we have a search which is feeding data to kv store lookup let say lookup name 'sample_test'. now i want to run a weekly scheduled search that will compare the index source data and the data in 'sample_test' and remove the entire row from the kv store lookup which are not in index source data. Example: KV store data ('sample_test') X Y Z a A 1 b B 2 c C 3 d D 4 e E 5 Index Source Data X Y Z a A 1 b B 2 c C 3 d D 4 So ideally, when compare to above 2 tables last row in the kv store lookup in not present my source data i need to run a weekly scheduled search to remove that last row from the KV store. It would be more helpful if anyone can help me to resolve this issue. Happy Splunking!! ... View more

I need to know how we can pause the search for 30 seconds and then run the saved search  for example, i have a search scheduled at 9:30:00 my requirement is that the search should pause for 30 seconds and run at 9:30:30 seconds.  It would be more helpful if anyone help me in resolving this!! happy Splunking!! ... View more

In the below dashboard table, I need to set colour condition of 2 columns that is is expected difference and sla_difference. if expected_difference Is negative it should show in red colour if it is positive it should show in green colour. same as for sla_difference if it is negative it should be orange if it is positive it should show in green.     ... View more