How do you get a Saved Search to ignore a specific automatic lookup? The reason for wanting to do this is because the lookup being used is very large and the enrichment is not needed for a specific search. Using something like | fields - FieldA FieldB Did not not speed up the search (where FieldA and FieldB are fields that are matched on in the automatic lookup) When the automatic lookup has the permissions changed to just one app then the saved search runs very fast but I do not believe keeping it like that is an option. Ideally there would be an option that could be a setting just for this one saved search so that it would not know the automatic lookup exists. Thanks in advance for any suggestions. ... View more

Using the classic type dashboards I'm able to have simple script run on load of the dashboard by adding something like: <dashboard script="App_Name:script_name.js" version="1.1"> But adding this to a dashboard created using Dashboard Studio the script does not run. How do you get a script to run on load of a dashboard that was created with Dashboard Studio?    ... View more

Is there a suggested size of lookup that would be the maximum size of a lookup that should be used for an automatic lookup? Such as if your lookup exceeds more than x rows it would best not to use with an automatic lookup?     ... View more

Example of issue encountering: Search one returns a row with all the fields populated | makeresults count=1 | eval tmp_field1="abc" | lookup kvstore_name field1 AS tmp_field1   Search two returns a row with most of the fields empty (even though it is a search of the same row in the kvstore - just using a different field) | makeresults count=1 | eval tmp_field2="xyz" | lookup kvstore_name field2 AS tmp_field2 What could cause the results described above? (any recommendations would be greatly appreciated)     ... View more

If you have a dashboard that has a panel with a  search like the one below: | rest splunk_server=* /services/-/-/admin/......../appName/local | table name splunk_server title How can you make it so that it searches the other search heads? (a search like the one above returns values for the current search head and its peers - indexers)    ... View more

What is the best way (globally for all apps) to detect and report on either the creation of a new file in a /appname/local/ directory of an app OR when a file has been updated within a local directory of an app.  Thanks! ... View more

Is there a more secure way to make client connection to splunk other than username and password (in conf file)? (such as system account using certificate?) ... View more