Aloha, We have a 24 column report in a Dashboard and when it is exported as a PDF, the Dashboard is not very pleasing to look at and pages span multiple pages with some pages have one or two columns that could not fit on the previous page and in essence the report is not easy to read without scotch-tape since the previous page's columns contained the required column for identification / correlation. As I understand based on this message thread there is an option to "Attach CSV" in step #6.  Could you please provide information on what/where the Step #6 is or where to find all the related steps to get to the "Attach CSV" option?   Is this custom solution or part of a module, is this applicable to Dashboard PDF export, etc?   Having the option to export as a CSV may be good option especially if it is possible to schedule to export as a CSV instead of as a PDF for Dashboards.   Any thoughts?  Thank you so much for the assist. ... View more

Thanks for replying.  Each cell will have its own lookup file which is the challenge.   We are already able to successfully use one lookup file but the requirement is for each cell to have its own unique lookup file.  Any thoughts?   Thanks. ... View more

Thank you for the response. Each cell will have a lookup file with the details of what made up the value or number of the cell.  For example, if cell A5 or column A row 5 has the number 5 the lookup will contain 1+1+1+2.   Or another example if cell C6 has the value 100 the lookup file will contain 10+10+80, and so on.  There is no other action for the lookup file except to provide details.   Could you please clarify how can a single condition be applied to all unspecified fields/cells?   Thanks again.   ... View more

Rich,  Thanks again for the response.  After reviewing the link to the documentation, it does not (or at least from reading it) the documentation did not include specific situations of having or using <condition> statement i.e. field="Network"> for a specific cell and depending on the cell selected/clicked, drilling down in to it and running another search or going to a lookup file.   Here's a screenshot of the example from the documentation: We've tried setting the token to one column heading name with no luck so far.     As a test we tried defining or setting the token as one cell or $row.col1_PKIenabled$ in this case "col1_Network" is the same field generated/used by the stats command or "mySearch | stats count as "col1_Network".    Below is an example of out the output of the Search.   Do we need to define a token for each possible cell or row/column combination since each cell has it's own target lookup file?   Any thoughts?  Thanks. ... View more

Rich,  Thank you for your response.  Would it be possible to get an example and/or a link to any documentation? Much appreciated.  ... View more

Rick,  Thanks for your post.  Unfortunately your suggestion did not work.     Perhaps this issue can be addressed at the initial ldapsearch instead of trying find the unique records comparing 2 outputlookup files.  The goal is to get a list of only enabled users that are in a specific Security Group FGPP (Fine Grained Password Policy) in AD.    Here is the ldapsearch we're running and unfortunately it is returning DISABLED users as well.     | ldapsearch domain=".com" search="(&(objectClass=group)(CN=*FGPP*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" | ldapgroup | table cn, member_dn, member_name | mvexpand member_name | rename member_name AS sAMAccountName | table sAMAccountName We've also tried this syntax but it did not return anything: | ldapsearch domain=".com" search="(&(objectClass=group)(CN=*FGPP*)(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=2))))" .... .... We suspect the issue could be that the ldapsearch contains 2 objectClass (group and user) because if run the ldapsearch separately for each, it works.  If we can find a single ldapsearch SPL to return only the ENABLED users of the users assigned to the FGPP group, then we would not need to run another SPL to compare the users in the FGPP users against  the list of disabled users and eliminate the need for running the second SPL.  Any thoughts?  Thanks. ... View more

That's awesome!  Thanks!!! ... View more

Each file contains a number of users and each file will have a count.  The Pie chart should include the total count of both files and then the percentages of each file's count against the total.    How do we combine the files to get the total and then show the percentage of each file's count against the total? ... View more

Both inputlookup files have one and the same field name (sAMAccountName) containing user accounts.  What's the inputlookup SPL to reference both files?   Thanks again.  ... View more

Both inputlookup files have one and the same field name (sAMAccountName) containing user accounts.  What's the inputlookup SPL to reference both files?  Thanks again.  ... View more

Rich,  Thanks for your message.  Currently we're able to show separate Bar charts for 2 inputlookup files.   Here's a sample of the SPL: | inputlookup blank.csv | appendcols [| inputlookup ServiceAccountsInOU.csv | stats count AS "Service Accounts in OU" ] | appendcols [| inputlookup ServiceAccountsNotInOU.csv | stats count AS "Service Accounts NOT in OU"] How would we implement your suggestion?   Thanks. ... View more

In case anyone runs into this issue/question. the following ldapsearch returns all records that are Enabled =true.  However the Enabled field does not contain the value "true".   A second or follow-on eval statement to add the value "true" will be needed if this is what your report needs to show.   To see records that are Enabled=false change the "!" to "&" in the userAccountControl string.   For records with Enabled=false use (&(userAccountControl:1.2.840.113556.1.4.803:=2) For record with Enabled=true use (!(userAccountControl:1.2.840.113556.1.4.803:=2) I hope this helps. ... View more

@ITWhisperer wrote: I am not sure I understand. Is this is a third source that you want to lookup and compare or something that is already in one of the two sources you have used already? Sorry for the confusion.  These are same 2 sources.    ... View more

Thank you so much for your reply.   Since this is comparing 2 lookup files, the common field between the 2 files is the userPrincipalName.  However we need to extract the sAMAccountName (which was exported from Active Directory) that contains a userID that have a .sa or .svc at the end of the name.  Any thoughts on how to achieve this? To further clarify the 1st lookup file in the SPL is the file from AD and 2nd file is not.  We've notice the 1st file referenced is where the results return from if it meets the search criteria.   | inputlookup ADUserID-File.csv | lookup ExDbUserID2-File userPrincipalName OUTPUTNEW userPrincipalName as userPrincipalName | where isnull(userPrincipalName) ... View more

@ITWhisperer  We have a similar question to this thread but in our case we're trying to compare 2 lookup files for user-IDs and if there's a match do a count of all the accounts that have a .admin in the name.    We're able to do a basic compare using "where isnull(userPrincipalName)" but not sure what's needed to compare if the user exist, then do a count .admin usernames. Here's what we have so far:  | inputlookup UserID-File.csv | lookup UserID2-File userPrincipalName OUTPUTNEW userPrincipalName as userPrincipalName | where isnull(userPrincipalName) Any thoughts?  Thanks in advanced.   ... View more

Can anyone please advise if this applies to Splunk v7.3.3 or if there is something else needed?   We tried applying this but it did not align the table.   Thank you. <panel> <html depends="$alwaysHideCSS$"> <style> #table1 .table th, .table td { text-align: center!important; } </style> </html> .... <table id="table1"> .... </table> </panel>   ... View more

Greetings,  I hope you all don't mind if I somewhat hijack this message with my question regarding drilldowns.   We have a requirement for a dashboard containing multiple lookup files.  We're able to reference one drilldown report.  How do we reference multiple (total 9) drilldown reports?   Thanks advance for your help. ... View more

Please disregard my previous message.  I was able to find the information on ldapsearch command at https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.3/User/Theldapsearchcommand However I am curious if anyone has worked with ADFineGrainedPasswordPolicy and have been able to return users that are in this Policy using ldapsearch.    Thanks in advance. ... View more

Is there a document or reference of all the available and supported ldapsearch commands?    Thanks in advance.  ... View more

Please disregard this post.  I found the issue.  The CDATA syntax needed the opening and closing <>.  | rex <![CDATA["Member:\s+\w+\s\w+:.*\\\(?<TargetAccount>.*)"]]> ... View more

One item to note, when trying to use CDATA as in the example below, the error message changes to "Unexpected close tag". | rex "Member:\s+\w+\s\w+:.*\\\[CDATA[(?<TargetAccount>.*)]]" ... View more