Amazing!, thanks brother @squared_away , got your idea, i'm prefer using saved search because applicable for form.token , instead of put SPL query under value because required add backslash \  it's very simple we just create simple form { "type": "input.dropdown", "title": "Testing Multi Query", "options": { "items": [ { "label": "Query 1", "value": "| makeresults | eval key=\"value\" | table *" }, { "label": "Query 2", "value": "| loadjob savedsearch=\"admin:itsi:sla_availability\" artifact_offset=0" }, { "label": "Query 3", "value": "| savedsearch \"AWS - IPs available\"" } ], "token": "tos", "defaultValue": "" } }   And create the visualization with my example token $tos$ bellow :   ... View more

Hi,  I've solved my case,  basically there are 2 step : 1. Build correct job output on saved search, better to specific time format : | eval timeframe = strftime(_time, "%Y-%m-%d %H:%M:%S %Z") Output : timeframe hostname availability 2025-03-08 00:00:00 +07 HostA 100 2025-03-09 00:00:00 +07 HostA 100   2. On dashboard add time range panel rename token to $time_range$, then create handling to convert time to epoch  | loadjob savedsearch="admin:itsi:sla_availability" artifact_offset=0 | eval timeframe_epoch = strptime(timeframe, "%Y-%m-%d %H:%M:%S %z") | eval earliest_epoch = strptime("$time_range.earliest$", "%Y-%m-%dT%H:%M:%S.%3NZ") | eval latest_epoch = strptime("$time_range.latest$", "%Y-%m-%dT%H:%M:%S.%3NZ") | where timeframe_epoch >= earliest_epoch AND timeframe_epoch <= latest_epoch | table *   So, the output data will be specific time only :), as of know only date range selection only works, will test for dynamic selection like last 7 days, last 30 day, etc ... View more

Hi @isoutamo @PickleRick , Yes, you are correct, thats solution will be impact to security, i run this for testing purpose on Dev, just to see how splunk works with custom script sudo. My implementation is read log file based on crontab. ... View more

Continuoing last reply : Bellow my error during troubleshoot : 1. sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid'  -> Because splunk running as a root user, i have change back splunk to non-root user and see bellow error. 2. sudo: sorry, you must have a tty to run sudo -> Required !requiretty permission on /etc/sudoers   for me Splunk is powerfull tools, since i got this workaround, Ansible task can be done with splunk directly 🙂 ... View more

Hi, i have same case also, but now it's solved, bellow my workaround : 1. Add splunk user to /etc/sudoers splunk-user ALL=(ALL) NOPASSWD: ALL 2. Add !requiretty for splunk user Defaults:splunk-user !requiretty   For point no. 2, basically splunk running script on non-interactive environment by defaults, so we need add permission to pass it. Running manual the command in CLI is interactive, thats why we don't need !requiretty ... View more

Just got the way to fixed it, actually we check Episodes Processing Times located on "Event Analytics Monitoring" on ITSI Dashboard. Or just try bellow query : `itsi_grouped_alerts_index` OR `itsi_tracked_alerts_index` | rename _indextime as it | stats earliest(it) as it by index event_id | xyseries event_id index it | search itsi_grouped_alerts=* AND itsi_tracked_alerts=* | eval latency=itsi_grouped_alerts-itsi_tracked_alerts | fields itsi_tracked_alerts latency | bin itsi_tracked_alerts span=10m | stats p99(latency) as "99th Percentile Time" min(latency) as "Min Elapsed Time" median(latency) as "Median Elapsed Time" max(latency) as "Max Elapsed Time" by itsi_tracked_alerts | rename itsi_tracked_alerts as _time And go to the Job Manager, and search itsi_event_grouping [real-time], i just delete the job to refresh it, because the time is very huge. After that, i can see new job created & processing time decreased, Why processing time increase on 7 March ? actually we have incident on splunk which is creating 1000++ alert, seems after that processing time increased.     ... View more

Hi @guptap2 ,   are you resolving the case ? i have same case also & impacting the auto resolve ticket because based on the event time.   Please share if any suggestion from your experience.   Thanks. ... View more

I've facing this issue also, and currently it solved. First, need to see what actually is running, go to the console monitoring in the master. run bellow to find the search query/name. | rest /services/search/jobs | search isRealTimeSearch=1 | table sid, dispatchState, runDuration, search, eventCount, resultCount, title, provenance, label   And i found the what is search indicated high CPU Go to the job console in the top right side, and stop or delete the job.    Hopefully will be help.     ... View more

Hi @markkasaboski ,   Thanks, it's working for me. In my case, i have edit small code in Add-On & re-package. ... View more

Hi @harsmarvania57 ,   Thanks, it's working with BMC Helix integration 🙂 ... View more

Hi @tscroggins ,   Thank you for the script, it's very helpful to save my time 🙂 ... View more

Hi, I was got this issue also, direct access is able to connect but with splunk invalid error, even after add pg_hba.conf FATAL: no pg_hba.conf entry for host "10.24.154.215", user "AMDSPLUNK", database "IOU", SSL on   Actually the issue it was because drivers compatibility, in this case we can try bellow drivers : 1. Splunk DBX Add-on for Postgres JDBC | Splunkbase -> Add on, works for me  2. About the JDBC Driver for Postgres - Splunk Documentation -> With .jar file, not works, but in other environment its work.   You can try it, hopefully will help  ... View more