The only good explanation, including any advanced XML documentation on the Splunk website, is the explanation in the "introduction to the advanced XML" page of Sideview Utils 2.X. It's really quite long though and too long to fit here. You will understand once you read this documentation, trust me. ... View more

ok, so I have figured out why the endpoint gets called more than once. short story: there are calls in the accumulator template that indirectly call the endpoint multiple times long story: In the accumulator.html template there is a call to a generator function (post_option found in eai.py) that makes the call to the endpoint. Each time this generator is called it does a getEntity() call. the generator has this form element['options'] Commenting out the first call results in a single call to the endpoint. The reason I asked this question in the first place is that each of these calls could be expensive, both in terms of doing what ever the endpoint does and the user experience in terms of page render times. Since the call is made twice, and in my case it takes approximately 13s to return results, the user has to wait a minimum of 26s for the page to render (actually it's longer than this but I am not including the time it takes for the back-end to render all the results, button, text inputs, etc.). What I have found through my limited testing is that converting all but the first generator call to use the results from the first call reduces the number of calls to the endpoint to 1 and the setup page still has the same data presented as it should. ie. selected elements are selected when updating an existing configuration. Looks like I need to open an enhancement request to get the number of calls to the generator reduced, if possible. ... View more

so here is a method that I found that changes the namespace to whatever app you want when configuring a new modular input. This applies to custom xml one might use to create a custom modular input page. place the following code within the main <elements> tag and change YOURAPPNAME to the app that the input should belong to <element name="hideme" type="hidden"> <view name="create"/> <view name="edit"/> </element> <element name="__ns" type="select" label="Destination app"> <view name="create"/> <key name="hideUnlessFieldSet">hideme</key> <options> <opt value="YOURAPPNAME" label="YOURAPPNAME"/> </options> </element> ... View more

Search command makecontinuous _time worked. I did not know this command. Thank you. Lp ... View more

Very interesting... What you and chris suggested works for everything I try, except with my specific "field3". The errors I get when trying to use "field3" are what led me to believe the eval replace() function would not accept a field reference for the second parameter, but apparently it does. I'll have to look into what is up with my field3 that is causing the Splunk errors. Marking your answer as accepted, as it is correct 99.9% of the time! ... View more

Way late to this answer but hopefully it will help future searchers. Splunk seems to use hoisting with the rename command. Hoisting is when a variable or expression is hoisted to the top of the current scope and evaluated before anything else. When I was using the rename command it was at the end of my table after my fieldformat commands and resulted in incorrect output. Once I switched the variable names in my fieldformat commands to the renamed variables, my output was correct. ,Way late to this answer but hopefully it will help future searchers. I used the table command with fieldformat to parse my data. I had my rename command after my fieldformat which then resulted in incorrect results. I believe that rename is hoisted similar to how javascript hoists variables to the beginning of their scope before evaluating them. So when I used rename, it was hoisted to the top of the table scope, my variables were renamed and then had fieldformat run on them resulting in incorrect results. Once you use rename you need to use the renamed variables in your fieldformat functions for the data to process properly. ... View more

I think it got updated to 100000 ... View more

Thanks this helps! ... View more

You could possibly use the filldown command on the dataset to "connect" the data on the graph ... View more

I have done the same thing but It is not working. Is there any alternative for this. ... View more