Hello I am working on creating a search that eval's results and adds boolean strings. the results will then be passed as a token to later searches. The result of the search could be a single ID or multiple IDs. The idea is that the first panel lists IDs. The next panel in the dashboard will search an index but only for IDs from the first panel.  For example: Panel 1 index=db source=MSGTBL MSG_src="XXXX" MSG_DOMAIN="CCCCCCCC" "<messageType>AAA</messageType>" | eval MSGID1="MSGID="+MSGID+" OR" | table MSGID might give you a table of MSGIDs: MSGID=56454GF-5RT1KL-566IOS-FT5GFAS OR MSGID=56454GF-65WE-566IOS-5845UIK OR MSGID=SD8734-DFH745-DFHJ7867-GKJH8 OR I can then set that as a token like <done> <set token="tokMSGID1">$result.MSGID1$</set> </done>   The issue im having is that if there is only a single MSGID it will have an 'OR' at the end as well as the last result in a set of IDs would have the 'OR' at the end. Can anyone tell me search-wise how to handle this? Thanks!   ... View more

Hello I am working on creating a dashboard to monitor some data flow info. this dashboard will have many panels so I was thinking I could hide them all when loaded and then only display the ones that the user selects in a multiselect input(maybe a better way?). I am unsure how to accomplish this though or if it can even be done. Does anyone have any ideas on how I could accomplish this task? Thanks for the help! ... View more

Hello I am collecting data via AWS add on and what I have found is that my timestamp recognition isn't working properly. I have a single AWS input using the [aws:s3:csv] sourcetype. this then uses transforms to update the sourcetype based on the file name the data comes from. Config snips: props.conf   [aws:s3:csv] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE_DATE = true FIELD_DELIMITER = , HEADER_FIELD_DELIMITER = , TRUNCATE = 20000 TRANSFORMS-awss3 =sourcetypechange:awss3-object_rolemap_audit,sourcetypechange:awss3-authz-audit-logs [awss3:object_rolemap_audit] TIME_FORMAT=%d %b %Y %H:%M:%S LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false BREAK_ONLY_BEFORE_DATE = true FIELD_DELIMITER = , HEADER_FIELD_DELIMITER = , FIELD_QUOTE = " INDEXED_EXTRACTIONS = CSV HEADER_FIELD_LINE_NUMBER = 1 [awss3:authz_audit] TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3Q #TZ=GMT FIELD_DELIMITER = , HEADER_FIELD_DELIMITER = , FIELD_QUOTE = " INDEXED_EXTRACTIONS = CSV HEADER_FIELD_LINE_NUMBER = 1   transforms.conf   [sourcetypechange:awss3-object_rolemap_audit] SOURCE_KEY = MetaData:Source REGEX = .*?object_rolemap_audit.csv DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::awss3:object_rolemap_audit [sourcetypechange:awss3-authz-audit-logs] SOURCE_KEY = MetaData:Source REGEX = .*?authz-audit.csv DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::awss3:authz_audit     It seems that the data comes in at indextime from what I can see, even though I set recognition for each sourcetype. I believe that timestamping is happening at the initial pass into Splunk before it gets the transforms applied.   How can i set timestamping via the initial sourcetype if there are multiple formats for the sourcetype depending on the file? Since its not honoring the timestamp recognition setting post-transforms. Thanks for the help. ... View more

Hello I have some array data located within a field in my data. It comes from DBConnect and isnt exactly JSON. Im trying to figure out how to extract this data so I can make it useful but Ive gone through several iterations and have been unsuccessful so far. Hers a sample record(I picked a fairly long one for an example):       2023-08-02 08:23:28.000, CASE_ID="50031iIQAQ", STAGE="Initial", EVENT_TYPE="SS", SUBMISSION_DATE="2023-08-02 06:23:23.0", SUBMISSION_TYPE="Application INITIAL SUBMISSION", DESTINATION=""Application ", SUBMISSION_DATA="{ "submissionType": "Application INITIAL SUBMISSION", "submissionDate": "2023-08-02 06:23:23", "stage": "Initial", "repository": "central", "xxxxMessage": { "header": { "timeStamp": "2023-08-02 06:23:24", "source": "XXXXX", "messageType": "XXX CCC SSS", "domain": "APPLICATION/SUBMISSION" }, "body": { "submissionUnit": { "field": [ { "value": "500871iIQAQ", "name": "sourceId" }, { "value": "CCC VVVV", "name": "submission_unit_type" }, { "value": "1", "name": "submission_unit_number" }, { "value": "2023-08-02 06:23:23", "name": "submit_date" }, { "value": "2023-08-02", "name": "xxxx_received_date" } ] }, "submission": { "field": [ { "value": "5000871iIQAQ", "name": "sourceId" }, { "value": "00132546", "name": "submission_event_id" }, { "value": "XXXX", "name": "submission_type" }, { "value": "1", "name": "submission_number" }, { "value": "Pending", "name": "submission_status" }, { "value": "2023-08-02", "name": "submission_status_effective_date" }, { "value": "TTTT 1", "name": "xxxxx_xxxxxx" }, { "value": "String of data goes here", "name": "proposed_change" } ] }, "referencedMonographs": { "referencedMonograph": [ { "field": [ { "value": "a001YmysUAC", "name": "sourceId" }, { "value": "XXX2", "name": "ref_monograph_number" }, { "value": " String of data goes here", "name": "ref_monograph_description" } ] } ] }, "organizations": { "organization": [ { "field": [ { "value": "a07000nMzDQAU", "name": "sourceId" }, { "value": "String of data goes here", "name": "organization_name" }, { "value": "117185493", "name": "xxxx_number" }, { "value": "12071", "name": "company_global_id" }, { "value": "Requestor", "name": "contact_type" }, { "value": "String of data goes here", "name": "address_line1" }, { "value": "CityName", "name": "city" }, { "value": "US", "name": "country" }, { "value": "XX", "name": "state" }, { "value": "XXXXX-AAAA", "name": "postal_code" } ], "contact": { "field": [ { "value": "a07nMzDQAU", "name": "sourceId" }, { "value": "Requestor", "name": "contact_type" }, { "value": "XXXX", "name": "first_name" }, { "value": "CCCC", "name": "last_name" }, { "value": "2221112222", "name": "phone_number" }, { "value": "test@test.com", "name": "email_address" }, { "value": "1111 NW 1st St", "name": "address_line1" }, { "value": "CCCCC", "name": "city" }, { "value": "United States", "name": "country" }, { "value": "CD", "name": "state" }, { "value": "11111", "name": "postal_code" } ] } } ] }, "ingredients": { "ingredient": [ { "field": [ { "value": "a041R8IbQAK", "name": "sourceId" }, { "value": "XXXXXXXXX", "name": "sssss_aaaaaa" }, { "value": "U8LYN0Y118", "name": "CCCC" }, { "value": "311218848", "name": "wwwwww_global_id" }, { "value": "String of data goes here", "name": "XXXXX_strength" }, { "value": "XX", "name": "numerator_unit" }, { "value": "12.00", "name": "numerator_strength" }, { "value": "1", "name": "denominator_unit" }, { "value": "1.00000", "name": "denominator_strength" }, { "value": "40", "name": "CCCCCC" }, { "value": "Month", "name": "xxxxx_frequency" }, { "value": "String of data goes here", "name": "age_group" }, { "value": "String of data goes here", "name": "xxxxx_form" }, { "value": "xxxxx", "name": "xxx_xxxx_xxx" }, { "value": "xxxxxx/ccccc", "name": "xxxxx_class" }, { "value": "0117984AB", "name": "xxxxx_xxxxx" }, { "value": "U8LY118", "name": "xxxxx_value" }, { "value": "xx", "name": "xxxxx_type" } ] } ] }, "xxxx_event_id": "00132542", "contacts": { "contact": [ { "field": [ { "value": "a070nMzEQAU", "name": "sourceId" }, { "value": "String of data goes here", "name": "contact_type" }, { "value": "XXXXXXXX", "name": "first_name" }, { "value": "CCCCCCCC", "name": "last_name" }, { "value": "+12223334444", "name": "phone_number" }, { "value": "test@test.com", "name": "email_address" }, { "value": "321 Drive", "name": "address_line1" }, { "value": "XXXXXXXXX", "name": "city" }, { "value": "United States", "name": "country" }, { "value": "VVVVVVV", "name": "state" }, { "value": "11111", "name": "postal_code" } ] } ] }, "attachment_metadata": { "total_attachment_count": 1, "application_attachment": { "type": "application", "submission_attachment": { "sub_submission": [ { "name": "String of data goes here", "attachment_count": 1 } ], "name": "String of data goes here" }, "name": "CCCCC" } }, "application": { "referencedMonographs": { "referencedMonograph": [ { "field": [ { "value": "a0Z3S000001YmynUAC", "name": "sourceId" }, { "value": "M009", "name": "ref_monograph_number" }, { "value": " String of data goes here", "name": "ref_monograph_description" } ] } ] }, "field": [ { "value": "5003872puQAA", "name": "sourceId" }, { "value": "XXXXX", "name": "application_type" }, { "value": "12345678", "name": "application_number" }, { "value": "Pending", "name": "application_status" }, { "value": "2023-08-02", "name": "application_status_effective_date" }, { "value": "Requestor", "name": "requestor_role" }, { "value": "test1", "name": "application_justification" } ] } } }, "eventType": "WE", "documentDestination": "Applications", "caseID": "5003871iIQAQ", "attachments": [ { "type": "docx", "storageLocation": "/XXXX/Data Stored HEre", "processedInd": "N", "name": "Test 3.docx", "fileSize": "11885", "fileId": "0683S000001o43hQAA", "file_metadata": [ { "value": "String of data goes here", "key": "docCategory" }, { "value": "1.1", "key": "sectionNumber" }, { "value": "Table of Contents", "key": "sectionName" }, { "value": "5003iIQAQ", "key": "sourceId" } ], "contentVersionId": "xxx/cccc/dddddd/0693hQAM/0683001QAA/Test 3.docx" } ] }", XXXX_MESSAGE_ID="7eewrty6e9-00ea-4e58-981f-3cn56igb82f", CREATED_BY="XXXX_CCC_APP", CREATED_DATETIME="2023-08-02 09:23:25", MODIFIED_BY="XXXX_CCC_APP", MODIFIED_DATETIME="2023-08-02 09:23:28", PROCESSED_STATUS="success"         Anyone have any ideas how I might accomplish getting the SUBMISSION_DATA field extracted properly? Thanks for the help ... View more

Hello I have a dashboard where I'd like to color the entire row based on the results of a field value. Currently its an XML dashboard and I have it setup to color the column but I'd like to color the entire row based on the field value. Here's the code for the dashboard:       <form version="1.1" theme="dark"> <label> Production Report</label> <fieldset submitButton="false" autoRun="true"> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Product Submission Details</title> <table> <search> <query>index=my_dbx sourcetype="my:dbx:details" | fillnull value="NA" SUPPORTING_DOC_NUMBER PRODUCT_SOURCE_KEY PROJECT_ID |stats count by ID INT_MESSAGE_ID APPLICATION_NUMBER APPLICATION_TYPE SUBMISSION_NUMBER SUBMISSION_TYPE SUPPORTING_DOC_NUMBER PRODUCT_SOURCE_KEY PROJECT_ID MESSAGE_STATUS MESSAGE_COMMENT LAST_UPDATE_TIMESTAMP | fields - count | sort - INT_MESSAGE_ID</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="MESSAGE_STATUS"> <colorPalette type="map">{"PRODUCTS NOT UPDATABLE":#DC4E41,"Project not Found":#DC4E41,"PRODUCTS UPDATE FAILED":#DC4E41,"PROCESS PRODUCTS":#F8BE34,"PRODUCTS UPDATED":#53A051}</colorPalette> </format> </table> </panel> </row>       Just trying to figure out how to accomplish this. Thanks for the assistance.   ... View more