I strongly recommend moving to the new CustomAPI options instead of the older reports. The new layout is json based and provides more details and customizability.  Available in 2.10.5 so just upgrade and try it out. ... View more

If your upgrading from a previous version of DBX make sure you remove commands.conf from /local I was having issues ready to pull out my hair and finally figured this one out. ... View more

There is an update part of the higher ed public sector group created a Student Success Toolkit. Not sure if anything has been published contact your sales department. ... View more

https://community.servicenow.com/community?id=community_question&sys_id=32d91767db1feb404abd5583ca96192d&view_source=searchResult Only one I have seemed to have found ... View more

3 more weeks and not a peep... ... View more

Another month down... another year to wait? This ServiceCow mooooves slowly ... View more

This is not a feature Splunk supports. Scheduled reports do not support Tokens, and embedded reports can only be created from a scheduled report. There is no support for any data to affect the outcome of the search. You might be best to grant access to splunk and use an iframe of a dashboard providing that access but removing the headers and footers. Add this to the dashboard XML Or in the URL provided simple add hideChrome in the url arguments. ... View more

BRDR, It sounds like what you are looking for is the snoweventstream. http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usestreamingcommands The following example search creates an incident when CPU usage is 95 or higher. sourcetype="CPURates" earliest=-5m latest=now | stats avg(CPU) as CPU last(_time) as time by host | where CPU>=95 | eval contact_type="email" | eval ci_identifier=host | eval priority="1" | eval category="Software" | eval subcategory="database" | eval short_description="CPU on ". host ." is at ". CPU | snowincidentstream The following example search closes the above incident in ServiceNow version Eureka when CPU usage drops below 15. sourcetype="CPURates" earliest=-5m latest=now | stats avg(CPU) as CPU last(_time) as time by host | where CPU<15 | eval contact_type="email" | eval ci_identifier=host | eval state="7" | eval category="Software" | eval subcategory="database" | eval short_description="CPU on ". host ." is at ". CPU | snowincidentstream ... View more

Waiting for a mod to approve my answer but set the backfill time in the CIM Setup in Enterprise Security it is an issue where the backfill is extending beyond the earliest time of data. ... View more

There is a known issue with Data Model Acceleration and the backfill time. Set the acceleration.backfill_time = (some time no earlier than data in the index) This can be set in the CIM setup in Enterprise Security or in the datamodels.conf in etc/apps/Splunk_SA_CIM/local ... View more