I'm trying to work out how I execute a saved search / report using the REST API.  I have created the token and have all the correct permissions.  An "inline" search in the curl command works and returns the required search results, however I have not been able to successfully get a saved search / report to run. I know that my saved searches reside in $SPLUNK_Home/etc/users/[user]/[app]/local/savedsearches.conf and I can see the required search of "LV - WiFi Users" in the .conf file.  My problem is how to reference that in the curl api call. I'm executing: curl -s -k -H "Authorization: Bearer [key]" "https://[splunk_host]:8089/users/[user]/[app]/local/?output_mode=csv" --data-urlencode search="savedsearch \"LV - WiFi Users\"" and results in "The requested URL was not found on this server." error. Does anyone have any hints on how I can execute the "LV - WiFi Users"  saved search using a curl API call? Thanks ... View more

How can I remove the "Open in Search" (search magnifying glass) icon/option from a panel in a Dashboard Studio dashboard? I know how it's done in the Classic dashboard, but cannot work out how to do it in Dashboard Studio. Thanks ... View more

I have a field returned with some search data that contains a date and time in UTC.  I would like to be able to add 10 hours to the time. a) Field contents(dateTime UTC):  2023-05-08T00:24:37.6079338Z b) New field (Local dateTime):         2023-05-08 10:24:37.607 Is there a way to do the conversion from a) to b) in the search syntax? ... View more

I'm trying to exclude a specific file called catalina.out in /var/log/tomcat9/ from being processed by Splunk.  The file is being sent to my heavy forwarder and I have the following in inputs.conf  [monitor:///var/log/tomcat9] blacklist=(catalina\.out) disabled = 0 The data continues to be processed.  What am I missing? ... View more

How do I take the results of a search pass a field into a dbxquery and then display results from both the search and the dbxquery? In this example, the search returns data about specific emails where the sender domain is found in the csv file lookup.  I then want to take the Sender email address, use it in the WHERE clause  of the dbquery to return the accoutname field from the db.  Then finally, display various fields in a table including results from the search and the field returned by the dbxquery select.   index=email Act IN ("Acc") Sender!="*mydomain.com" [ | inputlookup susDomains.csv | stats values(domain) AS search | format ] | eval senderEmail=split(Sender,"@") | eval senderDomain=mvindex(senderEmail,1) | eval acctCode=if ((acc="CAU3A274"),"Admin","Manager") | eval SQLRcpt = "'".Rcpt."'" | map search="| dbxquery query=\"SELECT accountname FROM [IDM].[drip].[usr_hist_tbl] uht WHERE uht.mail = $SQLRcpt$ ; \" connection=\"Subscriber_History\"" | table _time,senderDomain,Sender,Rcpt,Subject,acctCode,accoutname,SQLRcpt | sort -_time   This search returns no data when I know there are records that should be returned. Can anyone see where I may have gone wrong? Thanks Leigh ... View more

I have a data source that is being ingested into Splunk using a default field extraction which is working fine.  The data looks like:   DateTime=2020-11-24-10.38.00.869407,type=New-Request,Username=9999999,Client-Mac=F8-4E-73-xx-xx-xx,Called-Station-Id=A0-D3-C1-zz-zz-zz,SSID=myWiFi,NAS-IP=192.168.141.130,Nas-Identifier=CISCO_AP:CN3AD338P5,NAS-Port-Type=Wireless-802.11,Campus=SMB,Location=SMB Buildings HI   The data is being parsed correctly and I get the field name / value pairs in Splunk no problem (field_name=value).  The issue I have is the last field, Location. The default field extraction is extracting the Location field however if the value contains spaces I am only getting up to the first space as the value in the indexed data.  From the above example, my Location data is returning "SMB" only and not "SMB Buildings HI".  Is there any way to resolve this to either prevent it splitting the value at the space, or to replace the space with another character such as '_'. ... View more