I am writing a shell script which I will execute with a cron job to clean eventdata from files daily.  How do I script Splunk commands in shell script to execute?   Here is what I have: cd /datadrive/opt/splunk/bin ./splunk clean eventdata -index audit y ./splunk clean eventdata -index _internal y ./splunk clean eventdata -index _introspection y ./splunk clean eventdata -index _metrics y ./splunk clean eventdata -index _telemetry y ./splunk start     Any and all help would be greatly appreciated. ... View more

Hello, One of these works, One does not 1.] index="conmon" earliest>="01/01/2022:00:00:000" source="AwesomeCloudPOAM.xml" | rex field=_raw "<version>(?<version>[^<]+)</version>" | table version , which works fine and brings back value from the xml node.  however, this search fails every time: 2.] index="conmon" earliest>="01/01/2022:00:00:000" source="AwesomeCloudPOAM.xml" | rex field=_raw "<oscal-version>(?<oscal-version>[^<]+)</oscal-version>" | table oscal-version with this error: Error in 'rex' command: Encountered the following error while compiling the regex '<oscal-version>(?<oscal-version>[^<]+)</oscal-version>': Regex: syntax error in subpattern name (missing terminator).   Can anyone help me?   ... View more

I have multiple parts on my dashboard, how do I select mutiple parts at same time to move them all at once? ... View more

how do I make each column of a column graph a drilldown to a new dashboard in dashboard studio? ... View more

I am using a single value in a dashboard, it is only showing a date, but I cannot get the date to format the way want it on the dashboard. My search string is: index=conmon earliest=11/23/2022:00:00:00 dedup LASTMODIFIED eval tst = strftime(strptime(LASTMODIFIED, %Y-%m-%d), %Y-%m-%d) fields tst want 11-23-2022 , but continue to get 2022-11-23T13:35:53-05:00 The search on its own brings back the value correctly, but not on the dashboard. Any help would b greatly appreciated. Bill K ... View more