Agreed. I will mark this as closed and raise a new question for what am trying to do. Thanks for your help ... View more

I had same understanding, thanks for confirming that. I am asked to modify the raw event that we receive in JSON format to include new key value pair and to replace the value of one of the field value for a specific key. ... View more

This was my last fall back option as I have multiple fields and the query would become lengthy. This also gives me the flexibility to add extra fields to the _raw event. I am just assuming that splunk has some inbuilt solution that I might be missing ... View more

thanks @dural_yyz . I was thinking of a solution where for a specific token I could enable HTTP protocol. I infer based on your comment and @Jawahir comment, I infer that its a global setting and cannot be changed for a specific token. I wonder why Splunk recommends to use HTTP for performance optimisation(referring to below statement from listed ref link). Sending data over HTTP results in a significant performance improvement compared to sending data over HTTPS. Troubleshoot HTTP Event Collector - Splunk Documentation ... View more

So this is a global setting and I cannot choose protocol per token is it? ... View more

Thanks @gcusello I somehow could achieve the requirement using srchIndexesDisallowed. However new issue that has come up with is there are few users who belong to multiple roles and restriction takes precedence. Is there a way I can prioritise role settings to take priority over the combined role for user with multiple roles. ... View more

no we have 53 indexes and around 20+ roles. Is it advised to edit it that way? Is there no simple way of just excluding based on the index name? ... View more

Thanks @gcusello , I have defined same settings for all roles and for the super-user I have defined it as srchFilter = *. As mentioned for the super user things are working as expected. However for all other users instead of restricting users from searching data from index specified in srchFilter, it is restricting searching content from all indexes except for index=_*. I fail to understand. I did execute btool also to ensure that there is no other setting that is overriding such that none of the indexes are searchable for other users, i didnt find anything except for what I specified. ... View more

Perfect, works like a charm 😄 Just one last question, is there a way I can hide numbers/values from being displayed / in other words change font color to be same as the background color! Thanks, Sowmya ... View more

@gcusello is there a way I can assign a token with entire search query including the wild card characters. <input type="dropdown" token="" searchWhenChanged="true"> <choice value="1">xxxxx</choice> <choice value="2">yyyyy</choice> <change>       <condition value="1">           <set token="search_query"> index=ssss "<base search criteria>" | rex command to execute 2 fields | eval for date time conversion | timechart | eval to validate range to find if the count was in expected range </set>  ------- code breaks here with error - Unexpected close tag Basically the rex which has wild card character search is the cause for the error. Am trying to find which is the character that I should escape. Struggling to figure out as I have all characters in there _,.*()\ etc., Any help in this regard would be much appreciated ... View more

I wish what am trying to achieve is as simple as I conveyed. I did try setting a base query and then tried rebuilding query based on panel. However this is again adding too many panels to get the right query to be executed. I stumbled upon this discussion "https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-dashboard-panels-dynamically/td-p/122660?_ga=2.178741927.2024986498.1668679854-1592284181.1662095880&_gl=1*1ipaga9*_ga*MTU5MjI4NDE4MS4xNjYyMDk1ODgw*_ga_5EPM2P39FV*MTY2ODY3OTg1My45Ni4xLjE2Njg2Nzk4NjIuNTEuMC4w" . Here search query is set based on change of dropdown value and in the panel just execute to visualise the chart with right values(referring to the solution by gyslainlatsa) . However when I tried doing the same, I am getting an error which says unexpected close tag. I also noticed later that it was a very old thread with reference links broken.  Any idea how I can achieve this in latest version.  My search query I am trying to set as token on condition value looks like this: index=ssss "<base search criteria>" | rex command to execute 2 fields | eval for date time conversion | timechart | eval to validate range to find if the count was in expected range Basically the rex which has wild card character search is the cause for the error. Am trying to find which is the character that I should escape. Struggling to figure out as I have all characters in there _,.*()\ etc., Any help in this regard would be much appreciated ... View more

I am not sure if I have conveyed my question right. I mean to write code for just one panel which is capable of displaying based on the requirement. I don't want to  write too many queries/lines of code which will make it hard to maintain when the number of options in the dropdown is expected to exceed beyond 20! ... View more

are you saying that I need to have hardcoded panels set and just set or unset token based on the value selected. Is that right! What I mean is I will have one panel which caters to the need of displaying based on selected value "index=population name=<$dropdownvalue> | timechart count sum(people) span=1d" and remaining 5 panels with 5 different queries "index=population name='USA' | timechart count sum(people) span=1d" and 4 more with respective name. Based on the value selected set/unset token to get required detail!  ... View more

perfect, it works like a charm 🙂 Thanks so much for your help.  ... View more

source code: <input type="dropdown" token="option">  <label>Choose from options</label> <fieldForLabel>labelval</fieldForLabel> <fieldForValue>options</fieldForValue> <search>    <query>| inputlookup keyvalue_pair.csv | stats count by value </query> </search> </input> Can you please elaborate how to modify this to set fieldForLabel from search query similar to the fieldForValue.   ... View more

This worked like charm. Thanks so much for your help. ... View more

Yes that's right. When I did expand the date range, this is the issue I have landed with. ... View more