I feel like this should  be a simple solution but I can't find it. So my search gives values that were present from a group both yesterday and today, but I want to extract those that are not present both days. My search is currently doing this: Group Values_ today Values_ yesterday Count_ today Count_ yesterday change a 111 333 444 555 111 222 333 444 555 4 5 -1 b 111 222 333 111 222 333 3 3 0 c 111 222 333 666 111 222 333 444 555 666 4 6 -2 d 111 222 333 111 222 3 2 +1   Here is the desired output: Group Values_ today Values_ yesterday Count_ today Count_ yesterday change Missing_from_ today Missing_from_ yesterday a 111 333 444 555 111 222 333 444 555 4 5 -1 222   b 111 222 333 111 222 333 3 3 0     c 111 222 333 666 111 222 333 444 555 666 4 6 -2 444 555   d 111 222 333 111 222 3 2 +1   333 ... View more

Hi everyone, I recently took over a project by someone who is no longer with my employer. He made several scheduled searches that write to an index, and it was working great. However last month out of nowhere it just stopped working. Supposedly no changes were made.  The other searches are working, it's just this one. The search runs just fine, gets the expected results, but the results aren't being exported to the index.  I actually found another post on here with someone who looked to have the same problem, but it wasn't successfully answered.  Another post suggested that a forwarder might be a solution. Does that seem right? I'd rather avoid that solution as I don't want to be installing apps on this environment, but if necessary I will get the permission. Just want to make sure that's a probable solution before doing so.  ... View more

So I've searched and searched but can't seem to find an answer to my issue. I need to add an all option to my dynamic dropdown. I have found answers that seem like they should be simple enough. Either add All, * to static or alter the XML code. I've tried both, (I think when I altered the XML code it pretty much caused the dropdown to be the exact same way as it was had I just added the options to the static section) and each time I am getting a "search string cannot be empty" error. Don't know if it matters but I did watch a couple youtube videos, their search used | table fieldname | dedup fieldname at the end, when I did that I got the same issue, but now all the field values are grouped together, so I'm doing | stats count by fieldname at the end ... View more

Hello everyone, I'm new here and to Splunk in general. I have completed Fundamentals 1 and am now on the labs of Module 3 in Fundamentals 2. I am running into an issue with the drilldown editor in the edit dashboard page. The lab instructions say for me to click the 3 dots on the right of the screen (also known as the More actions button) but when I do the "More actions" bubble pops up and nothing appears, the more actions bubble then stays frozen on there until I leave the page or refresh it, see below. The other 3 buttons work fine. I am using Microsoft Edge and I tried Chrome but got the same result.  Is there another way to access the Drilldown Editor? I can't progress in the course without actually completing the lab.   ... View more