Thanks r. I didn't try your solution, but another colleague got it working with the following configuration.     ../etc/system/local/outputs.conf [indexer_discovery:first_cluster_label] master_uri = https://mm.mm.mm.mm:8089 passSymmKey = $asdfasfasdfasfasdfasdfas= . . . [indexer_discovery:second_cluster_label] master_uri = https://nn.nn.nn.nn:8089 passSymmKey = $zxcvzxcvzxcvzxcvzxcvzxcv= . . . [tcpout:FirstClusterName] autoLBFrequency = 30 indexerDiscovery = first_cluster_label . . . [tcpout:SecondClusterName] autoLBFrequency = 30 indexerDiscovery = second_cluster_label . . . [tcpout] defaultGroup = FirstClusterName . . . ../etc/apps/Splunk_TA_aws/inputs.conf [aws_sqs_based_s3://First_SQS_S3_Import] # Uses defaultGroup. . . . [aws_sqs_based_s3://Second_SQS_S3_Import] _TCP_ROUTING = SecondClusterName . . .         ... View more

I received the above error when attempting to connect to a Microsoft SQL Server database in an Amazon RDS.  Adding a Key/Value of TrustedServerCertificate = true in "Connection Properties" allowed it to work. ... View more

|spath handles both JSON and XML. |makeresults |eval _raw="<a>1</a><a>2</a><a>3</a>" |spath path=a output=a ...or just |makeresults |eval _raw="<a>1</a><a>2</a><a>3</a>" |spath   ... View more

Here's another (late) solution. | makeresults | eval test="abc5defgHijk" | eval session=substr( replace(test,"^.{3}\d",""), 1, tonumber(replace(test,"^.{3}(\d).*","\1")) ) |fields session   ... View more

The following is a subset of a larger solution I came up with to anonymize and re-index some previously ingested events while maintaining their original index, sourcetype, source, host, and _time fields. Create a set of index-time props and transforms that: Separately assign each event to their own index. Restore default summary sourcetype of "stash". Remove the pre-pended index name from each event. Then pre-pend a target index name to each event record before calling |collect with a sourcetype matching the stanza from your props.conf (and which is reverted back to "stash" to not count against license).   #Index time props.conf [per_event_summary_index] TRANSFORMS-set_summary_index = reset_index, reset_stash_sourcetype, remove_prepended_field #Index time transforms.conf [reset_index] DEST_KEY = _MetaData:Index REGEX = (.*?), FORMAT = $1 [reset_stash_sourcetype] DEST_KEY = MetaData:Sourcetype FORMAT = stash [remove_prepended_field] INGEST_EVAL = _raw=replace(_raw,".*?,","") ```Send events to separate summary indexes based on OS.``` index=A |eval _raw=OS.","._raw |collect sourcetype=per_event_summary_index     Three years too late for your use but maybe it will help others. ... View more

A little testing showed that edit_local_apps may do it. ... View more

Hi PickleRick, I greatly appreciate the feedback.  I've gained just enough experience that I want to start contributing back, so no offense taken. By "source" I had in mind a specific, dated, application log which, in our environment, is quite constrained. Identifying (in our environment) just index and sourcetype would result in a quite broad result set. I saw your solution, but took the poster's question as a desire for the couple of specific events immediately before and after the found event rather than a range of who-knows-how-many around its _time stamp. If I had written my answer like the following, would it have been more acceptable? index=YourIndex sourcetype=YourSourceType | streamstats count as row | eval r=[index=YourIndex sourcetype=YourSourceType | streamstats count as row | search "SpecificSearchCriterionExpectedToReturnOneEvent" | head 1 | return $row] | where row>=r-1 and r<=r+1 | sort -row   ... View more

Old post, but...  How about this? source=NameOfSource | streamstats count as row |eval r=[search source=NameOfSource | streamstats count as row | search "Search Criterion" | head 1 | return $row] |where row>=r-1 and row<=r+1 | sort -row   ... View more

Thanks, it worked great. Note I had to use an Area Chart to plot dots rather than lines. (Splunk ver 7.3.3) ... View more

It seems that the <input> element's <change> event fires when that object is first rendered, however it's <initialValue> is not set until after this occurs. I found this can be overcame by pre-setting the checkbox token within the form or dashboard's <init> block. The following Simple XML then uses "eval" and "match" to catch the change conditions and sets the display tokens to either "true" or null (<unset>). <dashboard> <label>Checkbox with mutiple Values (3)</label> <init> <set token="C">c1,c2,c3</set> </init> <fieldset submitButton="false"> <input type="checkbox" token="C"> <label></label> <choice value="c1">C1</choice> <choice value="c2">C2</choice> <choice value="c3">C3</choice> <initialValue>c1,c2,c3</initialValue> <change> <condition> <eval token="c1">if(match($C$,"c1"),"true",null</eval> <eval token="c2">if(match($C$,"c2"),"true",null</eval> <eval token="c3">if(match($C$,"c3"),"true",null</eval> </condition> </change> </input> <input type="text" token="t1" depends="$c1$"> <label>T1</label> </input> <input type="text" token="t2" depends="$c2$"> <label>T2</label> </input> <input type="text" token="t3" depends="$c3$"> <label>T3</label> </input> </fieldset> <row> <html> <div>C: $C$</div> <div>c1: $c1$</div> <div>c2: $c2$</div> <div>c3: $c3$</div> </html> </row> </dashboard> ... View more