I just moved over to a docker Splunk set up and im having an issue where Splunk thinks im in UTC even when the preferences are set to pacific, it thinks 15m ago was 12am when its 4pm here. I don't have anything special set up, in fact I carried over most of my settings from my local install but I don't know why this isn't working.   ... View more

I have a log that is putting the timestamp in UTC without any timezone, which appears Splunk thinks this is my time and I cannot get it to understand that the timezone is UTC Example log:   Feb 21, 2021 00:03:05.973 [0x7f6a027c5700] DEBUG - Completed: [127.0.0.1:42302] 206 PUT ... In my `$SPLUNK_HOME/etc/apps/search/default/props.conf` I have added: [default] TZ=GMT My timezone is set in preferences to -0800 (Pacific) but it still shows these as the same time. ... View more

I have a dashboard that is set up to do some conditions based on a change from an input and a date picker, however, this doesn't work when someone links into the dashboard and it pre-fills the inputs since Splunk treats that as the "initial value" and not a change. I don't want to set anything as the initial value because that will trigger the searches to fire off when when there’s nothing there, I.e. Someone doesn't link. So id like to keep the XML rejecting not to waste resources. Is there a way that I can set the tokens, perhaps in the <init> from the URL paramaters? I tried $form.field$ and that didn't seem to do anything. Thanks! ... View more

I am trying to set up a multiselect with dynamic options and want to use a scheduled report to do so, when I try to select my report it doesn't show up in the list, probably because the list is too large. However, I see something that says "This does not contain all reports. Add a report that is not listed from Reports." I can click on "Reports" but it just takes me to the list of reports and I can't find a way to select this report to be used for my Dynamic Options for my multiselect input ... View more

I have a dashboard (form) that I'm trying to allow a text field to accept single values or comma separated values that will be replaced by "* OR" right now when I first start up the dashboard and enter a single value, it just stays at "Search is waiting for input.." if I enter comma separated values it will run the search. I tried rapping the eval in a if statement to check for commas, but that didn't seem to do anything. Here is what I currently have: <input type="text" token="clientTransactionId" searchWhenChanged="true" id="webOrder"> <label>Transaction Id (for multiple use csv's):</label> <change> <eval token="clientTransactionId_formatted">if(like($clientTransactionId$, "%,%"),replace($clientTransactionId$,",","* OR"),$clientTransactionId$)</eval> </change> </input> And here is what I tried before: <eval token="clientTransactionId_formatted">replace($clientTransactionId$,",","* OR")</eval> How can I set this up to run? I need it to eval before search, there are too many transactions to filter after search has ran. Thanks! ... View more