We have a simple report which collates several lookups into a single lookup each night to support our dashboards. We recently added a dbxlookup command to add their user_id from one system, but for whatever strange reason, this causes other source fields to be vanish from the final report. See below... | inputlookup region1_employees.csv | append [ inputlookup region2_employees.csv ] | append [ inputlookup region3_employees.csv ]  ... do a bunch of stuff...(ldapfilters, etc..) ... add user_id from database... | dbxlookup connection="DATABASE" query="SELECT User_Id,User_Login FROM db.Users" "User_Login" AS "User_Login" OUTPUT "User_Id" AS "User_Id" | table Email_Address Name Position Site User_Id User_Login User_First_Name User_Last_Name userAccountControl If the dbxlookup is NOT included in the report, all fields are returned (except User_Id of course).  When the dbxlookup function is included, some fields are blank in the table (e.g. Position and Site have no values in this example).  What is going on?!?! ... View more

Hey community, another weird question.  We have scheduled reports which use dbxlookups to enrich the data for analysis.  Unfortunately, the reports are hitting resource/timeout limits and can't be run in subsearches. To resolve this, we had thought about running the initial report and collect results into a results index.  The report would then spawn separate reports by regions (from lookup defining these regions) to break the reports into manageable chunks.  For example... initial search ... | collect index=initial-results addinfo=false | savedsearch report-by-region host-region=[ inputlookup host-regions.csv ] Or would we need to use the map command in this case?  Based on my research, it is unclear if the savedsearches would be constrained by the resources limits on the initial search. Of course, we could also run the initial search at 1am, then the savedsearches at 1:15 with logic to hold until primary search completes, but this brings it's own complexity. Am I missing an obvious solution??? ... View more

Hello all, we recently migrated some of our legacy dashboards to Dashboard Studio and running into issues with text inputs where the value could be optional.  In legacy dashboards, this could be handled by adding a wildcard in the search, but in Dashboard Studio the visualizations refuse to run if there is no value, so we added "*" as the default value. Unfortunately, when the user tabs between the text inputs, Splunk doesn't highlight the field, so they sometimes enter text after the asterisk, causing the search to find ZERO values (really Splunk, really?). My research has not found a simple solution to this issue, so we came up with this. We use a default value of " " for all text inputs. If the user enters anything in a field, Splunk strips the leading space (yay!), but if a blank field is left, Splunk retains the blank space (WTF?). To work around this, we came up with the following search logic to handle the blanks, but at least the dashboard now allows blank inputs as wildcards (just like the legacy dashboards...).  | makeresults | eval USER_FIRST_NAME=ltrim("$INPUT_USER_FIRST_NAME$"," ") + "*" | eval USER_LAST_NAME=ltrim("$INPUT_USER_LAST_NAME$"," ") + "*" | eval USER_ID=ltrim("$INPUT_USER_ID$"," ") + "*" | map [ | tstats summariesonly=false count from datamodel=test where User_First_Name="$$USER_FIRST_NAME$$" User_Last_Name="$$USER_LAST_NAME$$" User_Id="$$USER_ID$$" by User_First_Name User_Last_Name User_Id Tenant_Code ] So, here is my actual question.  Is there a way in Dashboard Studio to do this properly that I'm just missing?  If not, is there another way to manage this without the "map" function as shown above?  Not a fan of using this, but we found no other way to make this work. Enquiring minds need to know!  Thanks in advance. ... View more

Hey, we've been playing with the jellyfisher tool to perform some fuzzy matching of similar user names / email addresses in audit logs.  It's good at names with close matches but characters changed, where it falls down are names which sound similar phonetically but not written.  Are there any functions or TAs that add this capability?  Thanks! ... View more

Hey there, we've built a dashboard in Dashboard studio which includes a report in table format. When users select export, it defaults to PNG and must select CSV.  Is there any option in XML or JS to disable PNG export, or perhaps create a custom EXPORT TO CSV button for this purpose??? Enquiring minds need to know! ... View more

Hey, something we haven't dug into seriously yet are the anomaly detection functions of Splunk.  Specifically, we're looking to develop a search that flags out of bounds events for further analysis. Example, user generally accesses 9 to 5 everyday, then randomly accesses at 11pm one evening, report this. Is there a way to do this with the built in functions and not require an external tool or AI/ML model? If you could even point me to some resources with examples, that'd be great.  Thanks! ... View more

We have a weird situation not sure how to work around. Our Splunk instance ingests an audit log which includes events from multiple departments. In our reports, we use DBXLOOKUP to enrich the data in the results. Unfortunately, although the table names are the same for each department, the database name is different. Is there anyway to create a dynamic dbxlookup to insert a different database name based on the department ID?  (perhaps using a search macro???)  I'd hate to create a dozen static dblookups for this. Any report changes would need to be updated in all those separate lookups... 😞 Any suggestions would be helpful.  Thanks! ... View more