Hey @Richfez or @Splunkerninja , I've successfully ingested the Snowflake LOGIN_HISTORY and SESSIONS tables but I'm running into roadblock after roadblock with the ACCESS_HISTORY and QUERY_HISTORY table ingestions. https://docs.snowflake.com/en/sql-reference/account-usage/access_history https://docs.snowflake.com/en/sql-reference/account-usage/query_history These tables have a QUERY_ID field that looks like this:  a0fda135-d678-4184-942b-c3411ae8d1ce And a QUERY_START_TIME (TIMESTAMP_LTZ) field that looks like this: 2022-01-25 16:17:47.388 +0000 The Checkpoint value system for a Rising ingestion in the Splunk DB Connect app doesn't play nicely with either of these fields and I've tried creating temporary fields and tables to bypass this issues but not to avail. For the QUERY_ID, I tried removing the hyphens and replace the letters a,b,c,d,e,f with numeric values 1,2,3,4,5,6 and stored it in a different field called QUERY_ID_NUMERIC. When trying that out as the checkpoint value, the checkpoint never gets updated so it just ingests the same data over and over again. Similarly for the QUERY_START_TIME, I've tried casting the TIMESTAMP_LTZ to TIMESTAMP_NTZ and saved that as a new field QUERY_START_TIME_NTZ and that ingests the data but the checkpoint value isn't updating either. I was wondering if anyone has experienced this issue when ingesting these two data sources and if they've found any work arounds that resolved it! Thank you very much! ... View more

You can also set up the search that generates done_sending_email to run once a day before the main search executes. This way the done_sending_email.csv file will be cleared and the main search will send out emails to people every day. ... View more

Yes. I would understand it this way. The search will be run but the alert will not be triggered for the throttle period. So side efects of the search (outputlookup, sendemail, whatever) will be run on each search run ... View more

It shows out of memory in the log - this could be caused by large volumes of data coming in from 0365 events. You might consider changing the interval in the inputs for the collection. (I don’t know if this will fix it, but may help with the different inputs you may have, sounds like its bottlenecked somewhere ) Check the memory usage on the where this add-on is running (normally on a HF)  - perhaps you need to increase this if it’s very low. Have a look at the troubleshooting guide, there may items there to help further investigate. https://docs.splunk.com/Documentation/AddOns/released/MSO365/Troubleshooting ... View more

The rex command defaults to the _raw field.  Other fields must be explicitly referenced.  The following works in my sandbox. | makeresults | eval message="<UL> <LI> The first vulnerability occurs because Internet Explorer does not correctly determine an obr in a pop-up window.</LI> <LI> The t type that is returned from a Web server during XML data binding.</LI> </UL> <P> &quot;Location: URL:ms-its:C:WINDOWSHelpiexplore.::/itsrt.htm&quot; <P> :<P><A HREF='http://blogs.msdn.com/embres/archive/20/81.aspx' TARGET='_blank'>October Security Updates are (finally) available!</A><BR>" | rex field=message mode=sed "s/\<[^\>]+>//g"   ... View more

Ok, lets check if the results are available by just removing below from the dashboard depends="$hide_this_always$"  We need to confirm the sid is available since its part of the download path.  So either in the title of the panel or somewhere just display the token. If the result is available and sid is present, try using the URL directly in the browser to make sure that the result is fetched. Here is a sample dashboard created using the same logic and it works <dashboard version="1.1" theme="light"> <label>Download</label> <row> <!-- Below is the table with the results. We are setting the panel depends to a non existing token so that it always false the panel is not visible.--> <panel depends="$hide_always$"> <title>$sid$</title> <table> <search> <query>index=_*|stats count by sourcetype</query> <earliest>-15m</earliest> <latest>now</latest> <done> <eval token="date">strftime(now(), "%d-%m-%Y %H:%M:%S")</eval> <set token="sid">$job.sid$</set> </done> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel> <!-- Setting the title for testing purpose and making sure that the SID is available in the token --> <title>Job Id is : $sid$, Time is : $date$</title> <html> <a href="/api/search/jobs/$sid$/results?isDownload=true&amp;timeFormat=%25FT%25T.%25Q%25%3Az&amp;maxLines=0&amp;count=0&amp;filename=test_$date$.csv&amp;outputMode=csv" class="button js-button">Download</a> <style> .button { background-color: steelblue; border-radius: 5px; color: white; padding: .5em; text-decoration: none; } .button:focus, .button:hover { background-color: #2A4E6C; color: White; } </style> </html> </panel> </row> </dashboard> ... View more

Hi @Splunkerninja, I answered a similar question earlier this year: https://community.splunk.com/t5/Other-Usage/How-to-change-treemap-default-colors-for-categorical-colorMode/m-p/639216/highlight/true#M119  ... View more

@tej57 Thanks but how can i include _time as well in the result since after mvcombine the _time data gets dropped ... View more

Your value (3.17) isn't covered by any condition in your case function which is why you don't have a grade. What are the ranges for your grades? ... View more

@gcusello Yes, I did reduce upto 20 kb but still the image is not loading. ... View more

I gave dummy URL here, but i do have one private URL where it is working fine ... View more

Your example seems to change the underscore to a hyphen (I have assumed that this is a typo). Also, your criteria is not very precise, so I have assumed that you mean not an underscore, followed by an underscore, followed by not an underscore somewhere in the name. | eval APP=if(match(name,"[^_]_[^_]"),name,null()) | eval Host=if(match(name,"[^_]_[^_]"),null(),name)  You may need to adjust the match expression if the criteria I have  used is not what you meant.  ... View more

Has the data already been deleted?  If so, submit a request to Splunk Cloud Support.  They may be able to recover the data, but be prepared for them to say "no". If the data has not yet been deleted then how to re-index data depends on how it was onboarded in the first place, whether the original source is still available, and what portion (if not the whole) of the data must be re-indexed. ... View more

Hi @Splunkerninja , the only way to have different retention policies is to store logs in different indexes. Usually you choose to have different indexes based on two parameters: retention policy and Access Grants. You cannot have different retention policies on data in the same index. This means that you have to create a rule on your Indexers or (if present) on Heavy Forwarders to override the default index value. Ciao. Giuseppe ... View more