How may I automatically generate a file on an on-prem server from the results of a search query ... View more

When editing searches in ITSI, control-e expands macros and control-z undoes the last change.  I know this only by being told.  Where is documentation on these, and whatever other hotkeys are defined for this editor? ... View more

I'm using Splunk ITSI, viewing its Episode Review. When an episode is opened, the episode list is compressed on the left side, and the opened episode displayed on the right side.  When this occurs, In the episode list, a count is added in the left side of that pane.  It displays the number of Notable Events within each episode, unless that amount exceeds 99, in which case it shows "100+".  When an episode is not opened, the count is only displayed if that field is included in those selected for display, but again, if the value exceeds 99, displays "100+". If the count is selected for display in the episode list, AND an episode is opened, THEN in the compressed episode list in the left pane, the count is added on the left side of the pane as before, but the selected count field still displays as well, AND the selected count field NOW displays the actual count values even if they exceed 99.  HOW can I get the actual values exceeding 99 to display when no episode is open? ... View more

My understanding is that the pipe operator is used for OR and ampersand for AND.  I find no NOT operator, and my testing indicates that "field=*" results in no records rather than only those for which "field" is populated.  I need to filter out all records for which a given field is empty.     Is that possible?   ... View more

I'm a newby to both splunk and itsi.  I think I can figure out how to find the fields in a lookup table and in an index, however, despite the name of this thing (itsi_event_management_group_index), it seems not to be an index as preceding it with "index=" yields no results, thus I can't figure out how to determine the names of the fields contained within it.  I've been provided with a query which references some of the fields via the 'stats' command, but... 1) How do I identify all such fields, and 2) what is this thing if not an index or lookup table? ... View more

How can one change the ITSI status of multiple episodes at once?  I need to close numerous old episodes and don't have time to do it individually. ... View more

I'm passing description text for tickets to be created in Service Now, and need to know what to insert in that text to cause a carriage return when it is displayed in Service Now.  I've verified that \n does not work. ... View more

I've "Opened in Search" one of my episode review searches, then typed ctrl-shift-e to view the "expanded search string".  Doing this, I found that the event count, along with other data, was obtained via lookup on itsi_notable_group_system_lookup (among other itsi tables).  I then expanded the search string for one of my notable event searches, but find no indication that this search writes to those tables.  What step(s) am I missing between the notable event search and the episode review search?  I'm trying to determine how the episode grouping is done, which appears to happen between the NE search and the episode review search. ... View more

In Splunk ITSI's episode review, how can I remove the private filters defined by people who have left?  I want to do this because the names of those filters can not be re-used without removing them. ... View more

I have some saved Search Macros which I'd like to delete.  How is this done? ... View more

Is there any way to filter in only episodes for which a given field, not among those in the 'Add Filter' menu, has one of two values, and no others? ... View more