I'm trying to do a condition based action on my chart. I want to create a situation where when a legend is clicked the form.tail will change to take click.name2 (which is a number like 120 144 931 etc..) and when inside the chart a column is clicked a costume search will be opened (in a new window if possible if not same window will be just fine). based of checking if click.name is a number (and it's should be as it should be the name of the source /mnt/support_engineering... )   this is my current chart: <chart> <title>amount of warning per file per Tail</title> <search base="basesearch"> <query>|search | search "WARNNING: " | rex field=_raw "WARNNING: (?&lt;warnning&gt;(?s:.*?))(?=\n\d{5}|$)" | search warnning IN $warning_type$ | search $project$ | search $platform$ | chart count over source by Tail</query> </search> <option name="charting.chart">column</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option> <option name="refresh.display">progressbar</option> <drilldown> <eval token="form.Tail">if($click.name2$=$form.Tail$, "*", $click.name2$)</eval> </drilldown> </chart> The main problem is that whenever i even try condition inside the drilldown a new search is opened instead managing tokens no matter what the condition or what im doing inside. This is what I've tried so far: <drilldown> <!-- Handle clicks on Tail (Legend) --> <condition match="tonumber($click.name$) != $click.name$"> <eval token="form.Tail"> if($click.name2$ == $form.Tail$, "*", $click.name2$) </eval> </condition> <!-- Handle clicks on Source (Chart) --> <condition match="tonumber($click.name$) == $click.name$"> <link> <param name="target">_blank</param> <param name="search"> index=myindex | search "WARNNING: " </param> </link> </condition> </drilldown> click.name should be the name of the source as those are the columns of my chart   thanks in advanced to helpers ... View more

Im trying to set and unset a filter (manage token) based on click.name2 - if form.Tail=* i want to put click.name2, and if it's not * i want to put * (by that unsetting the token) I've tried 3 approaches and all had prolems. this is the chart config: <chart> <title>amount of warning per file per Tail</title> <search base="basesearch"> <query>|search | search "WARNNING: " | rex field=_raw "WARNNING: (?&lt;warnning&gt;(?s:.*?))(?=\n\d{5}|$)" | search warnning IN $warning_type$ | search $project$ | search $platform$ | chart count over source by Tail</query> </search> <option name="charting.chart">column</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option> <option name="refresh.display">progressbar</option> <drilldown> <set token="form.Tail">$click.name2$</set> </drilldown> </chart> when i try something like that:    <drilldown> <eval token="form.Tail">if("$form.Tail$"==* OR "$form.Tail$"=="ALL", "$click.name2$",*)</eval> </drilldown> nothing happens (i also tried something simpler like <eval token="form.Tail">if($form.Tail$ != $click.name2$, 111,222)</eval> but still nothing happens)   when i try this: <eval token="form.Tail">if("$form.Tail$" == "$click.name2$", "*", "$click.name2$")</eval>   it just puts $click.name2$ in the token when i try:         <drilldown> <condition match="form.Tail==*"> <set token="form.Tail">$click.name2$</set> </condition> <condition match="form.Tail!=*"> <set token="form.Tail">*</set> </condition> </drilldown> instead of managing token in the dashboard it open as search on the current tab by there exiting the dashboard. what am i doing wrong here? thanks in advanced to all helpers 🙂 ... View more

i have a problem with the mention warning on my search head:(attached photo) i tried following the guide here: Configure Dashboards Trusted Domains List - Splunk Documentation and run : curl -k -u admin:$password$ https://mysplunk.com:8000/servicesNS/nobody/system/web-features/feature:dashboards_csp -d dashboards_trusted_domain.exampleLabel=http://jenkins/ and got:  curl: (56) Received HTTP code 403 from proxy after CONNECT i tried running it on the splunk master and on some of the search heads and it didn't work. also tried  editting : /etc/system/local/web.conf with: [settings] dashboards_trusted_domains = http://jenkins https://jenkins and still the same error   what am i doing wrong? thanks in advanced to helpers! ... View more

i have events that contains a specific field that sometimes contain a very long field which make the rest of the event be truncated, i want to remove this field or change it "long field detected". the problematic field call "file" and i should catch it's last appearnce, also i want the data after it so i should stop the removal after the first "," (comma). also the event contains nested fields. i've tried props.conf+transform conf like that:ete but it doesn't work. here is an example for 1 event: deleted due to security reasons  ... View more

Hey, im trying to do something relative easy and for some reason can't make it.. i have a lookup named tableq_lookyp with only one column tableq with the values: 1,2,4,5,7,8,10,11,12,13,14,15,16,20,21,22 (each value is different row) and i have this search: index=myidnex sourcetype=mysourcetype source=mysource | table ACCUM_CODE LOCK_CODE PERIOD_KEY TABLEQ UPD_DATE UPD_TIME USER_NAME i want to check if all of the values from the tableq lookup exists in my search  so i should get 16 rows (as the amount of different values in tableq) and a new column with yes/no options that tell me if the value appear in the search/lookup or not  what is the best way of doing it?   thanks ! ... View more