to ingest this data into an index every hour, or create a lookup file locally - this data will change all the time so ideally I would like to fetch it online every time. Many thanks in advance! ... View more

Hi, I have a general question about which commands do you usually avoid in order to make search faster? For example I tend to aviod transaction and join. Instead of join, when possible I try do use lookup. Also in favour of lookup, I try not to use subsearches which use | inputlookup command. What about other commands? What other commands do you avoid to save system resources? ... View more

Hi, I've got a lookup with a number of records, and not all of them have all columns populated. Is there a way to append only those columns which are not empty? Something similar to:   | lookup mylookup lookup_key OUTPUTNEW list of columns to append | <some SPL here to hide columns which are empty>   I'd be grateful for any tips.  I was experimenting with foreach but with no results. Regards ... View more

Hi, I'm searching through the Registry data model and I noticed that in the field "user" I've got process names. How to fix it? As far as I know, after fixing it - so in the "user" field there is actually a user name, I will need to rebuild the whole data model, right? Will I need to take some extra steps if this data model is accelerated? ... View more

Hi, I have a list of all notable events which triggered in X days using this SPL:   index=notable search_name="*Rule" orig_action_name=notable | stats count by search_name     Using this query I can see the list of my all rules which are enabled to trigger notables:    | rest /services/saved/searches | search title="*Rule" action.notable=1 | table title   Obviusly, the second search returns much larger list. I'd like to correlate those two searches to find out which of all the rules did not dispatch a notable in past X days. Any ideas on how to achieve this? ... View more

Hi, when building queries I'm all for their clean look and readability - of course performance always matters more. But I have this case in which I want to exclude lots of usernames from my search: username!=Johndoe username!=Mikesomeone username!=Jennifersomeoneelse but this looks much shorter and cleaner: NOT username IN (Johndoe Mikesomeone Jennifersomeoneelse) I've been using a lot the "field IN (value1 value2 value3)" but only today I've started using it with the NOT operator. Unfortunately, after I press CTRL+SHIFT+E in the query editor, I see that this shorter "NOT value IN ()" is transformed to NOT user=xxx NOT user=yyy ...etc As far as I know this is not the same as user!=xxx AND user!=yyy and returns more results which I need. Is there a way of a shorter query to do the same as explicit exclusion of multiple values from one field? I've looked through similar topic: https://answers.splunk.com/answers/48398/how-to-exclude-a-list-of-values-for-a-field.html but my case is not covered there. I'll appreciate all help. ... View more