Hi @gcusello and @PickleRick , I copied props.conf to indexers and it works properly :-). Thank you and have a nice day! ... View more

Thank you for more details). Unfortunately, it is not really clear in Splunk docs where we can use certain parameter (only UF, HF, Indexer or on any of them). how to get it? So, I have to copy my props.conf on indexers as well, or move it from UF to indexers? Thank you in advance:-) ... View more

Hi @PickleRick  and @gcusello , Thank you for your responses, but it is not clear for me, because in our system we have lots of configs/dataflows were we have props.conf with time related parameters (TIMESTAMP_FIELDS, TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD, TIME_FORMAT, TZ .... ) only on UF.  Our forwarders connected to indexers directly, we dont have any props.conf on indexers and it work properly). maybe it only works with INDEXED_EXTRACTIONS ? INDEXED_EXTRACTIONS = csv FIELD_DELIMITER = , NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured disabled = false TIMESTAMP_FIELDS = date TIME_FORMAT = %Y-%m-%d %H:%M:%S TZ = UTC ... View more

solution: SEDCMD-replaceblanks1 = s/,,/,-,/g SEDCMD-replaceblanks2 = s/,,/,-,/g SEDCMD-replaceblanks3 = s/,,/,-,/g SEDCMD-replaceblanks4 = s/,,/,-,/g SEDCMD-replaceblanks5 = s/,,/,-,/g SEDCMD-replaceblanks6 = s/,,/,-,/g SEDCMD-replaceblanks7 = s/,,/,-,/g SEDCMD-replaceblanks8 = s/,,/,-,/g   ... View more

Hello @somesoni2 , Thank you for this approach. But it works only when we have one empty value in row, but if not looks like it doesnt replace every value properly. Example:  D,2,,200,00,8842,,USA,,1989,,2,320301120086,,,,,19899717024,,,320335100002,,,,,:,,,0,0,0,S,00000000,0,0.0,19899717024,104129,,,0,,,,,   Could you please suggest a solution.   ... View more

Hi @yuanliu ,  I think I was pretty clear).  I need the same functionality like in Studio  -  "Select matched" . But, anyway thank you for your efforts. ... View more

hi @woodcock can you please point me to right direction ) ... View more

Hi @yuanliu , can you please check, what you suggested. IT is different from what i am looking for :-). I have put your code and checked to be sure, maybe i missed something. for example in filter try to select all values with "bundle". So, we have four matched values. How can i select these four values by one click?    ... View more

  1. I do filtering in muliselect filter 2. I have below in filter e.g. 27 matched values 3. I dont want click 27 times on each to select all of them 4. I want click one time on  "Select all matches" as it is in Studio to select all matched values. 5. OR hit enter to select. ... View more

hi @yuanliu For me it is straight forward ). If you have multiselect filters in dashboard studio, please open it and check the feature which i shared in screenshot. Then try to do the same in multiselect filter in classic dashboard :-).  ... View more

hi @yuanliu , I don't need select All in my classic dashboard But I need select All Matches:     ... View more

Hi @woodcock ,  Thank you, can you elaborate please. ... View more

Thanks @yuanliu , interesting option, but question not actually about that :-). usually we use this easier option for this - choice called "All" using "*" as value ... View more

hi @gcusello , the values  in the multiselect from a search, but it doesnt matter. i know that i display the ones that match :-).   Let me bring more details: 1. I do filtering in muliselect filter 2. I have below in filter e.g. 27 matched values 3. I dont want click 27 times on each to select all of them 4. I want click one time on  "Select all matches" as it is in Studio to select all matched values. 5. OR hit enter to select.   ... View more

hi @gcusello , I have it , but question different.  I want to select not all but all matched :-).   ... View more

Hi, Delimiter doesn't work here(.  the option only possible: index=_internal sourcetype IN ($ms2$) https://docs.splunk.com/Documentation/Splunk/9.0.3/DashStudio/inputMulti   ... View more

hi, I have just opened code and adjusted and it works).     ... View more

Hi colleagues, i have faced the same issue and just curious where actually the limitation defined (for alert action to lookup )   KR, Lis ... View more

Hi @yuanliu ,  I dont need send one row of statistical data to particular email, but group of many records/rows to particular email as discribed below. ... View more

My apologies for not clear explination.  Yes, dest and source values will be fetched and stored to lookup in prior query from the same index and sourcetype. My first query will fetches the list of dest and source with particular thresholds, look below: index=test sourcetype=main (filters) | stats count by dest source | where count > 100 source dest Count_of_records a x 345 b y 247 c z 144 but I need to send not statistical data, but certain records with more details. So, i will run second query with filter SOURCE and DEST from my lookup, for the same time period without grouping to get all records with all available fields. This is not fit my requirements, because I will send all (345+247+144): index=test sourcetype=main  [(| inputlookup Lookup_x.csv)] | table *   While I need send 345 to first email, and 247 to second and so on...             ... View more

Hi @yuanliu  thank you for your reply. I have seen this general approach how to send particular one row to certain email, but in my case it is something more complex). I need to use Source and Dest from lookup as filer in every search and send a table with results(might be many rows) to certain contact.    Lookup_x: source dest contact a x 1@email.com b y 2@email.com c z 3@email.com     index=test sourcetype=main | inputlookup Lookup_x.csv  | where source = a AND dest = x | table *   source dest Another field Another field Another field a x       a x       a x         Send the table above to 1@email.com   index=test sourcetype=main | inputlookup Lookup_x.csv  | where source = b AND dest = y | table *   source dest Another field Another field Another field b y       b y       b y         Send the table above to 2@email.com   ... View more

    <condition match="'value' LIKE &quot;object%&quot;"> ... View more