This sounds like @richgalloway said. You have defined some other KOs like field extraction inline or transforms. Maybe eventtypes and/or macros which are private or if those are public, other user’s role hasn’t permissions to see and use those.  ... View more

Interesting-and you're right. The knowledge objects are actually defined in a different app than the one I'm using to run the API calls. ... View more

Good point! My refresh interval would have definitely been set to more than 10 seconds, so good call on that. Unfortunately, I spoke too soon—this solution won’t work as it refreshes the dashboard for all users, which isn’t the intended behaviour. I still need something similar to looping through browser tabs, but without requiring the installation of an extension. ... View more

Hi @tomapatan  If you structure your lookups so that the more generic match is lower down the lookup than your more specific match, and you have your "Max Matches" set to 1 then it should match the more specific value first, else match the more generic one if not found. For example - this is my test lookup: You can see the more specific values are at the top. I have configured a lookup definition with WILDCARD matches and a max matches = 1 Then I run a search, if country/town isnt set I am setting to "Unknown" but it could be any value.   It maps to 999 because this is the generic value for host1 if town/country is not set. If I now set the country=UK:   I get a more specific value returned because it matches country=UK town=* If I do host=host999 it matches host* in the lookup and I get an interestingField value of GHI:   Remember that you have to pass all the fields you want to match on to the lookup command, and you should have the more generic matches lower down the lookup file. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Depending on your environment you may need to add an environmental variable for a proxy server. This allows apps to be "proxy aware" in cases where they are not. You can test it out on windows using the setx command. setx https_proxy <your proxy server ip>:443 setx http_proxy <your proxy server ip>:443 I know what your are thinking - "it is over port 8089" not "443" but try it out, it worked for me. ... View more

And to confirm - I`ve updated the lookup csv file so that empty values now contain a "*" value, but still not working. ... View more

thanks, this worked for me as well. Is there a way to rename the csv attached to the report ? ... View more

This thread is resolved.  For betters chances of a reply, please post a new question. ... View more

I can't see any obvious issue with your code. What happens if you include debug log statements that output the report_id value, and then the resulting URL? Assuming logging mode is set to debug: helper.log_debug(f"Report ID is: {report_id}") url = f"https://example_url/{report_id}/download" helper.log_debug(f"URL is: {url}") headers = { "accept": "application/json", "Authorization": f"Bearer {jwt_token}", }   ... View more

Answered my own question - the script below worked for me: require([ 'splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!' ], function(mvc) { console.log('JavaScript loaded'); // Debug log to confirm script is running var defaultTokenModel = mvc.Components.getInstance('default'); var submittedTokens = mvc.Components.getInstance('submitted'); document.getElementById('submit_button').addEventListener('click', function() { var comment = document.getElementById('html_ta_user_comment').value; console.log('Submit button clicked'); // Debug log to confirm button click console.log('Comment:', comment); // Debug log to show the comment value defaultTokenModel.set('tokComment', comment); console.log('Token set:', defaultTokenModel.get('tokComment')); // Debug log to confirm token is set // Trigger the search by updating the submitted tokens submittedTokens.set(defaultTokenModel.toJSON()); }); }); By adding the line submittedTokens.set(defaultTokenModel.toJSON());, we ensured that the search is refreshed whenever the token value changes. ... View more

@tomapatan- I'm not 100% sure on what are you trying to do but what I can say is, you probably might not need JS file. Simple XML dashboard can do it without need of JS code. This is just another example to explain you the usage. This example shows token on the Dropdown filter, but token on Table or Chart drilldown (on-click) would work the similar way. I'll put the reference doc below - https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/PanelreferenceforSimplifiedXML#drilldown <form> <label>dropdown</label> <fieldset submitButton="false"> <input type="dropdown" token="tkn_number"> <label>field1</label> <default>3</default> <fieldForLabel>count</fieldForLabel> <fieldForValue>count</fieldForValue> <search> <query>| makeresults count=10 | streamstats count</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <condition match="'value'==&quot;3&quot;"> <set token="tkn_show">true</set> </condition> <condition> <unset token="tkn_show"></unset> </condition> </change> </input> </fieldset> <row depends="$tkn_show$"> <panel> <table> <search> <query>index="_internal" |stats count by sourcetype</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form>   I hope this helps!!! Kindly upvote if it does!! ... View more

@marcoscala were you able to fix the Palo Alto Splunk app throwing JS errors ? ... View more

Amazing, worked exactly as you explained it will. ... View more

Apologies, but would really appreciate a more detailed set of instructions - can`t get my head round how adding a checkbox helps with the encryption and how to actually achieve this ? Many thanks! ... View more

Hi Just curious - what are the security implications to think about enabling this. If used in conjunction with the trusted domain list in web-features.conf - we should be secure? Or is there something else? ... View more

Settings on the SH as follows: AUTO_KV_JSON = false KV_MODE = none   Settings on the HF: AUTO_KV_JSON = false INDEXED_EXTRACTIONS = json KV_MODE = none   Values are getting duplicated, do you have anymore suggestions for us ? ... View more

Hi, I wanted to import your add-on into the add-on builder so I can view the checkpoint logic and replicate it for my app, but I`m getting the following error when I try to import the project: "The add-on project could not be imported because a problem occurred while extracting project file." Is there another way to view the checkpoint logic ? Thanks,  Toma ... View more

Would the Akamai add-on work with the Akamai Prolexic Analytics API ? ... View more

Hi You need to remember that changes in HF will effect only to new events and it also need restart of HF before those take effect. Is this HF 1st full splunk instance on path to SC? Have you try to set KV_MODE to none on SC to check if it helps with those old events. r. Ismo ... View more

thanks for the post, helped me solve a very similar issue that I`ve encountered. ... View more

If you're referring to the roles listed in the Monitoring Console then, yes.  Doing so does not change anything on the indexer itself, however. ... View more

@woodcock What is the best way to modify this script to support the API token approach?  I have tried a few different versions, but am unable to get it to work properly. So....something like:  curl -H "Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2......." ... View more