I ended up (for now) using the epoch time available in the native $value$ token in dashboard studio.  I then pass that epoch valie to a hidden table to search for the jira ticket number.  When that completes and populates another token using the search results it opens a hidden markdown box that then allows the user to click it to be redirected to Jira with the ticket number in the URL so they can go straight to that ticket.  Its a little hokey but its working for them for now until I can find an alternative. ... View more

Using the EPOCH is something I have been testing out. ... View more

Because we want to control all content that is created.  To also prevent wasting resources and impacting overall performance.   Running searches for discovery is fine but anything more we want to prevent where possible. ... View more

Thanks so much.  This worked perfectly! ... View more

Awesome!  thanks for the quick fix! ... View more

Settings are defaults: max_cache_size = 0 minFreeSpace = 5000 eviction_padding = 5120 So, if I am reading and understanding this correctly.  Cachemanager will use the entire 15tb use for homePath and only start evicting buckets using the sum of minFreeSpace + eviction_padding = 10120 MB (roughly 10gb of free space left)? ... View more

Tracking.  I have 6 clustered indexers and roughly 300gb per day (right now) of ingest. ... View more

interesting approach and thanks for providing it!  I came up with multiple solutions for the deferent scenarios we have.  We have some 9.4.0 right now we are testing and some 9.3.1 which will be upgraded to 9.3.2 soon. If there was a single value panel in a row by itself I just updated the CSS to change the width of the entire row vs just the width of the panel by giving the row an id instead of giving the single value panel and id.  #panelid { width: 30% !important;} --this works in 9.3.1 but not in 9.4.1 #rowWithPanel { width: 30% !important;} --this works in 9.4.1 and 9.3.1 If there were two single value panels in a row that we needed to adjust the width of I used the below.  I wrote it two ways so that it would work in all our environments that currently have v9.3.1 and 9.4.0. #panelid1 { width: 15% !important; --this works in 9.3.1 but not 9.4.1 flex-basis: 15% !important; --this works in 9.4.1 but not in 9.3.1 } #panelid2 { width: 25% !important; --this works in 9.3.1 but not 9.4.1 flex-basis: 25% !important; --this works in 9.4.1 but not in 9.3.1 }   ... View more

Here is the JS.  I gave the input id="user_name". require([ "splunkjs/mvc", "splunkjs/mvc/simplexml/ready!" ], function (mvc) { // get default token model var tokens = mvc.Components.getInstance("default"); var user_name = document.getElementById("user_name"); // Set required style if init value is undefined to channel if (tokens.get("user_name") === 'Enter a User') { user_name.classList.add("required"); } // Dropdown change on channel tokens.on("change:user_name", function (model, value) { if (value === 'Enter a User') { user_name.classList.add("required"); } else { user_name.classList.remove("required"); } }); });   Here is the CSS again just to capture it all in the same reply. .required button{ border: 2px solid #f6685e !important; }   I use this code (more or less) on other dashboards to perform the same "required" function on other inputs like drop downs and it works by creating a red outline around the drop down until a choice is made.   ... View more

I am using Splunk version 9.3.1 and I get the same results using your example.  A red border around the entire panel and not just the text box itself.         ... View more

For anyone following/interested.  I had to perform the migrate kvstore commands twice to get to version 4.2.17.  Not sure why but the initial run gave the same output as the answer except this line: "Created version file path=/opt/splunk/var/run/splunk/kvstore_upgrade/versionFile40".  Upon running it a second time I got the correct output: "Created version file path=/opt/splunk/var/run/splunk/kvstore_upgrade/versionFile42"       ... View more

I have no "unset" configured for that token so I don't believe so. ... View more

@jaxjohnny2000 Did you ever get clarity on your issue?  I am have the same problem.  I need to migrate about 8 months worth of data (buckets) from one indexer cluster to another indexer cluster. ... View more

I should have included this in my question but I have the below in server.conf, inputs.conf, outputs.conf and web.conf.  I don't have access to the system today but I am not sure where SSLv2/v3 would come from then?   sslVersions = tls1.2 cipherSuite = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:AES256-GCM-SHA384   Also, we are at version 9.0.3 ... View more