We have created reusable macro which was used in many reports with 3 parameters and that macro is starting point of query. one parameter takes Month (i.e 02/01/2017 ...) from filter. Now i got requirement where i need to provide current month/previous month to macro as parameter . Since query begins with macro i unable to create eval expression . query: |eval month = strftime(now(),"%m/01/%Y") | 'ADForecast("$Domain$,month)' since ,we cannot start a query with eval i unable to pass current month. please suggest how to pass current month. ... View more

How do post-process searches work in Splunk? In my dashboard there are 4 panels. Around 3-4 sub searches are repeating in every panel which resulting performance issue and dashboard not displaying any data. Using Post-process searches will be helpful in my scenario. Or else please suggest other alternatives. ... View more

We are looking to integrate share point list data to splunk. SharePoint list data will update daily. So we need a mechanism where splunk automatically detect share point data and update in splunk ... View more