Rather than completely disabling sudo, can you allow specific commands for specific users? (This is technically possible - I have done it in the past - it is more a question of whether your security policies would allow you to do it.) ... View more

As a general point, it is better to share data (and SPL for that matter) in a code block (using the </> formatting button). This is because general text is formatted, removing / compressing white spaces, etc. which may or may not be important to get good solutions. ... View more

One situation where this might occur is if you have leading (white) spaces in your string fields. Please can you give examples where this is not working as you would expect? ... View more

Please share the source of your dashboard, particularly the inputs ... View more

Run the search and see if it  is as you would expect ... View more

You don't need double quotes and |s token filter. Try | where workplace=$dropdown1_tkn$ Alternatively, check that the token is being set as expected (temporarily set the title of the input to be the token so you can see it change). Also, do you have an initial value set for the input? ... View more

You can't just use tonumber on a time token and expect it get the internal value for time. You could try something like this though | inputlookup table1.csv | eval start_epoch=strptime(start_date."T".start_time,"%d.%m.%YT%H:%M:%S") | eval end_epoch=strptime(end_date."T".end_time,"%d.%m.%YT%H:%M:%S") | where workplace="$dropdown1_tkn$" | addinfo | where start_epoch>= info_min_time AND end_epoch<= info_max_time | dedup orderId | table orderId ... View more

In order to do time range searches, you probably need to convert your start and end times to internal format with strptime e.g. | eval startdatetime=strptime(start_date."T".start_time,"%d.%m.%YT%H:%M:%S") | eval enddatetime=strptime(end_date."T".end_time,"%d.%m.%YT%H:%M:%S") You then need to do a similar thing to your time_tkn values ... View more

@Praz_123 Please can you provide additional information answering the excellent questions from @PickleRick @gcusello and @yuanliu  ... View more

What is wrong with what you already have tried? ... View more

While you might get an anecdotal answer from the illustrious audience we have here, I feel that you are asking the wrong people. You should be asking your stakeholders what insights they want to be able to derive from their data, what KPIs are meaningful to them, etc. You could spend a lot of time building a dashboard to show, for example, conversion rates of guests to members, or attendance drop off over time or impact of exhibitions on footfall, but if your stakeholders are not interested, your sponsors will get frustrated. Personally, if you don't ger clear direction from your stakeholders, I would start small, with a few charts just to show for example footfall by membership/guest by days of week, show it to your stakeholders and ask them what they found useful, what they didn't find useful, what else they would like to see, what questions they would like to be able to answer. Good luck! It sounds like an interesting and exciting project! ... View more

Are there any commonalities with the missing events? Do they come form the same source? (e.g. user/host/server/network/process/usecase) Do they come from the same time periods? (_indextime might be useful here.) What else is going on on your system(s) when the events go missing? ... View more

Can you determine which logs are "missing"? Are they from the same time period? Are they the same format? Are they the same event types? etc. You could do a bit more analysis to give us some clues as to where your issue(s) might be. ... View more

This is possibly because your definition is not precise enough. For example, I looked at this on a Thursday, so "previous Thursday" equates to a week ago, and "next Thursday" is in a week's time. Please clarify what you want the time range to be on a Thursday, particularly before 10:00, between 10:00 and 12:00 and after 12:00.  ... View more

Try something like this: earliest="@w-3d+12h" latest="@w+1w+4d+10h" ... View more

You can define a datasource, and chained datasource running from the results of the first datasource. This is a bit like base searches in SimpleXML. Note that the first datasource should be a transforming search e.g. containing with a table command ... View more

There was a competition recently encouraging people to submit Dashboard designs, showcasing creativity and complex interactions, only it had to be in Dashboard Studio. I tried "porting" my favourite, most interactive dashboard from SimpleXML to Studio, but I was unable to find a way to replicate everything I had done with SimpleXML in Studio. Perhaps I didn't try hard enough; the prize was a .conf pass,, but since I am unable to make it this year, there wasn't so much of an incentive, and I have been busy with other stuff (puzzles in Slack, questions for BORE and SPLing Bee, etc.)! 😎 ... View more

From a personal point of view, SimpleXML is preferred over Studio. Conditional handling is one aspect which Studio does not have which SimpleXML does. I find that token handling in general is still better in SimpleXML. There are also other handlers which are easier to do in SimpleXML, and there is better support for CSS and javascript in SimpleXML. Also, Studio is still being developed so you may find you need to upgrade to the latest version to get some features that you need, whereas they are already in SimpleXML. ... View more

Dashboard Studio is under active development. Do you have another version of Splunk available to you that you could upgrade or downgrade to? It could be that you have discovered a bug. If so, you should contact your support team. Alternatively, switch to Classic which is much more stable. ... View more

You should probably sort that out first. If your search is as simple as you have shown, I can't see any reason why you would get that error. If not, please provide more detail on your actual search which is generating this error. ... View more

If Classic is an option for you, then, yes! It is better at handling tokens, etc. ... View more

The only way I can get this to fail in a manner similar to what you have shown is to use a field name that does not exist in the table results, but this doesn't appear to be the case in your example. Please check that the field names used match completely, bearing in mind that field names are case-sensitive. ... View more

Try using a token filter to ensure that the value is compatible with URL formats "url": "https://google.fr?q=$row.correlationId.value|u$",   ... View more

What have you tried so far? ... View more