Hi Splunkers,    I would like to pass the label value to the macro based on some condition, when a single value is selected, the value is correctly passed to macro and search is loading the results but when the multiple values were selected the search is throwing error in macro. </input> <input type="multiselect" token="machine" searchWhenChanged="true"> <label>Machine type</label> <choice value="*">All</choice> <choice value="VDI">VDI</choice> <choice value="Industrial">Industrial</choice> <choice value="Standard">Standard</choice> <choice value="MacOS">MacOS</choice> <choice value="**">DMZ</choice> <default>*</default> <initialValue>*</initialValue> <delimiter>, </delimiter> <change> <condition match="$label$ == &quot;*DMZ*&quot;"> <set token="machine_type_dmz">"mcafee_DMZ=DMZ"</set> </condition> <condition match="$label$ != &quot;*DMZ*&quot;"> <unset token="machine_type_dmz"></unset> </condition> </change> </input> Thanks in Advance! ... View more

Hi Splunkers,   I dont need the value in first line and need that value later in search to filter, so I tried tis way to skip the value dmz type IN (if($machine$=="DMZ",true,$machine$) Is that will work? Thanks in Advance! ... View more

Hi Splunkers,    I'm having a lookup country_categorization, which have the keyword and its equivalent country, we need to use this info for the main search asset when the country field from index is "not available" or "Unknown", we need to use this keyword from lookup, need to compare with asset name with index, usually keyqords are set of prefix of asset name with multiple entries and it should match with equivalent country. Index- Asset, country braiskdidi001, Britain breliudusfidf002, Unknown bruliwhdcjn001, not available lookup keyword, country bru - Britain bre - Britain   the output should be   braiskdidi001, Britain breliudusfidf002, Britain bruliwhdcjn001, Britain. Thanks in Advance! Manoj Kumar S ... View more

Hi There!    I'm facing the error "Search is waiting for the input" <form stylesheet="dashboard.css,infobutton.css" script="multiselect_functions.js,infobutton.js" version="1.1" theme="dark"> <label>Agent Operational Dashboard</label> <description>v4.3</description> <init> <set token="agent_index">1T</set> <set token="console_stand_scope">OR `console_stand(*)`</set> <set token="form.cacp">*</set> <set token="form.sap">*</set> <set token="form.origin">*</set> </init> <search id="init"> <done> <condition match="isnull($scope$) OR $scope$ == &quot;agent_console_&quot;"> <set token="cmdb_scope">*</set> </condition> <condition match="$scope$ == &quot;agent_cmdb_&quot;"> <set token="cmdb_scope">IN</set> </condition> </done> <query> | makeresults </query> <earliest>$search_start$</earliest> <latest>$search_end$</latest> </search> <search> <query> | makeresults | eval LimitVersion_ens=`get_obsolete_version(Agent_Endpoint_Security)` | eval LimitVersion_agent=`get_obsolete_version(Agent_Agent)` </query> <done> <set token="ens_obsolete_version">$result.LimitVersion_ens$</set> <set token="agent_obsolete_version">$result.LimitVersion_agent$</set> </done> </search> <search id="compliance_agent"> <query> `compliance_agent_op("agent_index_source IN($agent_index$) $console_stand_scope$", now(), $timerange$, agent,$machine$, $scope$, $origin$, $country$, $cacp$, $sap$)` </query> <earliest>$search_start$</earliest> <latest>$search_end$</latest> </search> <search id="compliance_all_agent"> <query> `compliance_agent_op("`agent_scope_filter($cmdb_scope$)`", now(), $timerange$, agent,$machine$, $scope$, $origin$, $country$, $cacp$, $sap$)` </query> <earliest>$search_start$</earliest> <latest>$search_end$</latest> </search> <search> <done> <set token="search_start">$result.search_start$</set> <set token="search_end">$result.search_end$</set> </done> <query>| makeresults | fields - _time | eval now=now() | eval prev_day=if(strftime(now, "%a")="Mon" AND "$weekends$"="exclude", -3, -1) | eval search_start=relative_time(now, prev_day."d@d") | eval search_end=search_start + 86400</query> </search> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="agent_index" searchWhenChanged="true"> <label>Choose Agent console</label> <choice value="1T,2A*,2S">All</choice> <choice value="1T">Agent Stand</choice> <choice value="2A*">Agent Scad</choice> <choice value="2S">Agent SCAPA</choice> <default>1T</default> <initialValue>1T</initialValue> <delimiter>, </delimiter> <change> <set token="agent_index_label">$label$</set> </change> <change> <condition match="like($agent_index$,&quot;%1T23%&quot;)"> <set token="console_stand_scope">OR `console_stand($cmdb_scope$)`</set> </condition> <condition match="!like($agent_index$,&quot;%1T23%&quot;)"> <set token="console_stand_scope"></set> </condition> </change> </input> <input type="dropdown" token="timerange" searchWhenChanged="true"> <label>Last Communication</label> <choice value="-1d@d">Previous day</choice> <choice value="-7d@d">Last 7 days</choice> <choice value="-15d@d">Last 15 days</choice> <choice value="-21d@d">Last 21 days</choice> <choice value="-30d@d">Last 30 days</choice> <choice value="-3mon">Last 3 months</choice> <choice value="-6mon">Last 6 months</choice> <choice value="-12mon">Last 1 year</choice> <change> <eval token="time_timechart">case($value$ == "-1d@d","1",$value$ == "-7d@d","2",$value$ == "-15d@d","3",$value$ == "-21d@d","4",$value$ == "-30d@d","5",$value$ == "-3mon","6",$value$ == "-6mon","7",$value$ == "-12mon","8")</eval> </change> <default>-15d@d</default> <initialValue>-15d@d</initialValue> </input> <input type="radio" token="origin" searchWhenChanged="true"> <label>Location</label> <choice value="*">All Locations</choice> <choice value="NAT">NAT</choice> <choice value="ROO">ROO</choice> <default>*</default> <initialValue>*</initialValue> <change> <unset token="form.country"></unset> </change> </input> <input type="multiselect" token="country" searchWhenChanged="true"> <label>Country</label> <search> <query>| inputlookup b1a_asset_country.csv where nat_roo="$origin$" | dedup country | fields country </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <delimiter> </delimiter> <fieldForLabel>country</fieldForLabel> <fieldForValue>country</fieldForValue> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="multiselect" token="machine" searchWhenChanged="true"> <label>Machine type</label> <choice value="*">All</choice> <choice value="VDI">VDI</choice> <choice value="Industrial">Industrial</choice> <choice value="Stand">Stand</choice> <choice value="MacOS">MacOS</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="radio" token="business_assets" searchWhenChanged="true"> <label>Business assets</label> <choice value="*">All assets</choice> <choice value="cacp">CACP</choice> <choice value="sap">SAP</choice> <default>*</default> <initialValue>*</initialValue> <change> <condition match="$business_assets$ == &quot;cacp&quot;"> <set token="cacp">true</set> <set token="sap">*</set> </condition> <condition match="$business_assets$ == &quot;sap&quot;"> <set token="sap">true</set> <set token="cacp">*</set> </condition> <condition match="$business_assets$ == &quot;*&quot;"> <set token="sap">*</set> <set token="cacp">*</set> </condition> </change> </input> <input type="dropdown" token="scope" searchWhenChanged="true"> <label>Scope</label> <choice value="agent_console_">Agent Console</choice> <choice value="agent_cmdb_">CMDB</choice> <default>agent_console_</default> <initialValue>agent_console_</initialValue> <change> <condition match="$scope$ == &quot;agent_console_&quot;"> <unset token="cmdb_scope"></unset> <set token="cmdb_scope">*</set> </condition> <condition match="$scope$ == &quot;agent_cmdb_&quot;"> <unset token="cmdb_scope"></unset> <set token="cmdb_scope">IN</set> </condition> </change> </input> <input type="multiselect" token="office_filter" searchWhenChanged="true"> <label>Front/Back office (only Stand Global compliance)</label> <choice value="Front Office">Front Office</choice> <choice value="Back Office">Back Office</choice> <initialValue>Front Office,Back Office</initialValue> <default>Front Office,Back Office</default> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>, </delimiter> <change> <eval token="office_filter_drilldown">replace($form.office_filter$ + "","([^,]+),?","&amp;form.office_filter=$1")</eval> </change> </input> <input type="radio" token="weekends" searchWhenChanged="true"> <label>Weekends</label> <choice value="exclude">Exclude Weekends</choice> <choice value="include">Include Weekends</choice> <default>exclude</default> <initialValue>exclude</initialValue> </input> </fieldset> <row> <panel> <title>Full Perimeter Compliance (all EPO)</title> <chart> <title>All Consoles</title> <search base="compliance_all_agent"> <query>| chart count by $scope$global_compliance | sort $scope$global_compliance</query> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">all</option> <option name="charting.fieldColors">{"Compliant":0x55AA55,"Non Compliant":0xCC0000","Not Applicable":"0xFFC300 "}</option> <option name="charting.seriesColors">[0x55AA55, 0xCC0000]</option> <option name="refresh.display">progressbar</option> <drilldown> <link target="_blank">/app/agent_operational_antivirus_details?form.compliance_filter=$click.value$&amp;form.agent_index=*&amp;form.timerange=$timerange$&amp;form.antivirus_filter=*&amp;form.machine=$machine$&amp;form.origin=$origin$&amp;form.country=$country$&amp;form.business_assets=$business_assets$&amp;form.scope=$scope$</link> </drilldown> </chart> </panel> </row> Thanks in Advance!!!! ... View more

Hi There!    I would like to pass two values based on the selection of inputs in multiselect drill down,    Assume I'm having Multiselect options as v1, v2, v3, v4    Based on the selection Eg. If v1 and v2 were selected, I would like to pass "value1" "value 2" in "OR" condition to a token of a base search. Thanks in Advance! ... View more

Hi Splunkers!   I would like to pass two macros as a token to a base search when multiple values in multiselect is selected, <done> <condition match="$index$ == &quot;2A*&quot; AND $index$ == &quot;1T*&quot; AND $index$ == &quot;2S*&quot;"> <set token="standard">true</set> <set token="scada">true</set> <set token="aws">true</set> <set token="index_label">Standard, Scada, AWS</set> <set token="index_scope">`scada` OR `aws` OR `standard($cmdb_scope$)`</set> </condition> <condition match="$index$ == &quot;2A*&quot; AND $index$ == &quot;1T*&quot;"> <set token="standard">true</set> <unset token="aws"></unset> <set token="scada">true</set> <set token="index_label"> Standard,  Scada</set> <set token="index_scope">`scada` OR `standard($cmdb_scope$)`</set> </condition> <condition match="$index$ == &quot;2A*&quot; AND $index$ == &quot;2S*&quot;"> <unset token="standard"></unset> <set token="scada">true</set> <set token="aws">true</set> <set token="index_label"> Scada,  AWS</set> <set token="index_scope">`scada` OR `aws`</set> </condition> <condition match="$index$ == &quot;2S*&quot; AND $index$ == &quot;1T*&quot;"> <set token="standard">true</set> <unset token="scada"></unset> <set token="aws">true</set> <set token="index_label"> AWS,  Standard</set> <set token="index_scope">`aws` OR `standard($cmdb_scope$)`</set> </condition> <condition match="$index$ == &quot;2A*&quot;"> <unset token="standard"></unset> <set token="scada">true</set> <unset token="aws"></unset> <set token="index_label"> Scada</set> <set token="index_scope">`scada`</set> </condition> <condition match="$index$ == &quot;2S*&quot;"> <unset token="standard"></unset> <unset token="scada"></unset> <set token="aws">true</set> <set token="index_label"> AWS</set> <set token="index_scope">`aws`</set> </condition> <condition match="$index$ == &quot;1T*&quot;"> <set token="standard">true</set> <unset token="scada"></unset> <unset token="aws"></unset> <set token="index_label"> Standard</set> <set token="index_scope"> `standard($cmdb_scope$)`</set> </condition>     <input type="checkbox" token="index" searchWhenChanged="true">       <label>Choose  console</label>       <choice value="1T*"> Standard</choice>       <choice value="2A*"> Scada</choice>       <choice value="2S*"> AWS</choice>       <default>1T*, 2A*,2S* </default>       <initialValue>1T*, 2A*,2S* </initialValue>       <change>         <set token="index_label">$label$</set>       </change>       <change>         <condition match="$index$ == &quot;1T*&quot; AND $index$ == &quot;2A*&quot; AND $index$ == &quot;2S*&quot;">           <set token="standard">true</set>           <set token="scada">true</set>           <set token="aws">true</set>           <set token="index_scope">`scada` OR `standard($cmdb_scope$)` OR `aws`</set>         </condition>         <condition match="$index$ == &quot;1T*&quot; AND $index$ == &quot;2A*&quot;">           <set token="standard">true</set>           <set token="scada">true</set>           <unset token="aws"></unset>           <set token="index_scope">`scada` OR `standard($cmdb_scope$)`</set>         </condition>         <condition match="$index$ == &quot;2A*&quot; AND $index$ == &quot;2S*&quot;">           <unset token="standard"></unset>           <set token="scada">true</set>           <set token="aws">true</set>           <set token="index_scope">`scada` OR `aws`</set>         </condition>         <condition match="$index$ == &quot;2S*&quot; AND $index$ == &quot;1T*&quot;">           <set token="standard">true</set>           <unset token="scada"></unset>           <set token="aws">true</set>           <set token="index_scope">`aws` OR `standard($cmdb_scope$)`</set>         </condition>         <condition match="$index$ == &quot;2A*&quot;">           <unset token="standard"></unset>           <set token="scada">true</set>           <unset token="aws"></unset>           <set token="index_scope">`scada`</set>         </condition>         <condition match="$index$ == &quot;2S*&quot;">           <unset token="standard"></unset>           <unset token="scada"></unset>           <set token="aws">true</set>           <set token="index_scope">`aws`</set>         </condition>         <condition match="$index$ == &quot;1T*&quot;">           <set token="standard">true</set>           <unset token="scada"></unset>           <unset token="aws"></unset>           <set token="index_scope">`standard($cmdb_scope$)`</set>         </condition>        but this is not working, Only one value is  passed when selecting two values. Thanks! ... View more

Hi Splunkers!    How to change the color of info button in dashboard.   <panel id="global_status_op"> <title>Global Compliance</title> <html> <style> </style> <div class="infobutton" parent="global_status_op" type="collapse" style="display: none"> <p style="font-size:15pt;"> The compliance is calculated as follow:</p> <p style="font-size:9pt;"> - If compliant, the asset is considered as complinat</p> <p style="font-size:9pt;"> - If not compliant, the asset is considered as not compliant</p> </div> </html> </panel> Thanks! ... View more

Hi Splunkers!    I would like to know how to define a .evtx file,    I had defined in this way, but it didn't works [monitor://C:\Windows\System32\Winevt\Logs\Data Security.evtx]   Thanks! ... View more