Hi there, How can I stop all-time searches from running in the environment either via users or dashboards? Running 7.3.3 so cant take advantage of WLM monitoring yet. Can this be done with search restrictions and roles, in the sense that the search just wont run? Thanks! ... View more

Hi there, How can i get my _internal logs from my Fargate instance of Splunk? Ideally get them sent to CloudWatch or get a copy of them off the instance to a different location? Thanks! ... View more

Hi there, I have a dropdown input and a multiselect input. I want whatever I select on the dropdown to be "added" to the multiselect input. EG - if i select car type "Tesla" from my dropdown - i want it to then say "Tesla" in my multiselect. If i go back to the dropdown and select "ford", i want it to add that to the multiselect as well - so in the multiselect i would then have both cars listed. Anyone know how to achieve this with tokens? Thanks! ... View more

Hi there, I have a dashboard with 3 dropdown inputs and a text box. I am trying to get whatever i select from the 3 dropdown boxes to appear in the adjacent text box, essentially just appending the tokens to the whitespace and only running when they appear in that box and i hit "submit". The selections from the dropdown need to be in " ". I also want it to then clear previous selections if i go back and change one of the dropdowns again. Has anyone got any thoughts on how i could achieve this? Currently this almost works - i just need to figure out the append part properly: <fieldset submitButton="false"> <input type="dropdown" token="mainSection"> <label>Main Section</label> <fieldForLabel>MainSection</fieldForLabel> <fieldForValue>MainSection</fieldForValue> <search> <query>| inputlookup bla.csv | fillnull value="(empty)" | fields MainSection | dedup 1 MainSection</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="subSection"> <label>SubSection</label> <fieldForLabel>SubSection</fieldForLabel> <fieldForValue>SubSection</fieldForValue> <search> <query>| inputlookup bla.csv | fillnull value="(empty)" | search MainSection="$mainSection$" | fields SubSection | dedup 1 SubSection</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="dataLine"> <label>DatalineName</label> <fieldForLabel>DatalineName</fieldForLabel> <fieldForValue>Dataline</fieldForValue> <search> <query>| inputlookup bla.csv | fillnull value="(empty)" | search MainSection="$mainSection$" | search SubSection="$subSection$" | fields DatalineName Dataline | dedup 1 DatalineName</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <eval token="chosen_dls">$chosen_dls$." ".$dataLine$</eval> </change> </input> <input type="text" token="chosen_dls"> <label>selected</label> </input> Thanks! ... View more

Hi there, I am trying to do a POC on a single instance of Splunk to take some data that was archived(so its just the journal file). I want to get this in to SmartStore to use as warm buckets - any thoughts on how I can achieve this? I thought about trying to thaw the data and rebuild the tsidx then copy it using splunk to s3. Has anyone done anything like this? Thanks! ... View more

Hi there, I have a table and I want to send the entire set of table results to another dashboard or page on the click of a button..is there a way to achieve this? Kinda like a "select all rows" thing using a checkbox at the top or something? I have this for single selection values from another question I posted recently,however my JS skills are non-existent, so im not sure how to approach this. Is it possible with simple xml? Any thoughts? Thanks! ... View more