Excuse my super late reply. Below may help those who arrive here after me. Be careful to check that your html is referencing your stanza name - not your app name.  <splunk-search-dropdown name="action.[stanza_name].param.[param_name]"...   Below is how to extend the "logger_app" example in docs to add a dropdown. User's choice is sent to script. logger.html <form class="form-horizontal form-complex"> <p>Write log entries for this action.</p> <splunk-search-dropdown name="action.logger.param.mychoice1" search=" | inputlookup alert_action_dropdown1.csv | stats c by foo1" value-field="foo1" label-field="foo1"/> </form> alert_actions.conf [logger] is_custom = 1 disabled = 0 label = Log alert action description = Custom action for logging fired alerts icon_path = logger_logo.png param.mychoice0=This param is hardcoded. Look, I can use a token: $result.host$ #param.mychoice1=This param comes in from your stanza in savedsearches.conf. #savedsearches.conf: action.logger.param.mychoice1=User picks from the UI. See logger.html Output in test_modalert.log  then looks like: ...</search_name> <configuration> <stanza name="test_alert_action_logger_with_added_dropdown1"> <param name="mychoice0">This param is hardcoded. Look, I can use a token: </param> <param name="mychoice1">splunk2</param> </stanza> </configuration> <result>... ... View more

@Hemnaath have you resolved it? I have a similar request, can you guide me on this. thanks ... View more

I am currently using HTTP to trigger the POST request. Does it need to be HTTPS from Splunk Cloud to EnCase? What port (443, 8089)? ... View more

It seems like you are doing the first step correctly of assigning roles to users and setting the proper read permissions of the dashboard to that user role! Now, it sounds like the problem is that you need to route users to the proper dashboard. One way you could do this is to have multiple apps for each of the two users that need to see a specific dashboard when they login. The way I think makes most sense is a work around using the JS Webframework which could be as follows: Create a dashboard3 that is the default for the app. This might have reports to load or might be blank but will act more as a landing page to redirect users to the correct dashboard Using JS referenced in dashboard3 you can get all relevant information about user like user role with this code (http://dev.splunk.com/view/SP-CAAAEJ8#listuser) Then, in your JS code, have the user routed through an http redirect to the proper dashboard I am referencing another answer here (https://answers.splunk.com/answers/126873/how-to-show-different-views-by-the-type-of-user.html) for some of these ideas and links. ... View more

It will require two adjustments: Exclude events in query Changing refresh interval of the query to get you the real-time view. If you don't want launching VM you can exclude that in your base query like: index=yourIndex sourectype=yourSourcetype NOT(launching VM) | rex "^(?<status>[^\s]+) | stats latest(status) by host For the part to get the latest realtime results you can either use real time search or the refresh option of the query, panel or dashboard. See here: http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Aboutrealtimesearches https://answers.splunk.com/answers/483783/define-refresh-interval-for-formdashboard.html#answer-484018 ... View more

<form> <label>Enterprise Sandbox</label> <fieldset submitButton="false"> <input type="text" token="Source1" searchWhenChanged="true"> <default>Source1</default> </input> <input type="text" token="Source2" searchWhenChanged="true"> <default>Source2</default> </input> </fieldset> <row> <panel> <chart> <searchString>[search index=Name source="$Source1$" OR source="$Source2$"| chart count over index by source | eval search=if('$Source1$' &gt; '$Source2$', "index=Name source=\"$Source1$\" Sales_District=\"East\" NOT [search index=Name source=\"$Source2$\" | fields + Name_ID]| table Name_ID", "index=Name source=\"$Source2$\" Sales_District=\"East\" NOT [search index=Name source=\"$Source1$\" | fields + Name_ID]| table Name_ID")| table search ]| table Name_ID</searchString> <earliestTime>0</earliestTime> <latestTime/> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> </form> ... View more