Hey @shubhamsipah, For the SplunkCloud environment, if you want to make any changes to the conf files, the best way would be to reach out to Splunk Support and they'll be able to make changes in your environment. ... View more

Yes @franjrobles, That is exactly how the URL will change if a user changes the value from the selected input. If URL is the only thing that you want, then the way you have mentioned in the above post is the way to move forward with. ... View more

Hey @hungln9, You can use the eval function to perform arithmetical operations on the field values. Below is an expression that you can add to your search. <<your_base_query>> | eval mem_used_perc=round((mem_used/max_memory)*100,2) | timechart span=<<time_span_interval>> mem_used_perc   PS: The above expression is written with the assumption that Max Memory Used is stored under field mem_used and Memory Size is stored under max_memory field. ... View more

Hey @ojtoids, You can use the head command to display the top 8 results. However, it would not be much optimistic approach. Also, when you use earliest in the search query itself, it doesn't matter how much time you select in the time range picker. The query will run for the time defined using the earliest command only. So, if you want to search for data using All time and still display the timechart for the last 2 months only, I would suggest using the head command. Your query should look like below: index=data "search criteria" earliest=-2mon | | timechart usenull=f span=1w count by datapoints | head 8 ```Top 8 results```   ... View more

Hey @zacksoft_wf, When you run the btool command with debug mode enabled, look out for the file paths that are having local directory in them. All the changes made to the local directory would be the custom changes made as per the requirement. Basic syntax for btool command will be like below: $SPLUNK_HOME/bin/splunk btool <<file_name>> list --debug   PS: Do not add the .conf extension when you add a file.  ... View more

Hey @POR160893, Glad it helped. Could you also accept the above post as solution so that it would also help others browsing through the community. ... View more

Hey @POR160893, If you are having a list of users with specific IP addresses or the range, you can create a custom role and then assign those users the custom role. Then the dashboard read/write permissions can be controlled using the RBAC (Role Based Access Control) and only the users that have read access to that dashboard will be able to view it. More information related to RBAC can be found below: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/setpermissionsforobjects/ https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/UseaccesscontroltosecureSplunkdata https://conf.splunk.com/files/2017/slides/splunking-with-multiple-personalities-extending-role-based-access-control-to-achieve-fine-grain-security-of-your-data.pdf https://www.splunk.com/en_us/blog/tips-and-tricks/stories-from-customer-zero-building-a-scalable-rbac-methodology-on-splunk.html  ... View more

Hey @faisalchohan, I don't think it is possible to change the labels on the Y-axis in any of the graph charts. Also, the charting.axisTitleY.visibility is to set if the title of the Y-axis should be visible or not. You can find information related to the parameter here - https://docs.splunk.com/Documentation/Splunk/8.2.6/Viz/ChartConfigurationReference#:~:text=charting.axisTitleY.visibility  You can transpose the data from Y-Axis to X-Axis and then use case conditions to change the mapping of the Alert_level. ... View more

Hey @franjrobles, I couldn't find any documentation supporting this. But, I have one server with me and have created a sample dashboard using the Dashboard Studio. I verified that inputs can be set in the URL and the same dashboard loads with the input value passed in the URL. ... View more

Hey @aaa2324 , Try renaming the columns in the table and remove the spaces in the column name and then you'll be able to calculate the difference easily. Your query should look something like below:   <<your_base_query>> | rename "Table A" as Table_A "Table B" as Table_B | eval diff=Table_B-Table_A   And then you can save this search as an alert and have the alert triggered if diff>3. ... View more

Hey @Kisame27, You can use spath to extract the json object attributes into separate fields. Then after, you will be able to visualize the Amount field in the table. Reference docs for spath command can be found here - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Spath ... View more

Hey @coyne_a_phrase, This may happen because of self-service installation, the inputs.conf gets purged from the app package. And that could be the reason for app getting stuck in loading state. ... View more

Hey @saotaigiri, There's a blog which provides detailed steps on ingesting azure nsg flow logs into Splunk. Here's the link - https://www.splunk.com/en_us/blog/platform/splunking-azure-nsg-flow-logs.html?locale=en_us  ... View more

Hey @novaty, For your first question, yes you can change the searches based on the user selected from the input and token can be set for the input. However, you will not be able to hide/unhide panels using the same. Dashboard Studio does not support it. Below is the detailed difference between the Classic Studio and the Dashboard Studio in terms of data - https://docs.splunk.com/Documentation/Splunk/8.2.5/DashStudio/IntroFrame#:~:text=all%20other%20settings.-,Dashboard%20features,-Dashboard%2Dlevel%20features  If you want a reference on how to make your dashboard dynamic by using tokens, please find the below doc - https://docs.splunk.com/Documentation/Splunk/8.2.5/DashStudio/inputs  ... View more

Hey @mstrzelecki, You can try using the ITSI Content Packs (https://splunkbase.splunk.com/app/5391/) and try configuring the same for AD analysis. There are multiple content packs for different purposes. You can find the description related to content packs here - https://docs.splunk.com/Documentation/ContentPackApp/1.5.0/Overview/Overview#:~:text=for%20Content%20Packs.-,Available%20content%20packs,-These%20content%20packs.  ... View more

Hey @xinyizhang, Can you let here know which driver you are trying to install and configure? Also, you will need the Splunk username and password when you connect to Tableau with the help of which all the saved searches and reports will be listed in the Tableau UI and you'll be able to visualize the data. Splunk ODBC helps to connect Splunk instance to Tableau - https://splunkbase.splunk.com/app/1606/  ... View more

Hey @SonakshiRaiTH, Try running the below query for a short time period. It'll help you identify all the logs that are coming to Splunk or getting monitored by Splunk. index=_internal source=*.log | stats count by source You can check the monitoring console of the environment to have the overview of the Splunk architecture. ... View more

Hey @ccntech, I'm not aware of any way to read the content of the scripts from the search bar. If this script belongs to a Splunkbase app, you can download it and can view the contents of the script. If the app is a custom/private one, you can request someone with access to the command line to provide you with a copy of the app. ... View more

Hey @jbender72, I don't have a dashboard for social media. If you are trying to create a dashboard and display it on social media, you can save the search as a report and embed it into a custom URL. Steps and details can be found below: https://docs.splunk.com/Documentation/SplunkCloud/8.2.2201/Report/Embedscheduledreports  https://docs.splunk.com/Documentation/SplunkCloud/latest/Report/Optionalconfigurationforembeddedreports    ... View more

I'm not sure why it failed. Try running the vetting using the private_app tag. That's the one needed for vetting the private apps on Cloud instances. ... View more

Hey @heathramos, Try accelerating the data model present in the app. It'll help you generate the AD-related datasets and populate the dashboards. The name of the data model is MS_Windows_AD_Changes . ... View more

Hey @Venkat_Kumar, Your Splunk credentials are different than the SplunkCloud credentials. The one you received in the email are the creds for signing into the cloud platform. Please use the same URL, username, and password and give it a hit. ... View more

Hey @Kubousky, If the field coordinatorsID is present as a column of the table, try expanding the field using mvexpand first, and then extract the field expertiseLevel from the coordinatorsID using regex. This will create a separate column for the expertiseLevel and then you can filter your data using the search command. Roughly your query should look something like this <<your_base_query>> | mvexpand coordinatorsID | rex field=coordinatorsID "[a-zA-Z]##(?<expertiseLevel>\d)" | search expertiseLevel="3" ... View more