With a search I would like a result that does NOT match an element in a list For instance:       index=myindex source="mysource_*" earliest-30m       I'd like to compare the sources against a list, such as:       ("*one","*two","*three")       If the search results, for instance, DON'T include events with the source "mysource_three" I would like a result that states this.  Ultimately, I'm looking to create an alert based on the query; if there are no events seen from some sources in the last 30 minutes. ... View more

How can I get the my queries to update when I change the contents of the multiselect input (Select Users)?  Right now, the data will only update the data with the updated $user_tok$ when changing the selection in the Log type dropdown:     <form> <label>Data Lookup</label> <description>Display stats for a given user</description> <search id="baseSearch"> <query>index=source_db sourcetype=source_type Username="*$site_tok$*" | table _time,_raw,Username,roundtrip_ms,client_to_agent_packetloss</query> <earliest>$time_tok.earliest$</earliest> <latest>$time_tok.latest$</latest> </search> <fieldset submitButton="false" autoRun="true"> <input type="text" token="site_tok" searchWhenChanged="true"> <label>Enter Site</label> <default></default> </input> <input type="time" token="time_tok" searchWhenChanged="true"> <label>Date</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="multiselect" token="user_tok" searchWhenChanged="true"> <label>Select Users</label> <search base="baseSearch" id="user_search"> <query>| eval Username=mvindex(split(Username,"\\"),-1) | dedup Username | sort Username</query> </search> <fieldForLabel>Username</fieldForLabel> <fieldForValue>Username</fieldForValue> <valuePrefix>Username="*</valuePrefix> <delimiter> OR </delimiter> <valueSuffix>"</valueSuffix> </input> <input type="dropdown" token="result_type" searchWhenChanged="true"> <label>Log type</label> <choice value="P_LOSS">Packet Loss</choice> <choice value="MGMT_PROTO_DATA">Latency</choice> <default></default> <change> <condition label="Latency"> <unset token="result1"></unset> <set token="result1">| search _raw="*$result_type$*" $user_tok$ | where roundtrip_ms!=" " | sort _time | table _time,_raw,roundtrip_ms</set> <unset token="result2"></unset> <set token="result2">| search _raw="*$result_type$*" $user_tok$ | where roundtrip_ms!=" " | sort _time | eval roundtrip_ms=roundtrip_ms | timechart span=1s values(roundtrip_ms) BY Username</set> </condition> <condition label="Packet Loss"> <unset token="result1"></unset> <set token="result1">| search _raw="*$result_type$*" $user_tok$ | table _time,_raw,client_to_agent_packetloss</set> <unset token="result2"></unset> <set token="result2">| search _raw="*$result_type$*" $user_tok$ | eval packet_loss=client_to_agent_packetloss | timechart span=1s values(packet_loss) BY Username</set> </condition> </change> </input> </fieldset> <row> <panel> <title>Performance statistics</title> <chart> <search base="baseSearch"> <query>$result2$</query> </search> <option name="charting.chart">line</option> <option name="charting.chart.nullValueMode">connect</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> <table> <title>Query Data</title> <search base="baseSearch"> <query>$result1$</query> </search> </table> </panel> </row> </form>     ... View more

I've combed through many similar questions, but no resolutions thus far have worked for me: Issue: - unable to get past http://servername:8000/en-US/app/splunk_app_db_connect/ftr#/welcome - Upon first launch of the App, an error briefly pops up: "Cannot communicate with task server, please check your settings" - In output of: "./splunk cmd splunkd print-modinput-config --debug server" I see: =================================================== Found scheme="server". Locating script for scheme="server"... Found script "/opt/splunk/etc/apps/splunk_app_db_connect/linux_x86_64/bin/server.sh" to handle scheme "server". Introspecting scheme=server: /usr/lib/jvm/java-11-openjdk-amd64/bin/java: symbol lookup error: /usr/lib/jvm/java-11-openjdk-amd64/bin/java: undefined symbol: JLI_InitArgProcessing Introspecting scheme=server: script running failed (exited with code 127). Unable to initialize modular input "server" defined in the app "splunk_app_db_connect": Introspecting scheme=server: script running failed (exited with code 127).. What I've tried thus far: - manually uninstalled and reinstalled the App, and restarting splunk - added: /etc/ld.so.conf.d/java.conf -- With the single-line contents (added to new Docker image): /usr/lib/jvm/java-11-openjdk-amd64/lib/jli System: Splunk 8.0.3, dockerized on Debian 10 Open JDK 11 DB Connect 3.3.0 JAVA_HOME is set to: /usr/lib/jvm/java-11-openjdk-amd64/ ... View more