@PrewinThomas , yes that the correct way. I was able to figure it out yesterday 🙂 <form version="1.1" theme="dark"> <label>Health Log Source Analysis</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="multiselect" token="selected_index" searchWhenChanged="true"> <label>Select Index(es)</label> <choice value="*">All</choice> <fieldForLabel>index</fieldForLabel> <fieldForValue>index</fieldForValue> <search> <query>| rest splunk_server=local /services/data/indexes | fields title | rename title as index | sort index</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <table> <title>Index and Sourcetypes</title> <search> <query>| tstats values(sourcetype) as sourcetypes dc(host) as hosts_count dc(source) as sources_count where index IN($selected_index$) by index</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> that's the query I used which worked. ... View more

Do you mean to say pie chart is not showing labels on smaller slices?  This is what I get when I really press down both graph size and smallest slice. (0.41% is currently the smallest.)  Yes, outward labels for smaller slices have disappeared.  But each slice is still present; if I mouse over them, their individual labels, values, and shares still show (second screenshot)  This seems to be a sensible use of real estate.  Then, if you have many especially small slices, there will be a limitation as to whether your mouse cursor could land on a given slice.   This is my new emulation | makeresults | eval _raw = "PARAMETER VALUE ASDF 6 XCV 34 ERT 1 TDED 14 GHT 3 GHB 2 BNHJ 57 QWE 17 DDD 9 YYY 8 KLO 7 POL 2 YUO 82 TRYU 2" | multikv | fields - _* linecount | sort VALUE   ... View more

@harshal_chakran @suresh401    One of our salesforce security guys found a workaround that involves modifying a few python scripts under the lib folder. There are two methods, long polling and web sockets. Long polling was applicable to us so we just fixed that. Some information on the usage of proxy settings in aiohttp can be found here: Advanced Client Usage — aiohttp 3.9.3 documentation The fixes can be applied to the TA-sfdc-streaming-api pack and below is what we modified to successfully subscribe via a proxy.   1. Modify /opt/splunk/etc/apps/TA-sfdc-streaming-api/lib/aiocometd/transports/long_polling.py search for one instance of "session.post" and add  ,proxy="http://<proxyip>:<port>" 2. Modify /opt/splunk/etc/apps/TA-sfdc-streaming-api/lib/aiosfstream/auth.py search for two instances of "session.post" and add ,proxy="http://<proxyip>:<port>"     Hope this helps!   ... View more

Hi Harshal, I don't know if this response is needed anymore, but from my experience, I noticed that the only capability that grants this view is the "admin_all_objects". A similar thread can be found here confirming this: https://community.splunk.com/t5/All-Apps-and-Add-ons/What-roles-or-capabilities-are-needed-that-Alerts-will-display/m-p/258018 ... View more

Hi @harshal_chakran, You can set up the tokens in Dashboard Studio from the search results for the Single Value viz - see the docs article on Setting tokens from search results. When you create your search, check the "Use search results or job status as tokens" checkbox: Now once the search runs, you can use a token like this: $search name:result.<field>$ In our case it would be: $Single_Value_Search:result.list_of_id$ Now in your single value drill-down you can link to the Simple XML dashboard using the token: This will link to the Simple XML dashboard with the list_of_id token being set. Cheers, Daniel   ... View more

Can also be accomplished over time by: index=summary sourcetype=stash source IN (Summary_Error_*) | fields + * | bin _time span=1d | eval search_name=search_name+"#"+_time | stats mode(*) AS * by search_name | transpose 1000 header_field=search_name column_name=fieldName | eval type=if(match(fieldName,"(_raw|_time|date_.*|eventtype|tag.*|index|sourcetype|host|info_.*|punct|time*.?pos|search_name|search|search_now|splunk_server.*|linecount)"),"internal","custom") | stats count(*) AS * BY type | transpose 1000 column_name=search_name header_field=type | rename "row 1" AS fieldCount | search search_name!=fieldName | rex field=search_name "(?<search_name>[^#]+)#(?<_time>.*)" | stats max(*) as * BY _time search_name ... View more

does this works for splunk 8.2.0 version? ... View more

Thank you very much for this tip. It doesn't work for me on 8.2.0 in type="multiselect" 😭   ... View more

There is the services/cluster/master/indexes API, but it doesn't return app information.  See the REST API Reference Manual for details. ... View more

See if solution by @niketn helps. After your <panel> add this: .facets-container .viz-facet { height: 100px !important; width: 100px !important; float: left; padding: 10px 0px 0px 0px; }   Also see his response here: https://community.splunk.com/t5/All-Apps-and-Add-ons/Using-trellis-with-simple-XML-extension/m-p/367962/highlight/true#M44501 ... View more

I have executed the python query have the results. The binding response reader results are in bytes and getting the TypeError while writing to CSV Requesting help to export the search results to a CSV file. Quick response is highly appreciated. Thank you ... View more

Hi @harshal_chakranarayan, remember that all the knowledge objects in Splunk are related to sourcetype, so if you have different sourcetypes you cannot use (or it's very difficoult) field extractions, eventtypes, tags, etc...; this means that it isn't a good idea to use different sourcetypes! At the same time, why do you want to put logs from hosts in different indexes? Usually indexes are choosen based on retention policies and access right, eventually based on quantity of data (e.g. large data flows aren't stored in indexes together with few data flows), not other. In other words, Splunk isn't a database and usually logs are stored in indexes which common retention policies and access rights using a limited number of sourcetypes that permits to manage knowledge objects. Logs are searcheable using all their fields like sourcetype host and others. Ciao. Giuseppe ... View more

Thanks, this helped me to resolve this. So my final curl command came in as : curl -k -u <uname>:<pwd> https://<hotsname>:8089/servicesNS/admin/<appName>/search/jobs/export -d search="|inputlookup <kvstoreName>| table field1, field2, field3" -d output_mode=csv ... View more

Hi- I've seen this happen in our cluster master. The best option/way to do this is to go to (on any clustered SH) Settings -> All Configurations -> Reassign Knowledge Objects button. Change the 'Object Type:All' to 'savedsearches' Then click the 'Orphaned' button, wait for it to refresh and then you can bulk re-assign or delete any orphaned saved searches. Warning! Use this tool with care. ... View more

Hi Harshal, The edit_user capability will have the ability to delete the user. You have already granted the capability so no need to add power role. You can control the access via grantable roles in authorize.conf For example: [role_test] admin_all_objects = enabled cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 dispatch_rest_to_indexers = enabled edit_roles = enabled edit_user = enabled grantableRoles = test;admin;power rest_apps_view = enabled rest_properties_get = enabled rest_properties_set = enabled srchMaxTime = 8640000 The user with test role will let me delete the user with test, admin and power role. You can go through splunk doc for further details: https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Rolesandcapabilities Thanks, Lavina ... View more

Hi @harshal_chakranarayan, Have a look at the rest reference sheet for access control configuration : https://docs.splunk.com/Documentation/Splunk/7.2.6/RESTREF/RESTaccess I think you're looking for this endpoint specifically : https://docs.splunk.com/Documentation/Splunk/7.2.6/RESTREF/RESTaccess#admin.2FProxySSO-user-role-map Cheers, David ... View more

I have a certain dashboard listing all Splunk users and what role-capabilities are assigned to them. For which I have used the above mentioned Rest API commands. However the dashboard users are not able to see the results as they don't below capabilities. edit_roles edit_user rest_properties_get search If I assign these capabilities to them, then they can delete/update the user-role information from GUI settings, which I don't want. ... View more

Do you need this for a few specific fields, known up front, or are you looking for a more generic solution somehow? If some specific known fields, I guess something along the lines of below should work. index=* Field_1=* | stats latest(_raw) as F1_raw by index,sourcetype | append [ index=* Field_2=* | stats latest(_raw) as F2_raw by index,sourcetype ] | stats values(F1_raw) as Field_1 values(F2_raw) as Field_2 by index,sourcetype ... View more

I'd suggest cloning the glass table to the beta editor introduced in 4.2.0. When you configure a drilldown, it provides the option to select "Open in new tab": https://docs.splunk.com/Documentation/ITSI/4.3.0/User/BuildbetaGT#Configure_drilldowns The beta framework will soon become the official and only framework, so it is recommended that you begin to use this new framework exclusively. ... View more

Here's a command that should work for KPIs if you have jq installed. I'd recommend to filter with jq rather than trying to process that JSON response yourself: curl -k -u username:password https://example:8089/servicesNS/nobody/SA-ITOA/itoa_interface/service?filter='\{"title":"service_name"\}' | jq '.[].kpis[].title' (Replace "service_name" with the name of the service you want to grab the KPIs from) ... View more

Thanks Giuseppe. I got it now. ... View more

Thanks, this work for me. Yes, I wanted the extraction to include first set of number. ... View more