The only thing I found worked was to perform the following steps: 1. Change directories to: /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/install 2.  Execute the following command: for i in *.spl; do /opt/splunk/bin/splunk install app $i; done 3. Change is_configured = 0 to is_configured = 1 in /opt/etc/apps/SplunkEnterpriseSecuritySuite/local/app.conf 3. Restart Splunk services NOTE: Also works on 6.4.0 ... View more

Hi, Here is an example of how you get to these variables: search_results = self.search_results_info earliest = int(search_results.search_et) latest = int(search_results.search_lt) Hope this helps! Rivaan ... View more