It is either/or. Either you allow GUI changes and NEVER EVER use the Deployer to push, OR you use the Deployer to push and NEVER EVER allow GUI changes. ... View more

@brywilk_umich - Glad that you were able to find the help you needed via doksu, Splunk Support, and yourself. Please click "Accept" for this answer provided by doksu to close out your question and so it can be easily found by other users that have the same issue. Thank you. ... View more

Perfect! Thanks! ... View more

that worked, thanks a bunch! ... View more

Since $ is a special character used for tokens in dashboards, you need to escape it by using 2 $ signs. LIke this ( (index=radius sourcetype=radius src_ip=$ip$) OR (index=collaboration) OR (index=google) ) | lookup dnslookup clienthost as src_dns OUTPUT clientip as x_src_ip | eval xx_src_ip=src_ip | eval src_ip=coalesce(xx_src_ip,x_src_ip) | iplocation src_ip allfields=true | sort -_time **| rex field=user mode=sed "s/@email.edu//g" | ldapfilter domain=email.edu search="uid=$$user$$" attrs="InstRoles"** ... View more

Another alternative index=collaboration tag::host=inbound [search index=collaboration tag::host=inbound mail_sender=email_address@umich.edu | fields simta_id] | transaction simta_id | replace *.google.com with google.com in domain_name| stats avg(duration) as "Average Duration" by domain_name ... View more

Never mind I did a stats on Available and based the percentAvailable off of that..... thanks again! ... View more

Hi @brywilk_umich This Answers post asks a similar question to yours, but with a different approach scheduling a report for the 1st day of the month on the previous month's data: http://answers.splunk.com/answers/3280/cron-schedule-for-saved-search-on-last-day-of-month It refers to using cron scheduling from this documentation: http://docs.splunk.com/Documentation/Splunk/6.1.2/Report/Schedulereports#Specify_a_cron_schedule_for_report_delivery Hope this helps 🙂 Patrick ... View more

Try the updated answer. The condition is added in the middle (subsearch after "eval shouldShow...") ... View more

I updated the answer and added max=0 to the join command. This should fix the problem, I hope. ... View more

Thanks @kristian.kolb ... View more

The simpler way to accomplish almost the same thing (if it's just for presentation purposes) is; ... | stats values(ipAddr) by username that's it. The values(field) function give you the distinct values for the field. The list(field) function would give you all values for the field (including duplicates). /K ... View more

If you looked at the linked docs, it shows an example that may be useful for finding things out in one search and use it in another. Assuming that you already have extracted (in props.conf) the fields discussed above, the search would be something like; sourcetype=blah Auth [search sourcetype=blah 21_ubl | dedup userid | fields + userid] | stats values(ipAddr) by userid The inner search gets executed first, and returns the distinct userid s (from 21_ubl log lines), and this gets added to the outer search, so that it now reads; sourcetype=blah Auth (userid=user1 OR userid=user2) /k ... View more