Hi there, I am trying to get a rolling number whenever proposals get activated. I am able to execute the following SQL script which gets me a figure for proposals activated today using this:     select * from cr_managementinformation where activation_date >= '06-JUNE-23' order by proposal_status     When I change the input type to Batch then i use this:     SELECT * FROM cr_managementinformation WHERE PROPOSAL_NUMBER > ? AND activation_date = TO_DATE(current_date) ORDER BY PROPOSAL_NUMBER ASC     The rising number does not match the batch number. i.e. the batch number of activations today is 302 but the rising number is only 5.   Can you help? ... View more

HI there, I've created a multi select input called Source and the Data Configurations is set to a search and Use search results or job status as tokens is ticked (i've tried with this unticked). The source filter shows the values I expect to see but nothing happens when I tick one or more of the options.   Not sure if the code below is relevant but I am adding it in case it helps     "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "@d,now" }, "title": "Global Time Range" }, "input_OvTI7NW3": { "options": { "items": ">frame(label, value) | prepend(formattedStatics) | objects()", "token": "ms_monMf0CU", "defaultValue": "" }, "title": "Source", "type": "input.multiselect", "dataSources": { "primary": "ds_ESObVruQ" }, "context": { "formattedConfig": { "number": { "prefix": "" } },       ... View more

Hi there, I have found issues when using the Send to Mobile action on an alert. If the condition is set to less than 1 or equals 0 then the alert does not create a push notification. ie. if an event is not generated by 9am where sourcetype=sourcetype=globalscape then create a Send to Mobile action. The push notification is not received. The only workaround i have found is to create a "Log Event" action, create a second alert and create a Send to Mobile on the Event as created in the first alert.   I think this is a bug but any help  ... View more

Our MPS team provisions IAM user for non-personalized access.  All IAM Access Keys need to be rotated every 90 days. MPS has created a rotation service which helps you to fulfil this requirement. This impacts Splunk as the Key ID within Configuration - Account will need to be updated once a new Key has been created. Is there a solution where Splunk can automatically update the Key ID value once a new access key has been created? ... View more