I have a not-very-complicated query that returns a table of my roles and associated default search indexes. One role has no default search index (srchIndexesDefault), so that role's row contains no value for srchIndexesDefault. So far so good. Now, I want to filter out rows with no srchIndexesDefault value. Any one of the last three (commented out) lines in this query seem like they should do exactly that. But only the first of the three does. The other two produce no errors, but they also have no apparent effect, and I'd like to understand why. (The results you get from this query will depend on what roles and indexes you have access to.) | rest /services/authorization/roles | mvexpand srchIndexesDefault | table title, srchIndexesDefault, defaultApp | rename title as roles | join roles [| rest /services/authentication/users | search splunk_server=splunksearch* | table title, roles, defaultApp | mvexpand roles ] | table title, roles, srchIndexesDefault, defaultApp ``` | regex srchIndexesDefault!="^$" ``` ``` <--- This works ``` ``` | search srchIndexesDefault=* ``` ``` <--- This doesn't work ``` ``` | where isnotnull(srchIndexesDefault) ``` ``` <--- This doesn't work ```   ... View more

We have automation which compares installed versions of Splunk (universal forwarder mostly, but other instances) with released versions. Until very recently, we could easily scrape released Splunk versions from https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/CompatMatrix. However, that page now requires specific browsers, javascript, etc. which together makes pulling that data with curl particularly impractical. Is there a web-accessible static source of released Splunk versions that's usable by automated processes? ... View more