actually there is one thing that i forget to tell that i have made indexer standalone that these saved searches i have copied from search head ... View more

it is made by me I have admin role, searches are not disabled and enableSched = 1. ... View more

  also in future we would be Decommissioning the indexer after i have send the data to sh and then i will be sending data directly to sh ... View more

also in future we would be Decommissioning the indexer after i have send the data to sh and then i will be sending data directly to sh ... View more

ok let me explain briefly ,  we are making our search head a standalone . so now i want to send some important data from indexer which is currently being stored and onboarded from the source to Search head . Is this clear. ... View more

index=endpoint_defender source="AdvancedHunting-DeviceInfo" | rex field=DeviceName "(?<DeviceName>\w{3}-\w{1,})." | eval DeviceName=upper(DeviceName) | lookup snow_os.csv DeviceName output OS BuildNumber Version | lookup OS_Outdated.csv OperatingSystems as OS BuildNumber Version OUTPUT Outdated | fillnull value=false outdated | table DeviceName OS BuildNumber Version Outdated this is i am using but the problem is this line | lookup OS_Outdated.csv OperatingSystems as OS BuildNumber Version OUTPUT Outdated is not generating any results   ... View more

i am doing this but outdated is showing nothing   ... View more

it is working fine , but when i am refreshing the entire dashboard unsolved color becomes opposite meaning the panel which is showing green shows red and other panels are showing green .   ... View more

ok , so if both the options are checked then it all the panels should  be red , it will be green only if the count is 0 in the panel which means if the panel is showing 0. this is same if unsolved option is only checked. If solved is checked then all the panels color should be green . Hope I am clear this time. ... View more

NO for unsolved it will be red if the count is  0  then only the panel color will be green .  And for solved all panels should be green nothing should be red. ... View more

ok this is the source code <form version="1.1" script="solved3.js ,minor.js, warning.js , critical.js" theme="dark"> <label>SBC Monitoring</label> <fieldset submitButton="false"> <input type="checkbox" token="srStatus"> <label>Status</label> <choice value="1">solved</choice> <choice value="0">unsolved</choice> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>solved=</valuePrefix> <delimiter> OR  </delimiter> <default>0</default> <initialValue>1,0</initialValue> </input> </fieldset> <row> <panel> <title>MINOR EVENTS</title> <single> <search> <query>| inputlookup sbc_minor.csv | search $srStatus$ | stats count</query> <earliest>-30d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x118832","0xd41f1f"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> <drilldown> <set token="minor">minor</set> <unset token="major"></unset> <unset token="critical"></unset> <unset token="warning"></unset> </drilldown> </single> </panel> <panel> <title>MAJOR EVENTS</title> <single> <search> <query>| inputlookup sbc_major.csv | search $srStatus$ | stats count</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x118832","0xd41f1f"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> <drilldown> <set token="major">major</set> <unset token="minor"></unset> <unset token="critical"></unset> <unset token="warning"></unset> </drilldown> </single> </panel> <panel> <title>CRITICAL EVENTS</title> <single> <search> <query>| inputlookup sbc_critical.csv  | search $srStatus$ | stats count</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="rangeColors">["0x118832","0xd41f1f"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> <drilldown> <set token="critical">critical</set> <unset token="major"></unset> <unset token="minor"></unset> <unset token="warning"></unset> </drilldown> </single> </panel> <panel> <title>WARNING EVENTS</title> <single> <search> <query>| inputlookup sbc_warning.csv  | search $srStatus$ | stats count</query> <earliest>0</earliest> <latest></latest> </search> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="rangeColors">["0x118832","0xd41f1f"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> <drilldown> <set token="warning">warning</set> <unset token="major"></unset> <unset token="minor"></unset> <unset token="critical"></unset> </drilldown> </single> </panel> </row> <row> <panel> <title>MINOR ALERTS HISTORY</title> <chart> <search> <query>index=sbc-logs RAISE-ALARM | dedup S | rex field=_raw ".*Severity:(?&lt;Severity&gt;\D+);" | rex field=_raw "\[Time:(?&lt;Time&gt;.*)]" | rex field=Time "(?&lt;date&gt;.*)@" | rex field=_raw "RAISE-ALARM:(?&lt;Alarm_Type&gt;\w+)" | rex max_match=0 field=_raw ": \[(?&lt;Region&gt;\w+)\]" | rex max_match=0 field=_raw "\[\w+\d\](?&lt;message&gt;[^;]+)" | table Alarm_Type Region message IP Severity Time date | search Severity=minor | stats count as Total by date | appendpipe      [ stats count     | eval Message="No Minor Alerts"      | where count==0      | table Message      | fields - Alarm_Type Region message IP Severity Time date]  | transpose 0  | eval allnulls=1  | foreach row*      [ eval allnulls=if(isnull('&lt;&lt;FIELD&gt;&gt;'),allnulls,0) ]  | where allnulls=0  | fields - allnulls  | transpose 0 header_field=column   | fields - column</query> <earliest>0</earliest> <latest></latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>MAJOR ALERTS HISTORY</title> <chart> <search> <query>index=sbc-logs RAISE-ALARM | dedup S | rex field=_raw ".*Severity:(?&lt;Severity&gt;\D+);" | rex field=_raw "\[Time:(?&lt;Time&gt;.*)]" | rex field=Time "(?&lt;date&gt;.*)@" | rex field=_raw "RAISE-ALARM:(?&lt;Alarm_Type&gt;\w+)" | rex max_match=0 field=_raw ": \[(?&lt;Region&gt;\w+)\]" | rex max_match=0 field=_raw "\[\w+\d\](?&lt;message&gt;[^;]+)" | table Alarm_Type Region message IP Severity Time date | search Severity=major | stats count as Total by date</query> <earliest>0</earliest> <latest></latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>CRITICAL ALERTS HISTORY</title> <chart> <search> <query>index=sbc-logs RAISE-ALARM | dedup S | rex field=_raw ".*Severity:(?&lt;Severity&gt;\D+);" | rex field=_raw "\[Time:(?&lt;Time&gt;.*)]" | rex field=Time "(?&lt;date&gt;.*)@" | rex field=_raw "RAISE-ALARM:(?&lt;Alarm_Type&gt;\w+)" | rex max_match=0 field=_raw ": \[(?&lt;Region&gt;\w+)\]" | rex max_match=0 field=_raw "\[\w+\d\](?&lt;message&gt;[^;]+)" | table Alarm_Type Region message IP Severity Time date | search Severity=critical | stats count as Total by date | appendpipe      [ stats count     | eval Message="No critical Alerts"      | where count==0      | table Message      | fields - Alarm_Type Region message IP Severity Time date]  | transpose 0  | eval allnulls=1  | foreach row*      [ eval allnulls=if(isnull('&lt;&lt;FIELD&gt;&gt;'),allnulls,0) ]  | where allnulls=0  | fields - allnulls  | transpose 0 header_field=column  | fields - column</query> <earliest>0</earliest> <latest></latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>WARNING ALERTS HISTORY</title> <chart> <search> <query>index=sbc-logs RAISE-ALARM | dedup S | rex field=_raw ".*Severity:(?&lt;Severity&gt;\D+);" | rex field=_raw "\[Time:(?&lt;Time&gt;.*)]" | rex field=Time "(?&lt;date&gt;.*)@" | rex field=_raw "RAISE-ALARM:(?&lt;Alarm_Type&gt;\w+)" | rex max_match=0 field=_raw ": \[(?&lt;Region&gt;\w+)\]" | rex max_match=0 field=_raw "\[\w+\d\](?&lt;message&gt;[^;]+)" | table Alarm_Type Region message IP Severity Time date | search Severity=warning | stats count as Total by date | appendpipe      [ stats count     | eval Message="No Minor Alerts"      | where count==0      | table Message      | fields - Alarm_Type Region message IP Severity Time date]  | transpose 0  | eval allnulls=1  | foreach row*      [ eval allnulls=if(isnull('&lt;&lt;FIELD&gt;&gt;'),allnulls,0) ]  | where allnulls=0  | fields - allnulls  | transpose 0 header_field=column  | fields - column</query> <earliest>0</earliest> <latest></latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel depends="$minor$"> <title>Minor Events</title> <table id="sbc_minor_table"> <search> <query>| inputlookup sbc_minor.csv | search $srStatus$ | eval Server_Name=case(IP == "10.2.96.35","US-SOU",IP == "10.82.10.245","KR-SEL",IP == "10.86.164.25","CN-SGH",IP == "10.86.68.25","CN-SHH",IP == "10.86.128.25","CN-SHA" ,IP == "10.20.41.90 ","DE-SLO",IP == "10.150.222.120","DE-BIE")</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$major$"> <title>Major Events</title> <table id="sbc_alarm_table"> <search> <query>| inputlookup sbc_major.csv | search $srStatus$ | eval Server_Name=case(IP == "10.2.96.35","US-SOU",IP == "10.82.10.245","KR-SEL",IP == "10.86.164.25","CN-SGH",IP == "10.86.68.25","CN-SHH",IP == "10.86.128.25","CN-SHA" ,IP == "10.20.41.90 ","DE-SLO",IP == "10.150.222.120","DE-BIE")</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$critical$"> <title>Critical Events</title> <table id="sbc_critical_table"> <search> <query>| inputlookup sbc_critical.csv | search $srStatus$ | eval Server_Name=case(IP == "10.2.96.35","US-SOU",IP == "10.82.10.245","KR-SEL",IP == "10.86.164.25","CN-SGH",IP == "10.86.68.25","CN-SHH",IP == "10.86.128.25","CN-SHA" ,IP == "10.20.41.90 ","DE-SLO",IP == "10.150.222.120","DE-BIE")</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$warning$"> <title>Warning Events</title> <table id="sbc_warning_table"> <search> <query>| inputlookup sbc_warning.csv | search $srStatus$ | eval Server_Name=case(IP == "10.2.96.35","US-SOU",IP == "10.82.10.245","KR-SEL",IP == "10.86.164.25","CN-SGH",IP == "10.86.68.25","CN-SHH",IP == "10.86.128.25","CN-SHA" ,IP == "10.20.41.90 ","DE-SLO",IP == "10.150.222.120","DE-BIE")</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   ... View more

ok so i have a drilldown so in this table there is a field solved which have default value 0 which means this particular severity is not solved . Now i want a button instead of 0 .like this now whenever a severity is being solved then when we click on this button it should change like this and this specific result  its value (solve field ) should be changed to 1. this is JS i am using but it is not working. plus ye script thi jo mai use kar raha hun   require([     'splunkjs/mvc/tableview',     'splunkjs/mvc/searchmanager',     'splunkjs/mvc',     'underscore',     'splunkjs/mvc/simplexml/ready!' ], function(     TableView,     SearchManager,     mvc,     _ ) {     var CustomLinkRenderer = TableView.BaseCellRenderer.extend({         canRender: function(cell) {             return cell.field === 'solved';         },           render: function($td, cell) {             var solved = cell.value;             var rowKey = cell.data.row.rowKey;               var icon = $('<a>')                 .attr("href", "#")                 .attr("title", "Mark as Solved")                 .css({                     "cursor": "pointer",                     "text-align": "center",                     "display": "inline-block",                     "width": "100%"                 });               icon.html('<i class="icon ' + (solved === "1" ? 'icon-check-circle' : 'icon-minus-circle') + '"></i>');               icon.on("click", function(e) {                 e.preventDefault();                   var $icon = $(this).find('i');                   // Only run update if not already solved                 if (solved === "1") {                     return; // Already marked as solved                 }                   $icon.removeClass("icon-minus-circle").addClass("icon-gear");                   var updateSearch = `                     | inputlookup sbc_major.csv                     | eval rowKey=tostring(rowKey)                     | eval match=if(rowKey="${rowKey}", "1", "0")                     | eval solved=if(match="1", "1", solved)                     | fields - match                     | outputlookup sbc_major.csv                 `;                   var updateManager = new SearchManager({                     id: "update-solved-" + _.uniqueId(),                     preview: false,                     cache: false,                     search: updateSearch                 });                   updateManager.on("search:done", function() {                     $icon.removeClass("icon-gear").addClass("icon-check-circle");                 });             });               $td.empty().append(icon);         }     });       var tableElement = mvc.Components.getInstance("sbc_alarm_table");     tableElement.getVisualization(function(tableView) {         tableView.table.addCellRenderer(new CustomLinkRenderer());         tableView.table.render();     }); });         ... View more

i want to implement it using JS is it possible? ... View more