Trying to collect my AWS data using on-prem splunk instance. I need to go via a proxy to access anything on the internet sts.amazon.com etc for example. I've added proxy settings to the environment and splunk-launch.conf which seems to do the trick for most other apps and I can get my newrelic data and can see the access via the proxy. For the AWS app if I leave the app specific proxy config blank I can't add any account because it appears to be ignore the global proxy settings and trying to go direct when I click add. If I configure the App specific proxy with the same settings as the system (except for the no proxy list because there is no setting for that) I can't even get to the account add screen because it is trying to proxy the call to the localhost:8089 mgt port. Anyone know how to configure it to make it work?   Thanks ... View more

In a dashboard I'm trying to drive several charts off a single query and use post process search to select the fields that I want. The timechart has a "by" clause and I wanted to select fields (columns in this case) for each chart based on the prefix which is the by field followed by a "-". Assuming the by field is an "a" or a "b" I end up with fields like - _time, a-avgcpu,a-maxcpu,b-avgcpu,b-maxcpu I wanted to chart them separately So I tried <query> | fields _time,a-* and <query> | fields _time,b-* For all the charts they just come up empty. Tried the equivalent search outside the dashboard app and it only displays the _time field. Does using the by clause change something fundamental that I've missed to do with result names...is there another way to do this? ( I see from another question that it appears to be possible if there is no by clause, although they are also not using a wild card field selection in that question either) ... View more