Thanks @gcusello I somehow could achieve the requirement using srchIndexesDisallowed. However new issue that has come up with is there are few users who belong to multiple roles and restriction takes precedence. Is there a way I can prioritise role settings to take priority over the combined role for user with multiple roles. ... View more

no we have 53 indexes and around 20+ roles. Is it advised to edit it that way? Is there no simple way of just excluding based on the index name? ... View more

Thanks @gcusello , I have defined same settings for all roles and for the super-user I have defined it as srchFilter = *. As mentioned for the super user things are working as expected. However for all other users instead of restricting users from searching data from index specified in srchFilter, it is restricting searching content from all indexes except for index=_*. I fail to understand. I did execute btool also to ensure that there is no other setting that is overriding such that none of the indexes are searchable for other users, i didnt find anything except for what I specified. ... View more

Perfect, works like a charm 😄 Just one last question, is there a way I can hide numbers/values from being displayed / in other words change font color to be same as the background color! Thanks, Sowmya ... View more

@gcusello is there a way I can assign a token with entire search query including the wild card characters. <input type="dropdown" token="" searchWhenChanged="true"> <choice value="1">xxxxx</choice> <choice value="2">yyyyy</choice> <change>       <condition value="1">           <set token="search_query"> index=ssss "<base search criteria>" | rex command to execute 2 fields | eval for date time conversion | timechart | eval to validate range to find if the count was in expected range </set>  ------- code breaks here with error - Unexpected close tag Basically the rex which has wild card character search is the cause for the error. Am trying to find which is the character that I should escape. Struggling to figure out as I have all characters in there _,.*()\ etc., Any help in this regard would be much appreciated ... View more

I wish what am trying to achieve is as simple as I conveyed. I did try setting a base query and then tried rebuilding query based on panel. However this is again adding too many panels to get the right query to be executed. I stumbled upon this discussion "https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-dashboard-panels-dynamically/td-p/122660?_ga=2.178741927.2024986498.1668679854-1592284181.1662095880&_gl=1*1ipaga9*_ga*MTU5MjI4NDE4MS4xNjYyMDk1ODgw*_ga_5EPM2P39FV*MTY2ODY3OTg1My45Ni4xLjE2Njg2Nzk4NjIuNTEuMC4w" . Here search query is set based on change of dropdown value and in the panel just execute to visualise the chart with right values(referring to the solution by gyslainlatsa) . However when I tried doing the same, I am getting an error which says unexpected close tag. I also noticed later that it was a very old thread with reference links broken.  Any idea how I can achieve this in latest version.  My search query I am trying to set as token on condition value looks like this: index=ssss "<base search criteria>" | rex command to execute 2 fields | eval for date time conversion | timechart | eval to validate range to find if the count was in expected range Basically the rex which has wild card character search is the cause for the error. Am trying to find which is the character that I should escape. Struggling to figure out as I have all characters in there _,.*()\ etc., Any help in this regard would be much appreciated ... View more

I am not sure if I have conveyed my question right. I mean to write code for just one panel which is capable of displaying based on the requirement. I don't want to  write too many queries/lines of code which will make it hard to maintain when the number of options in the dropdown is expected to exceed beyond 20! ... View more

are you saying that I need to have hardcoded panels set and just set or unset token based on the value selected. Is that right! What I mean is I will have one panel which caters to the need of displaying based on selected value "index=population name=<$dropdownvalue> | timechart count sum(people) span=1d" and remaining 5 panels with 5 different queries "index=population name='USA' | timechart count sum(people) span=1d" and 4 more with respective name. Based on the value selected set/unset token to get required detail!  ... View more

perfect, it works like a charm 🙂 Thanks so much for your help.  ... View more

source code: <input type="dropdown" token="option">  <label>Choose from options</label> <fieldForLabel>labelval</fieldForLabel> <fieldForValue>options</fieldForValue> <search>    <query>| inputlookup keyvalue_pair.csv | stats count by value </query> </search> </input> Can you please elaborate how to modify this to set fieldForLabel from search query similar to the fieldForValue.   ... View more

This worked like charm. Thanks so much for your help. ... View more

Yes that's right. When I did expand the date range, this is the issue I have landed with. ... View more

But, replace("01-08-2021,02-08-2021,03-08-2021","01-08-2021,03-08-2021","") prints 01-08-2021,02-08-2021,03-08-2021. This is causing the issue in my case. What would you think is the best way to handle this! ... View more

Figured out the reason for inconsistency. Please see below result, when date doesn't follow the sequence replace doesn't work as expected. First row works as expected since date has a pattern, but second row onwards it fails because date has broken sequence as reports were missing on specific dates: BBBB AAAA 2021-07-28,2021-07-29,2021-07-30,2021-07-31,2021-08-01,2021-08-02,2021-08-03 2021-07-28,2021-07-29,2021-07-30,2021-07-31,2021-08-01,2021-08-02,2021-08-03 BBBB AAAA 2021-07-28,2021-07-29,2021-07-30,2021-07-31,2021-08-01,2021-08-03 2021-07-28,2021-07-29,2021-07-30,2021-07-31,2021-08-01,2021-08-02,2021-08-03 2021-07-28,2021-07-29,2021-07-30,2021-07-31,2021-08-01,2021-08-02,2021-08-03 BBBB AAAA 2021-07-28,2021-07-29,2021-07-30,2021-07-31,2021-08-01,2021-08-03 2021-07-28,2021-07-29,2021-07-30,2021-07-31,2021-08-01,2021-08-02,2021-08-03 2021-07-28,2021-07-29,2021-07-30,2021-07-31,2021-08-01,2021-08-02,2021-08-03 BBBB AAAA 2021-07-29,2021-07-30,2021-08-01,2021-08-03 2021-07-28,2021-07-29,2021-07-30,2021-07-31,2021-08-01,2021-08-02,2021-08-03 2021-07-28,2021-07-29,2021-07-30,2021-07-31,2021-08-01,2021-08-02,2021-08-03 ... View more

Its weird it works with one query and doesn't work for different query. Now when I try to use same logic, its purely replacing Dates with date!!!! Can you please explain the logic. ... View more

Apologies didn't mention the expected output result format: FN   |  FT  |      date          |                                    Dates                             |     Missing dates AAA BBB 03-08-2021 01-08-2021,02-08-2021,03-08-2021 01-08-2021,02-08-2021 AAA CCC 02-08-2021 01-08-2021,02-08-2021,03-08-2021 01-08-2021,03-08-2021 XXX BBB 02-08-2021 01-08-2021,02-08-2021,03-08-2021 01-08-2021,03-08-2021 XXX CCC 03-08-2021 01-08-2021,02-08-2021,03-08-2021 01-08-2021,02-08-2021 I am looking in for query to retrieve last column. ... View more

Thanks for that I now have a table with below  columns: FN | FT | date | Dates AAA | BBB | 03-08-2021 | 01-08-2021, 02-08-2021,03-08-2021 AAA | CCC | 02-08-2021 | 01-08-2021, 02-08-2021,03-08-2021  XXX | BBB | 02-08-2021 |  01-08-2021, 02-08-2021,03-08-2021 XXX | CCC | 03-08-2021 |  01-08-2021, 02-08-2021,03-08-2021 I am trying to compare date and Dates column and want to print missing dates as output. I tried using join and eventstats count command but somehow am not able to achieve without loosing FT/FN type. Can you please assist with this. ... View more

Eventually it has been found that the issue has been identified with the sslpassword. Old certificates were configured with sslpassword that started with a space. Example: " test123". Now when I try to store the same password in outputs.conf and restart the server, splunk is ignoring the leading space character. I have tried to add password in double quotes, single quotes, escaping with a forward slash - nothing seems to be helping with getting the right password encrypted. This is where am stuck now at.  ... View more