Hi, I have a dashboard where I have a dropdown with three values A, B and C, now if I click on value A it should set panel A, and If I choose value B it should load panel B and same for C also. now that code I have developed but in the dashboard added a submit button and disabled searchwhenchange but still prior to click on submit button panels load automatically after choosing values from the dropdown. I need help on the submit button it should load panels only after clinking on the submit button. please find the code below which I have developed.     <form> <label>My Dashboard</label> <fieldset submitButton="true"> <input type="dropdown" token="dropdown_token" searchWhenChanged="false"> <label>dropdown_token</label> <default>A</default> <choice value="A">A</choice> <choice value="B">B</choice> <choice value="C">C</choice> <change> <condition match="'value'==&quot;A&quot;"> <set token="panelA">true</set> <unset token="panelB">false</unset> <unset token="panelC">false</unset> </condition> <condition match="'value'==&quot;B&quot;"> <unset token="panelA">true</unset> <set token="panelB">false</set> <unset token="panelC">false</unset> </condition> <condition match="'value'==&quot;C&quot;"> <unset token="panelA">true</unset> <unset token="panelB">false</unset> <set token="panelC">false</set> </condition> </change> </input> </fieldset> <row> <panel depends="$panelA$"> <table> <title>Panel A</title> <search> <query>index=a |table a b c</query> </search> </table> </panel> <panel depends="$panelB$"> <table> <title>Panel B</title> <search> <query>index=a |table a b c</query> </search> </table> </panel> <panel depends="$panelC$"> <table> <title>Panel C</title> <search> <query>index=a |table a b c</query> </search> </table> </panel> </row> </form>     ... View more

While configuring the AAD User log, I am getting this error. Is there anyone who can help me regrading this?   ---------------------------------------------------------------------------------------- 2020-12-22 08:42:59,793 ERROR pid=13688 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\ta_ms_aad\aob_py3\modinput_wrapper\base_modinput.py", line 128, in stream_events self.collect_events(ew)   File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\MS_AAD_user.py", line 76, in collect_events input_module.collect_events(self, ew)   File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\input_module_MS_AAD_user.py", line 36, in collect_events users_response = azutils.get_items_batch(helper, access_token, url)   File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\ta_azure_utils\utils.py", line 55, in get_items_batch raise e   File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\ta_azure_utils\utils.py", line 49, in get_items_batch r.raise_for_status()   File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\ta_ms_aad\aob_py3\requests\models.py", line 940, in raise_for_status   raise HTTPError(http_error_msg, response=self)   requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://graph.microsoft.com/beta/users/ -------------------------------------------------------------------------------------------------------------------   Thanks in advance .... Collapse ... View more

|from datamodel:"Threat"."Threat_one" |search * and |datamodel Threat Threat_one search both of these queries is working every 15 minutes but after 15 minutes it's not working and so on. This is happening with this "Threat" data model only.   Could you pls help me to fix this out.   Thanks in advance ... View more

Hi, Suppose I have an alert, whenever that alert will trigger it should return a unique result only, I don't want those previous results of that same alert. If my alert "A" triggering at "A1" time it will return  "R1" results, at "A2" time it should return "R2" results not "R1+R2" and at "R3" times it should return "R3" results not "R1+R2+R3"   Please tell what are the things that I need to consider, Alert search - index=jira  "issue is not fixed" condition- If  number of results is greater than Zero corn schedule - */5    8-10   *   *   * time range - last 24 hours  Trigger - Once     Thanks in advance 🙂   ... View more

Hi, I am using Splunk add on for Unix and Linux to get my CPU and iostat data of my hosts. Everything is working fine but only iostat data is not coming. [script://./bin/iostat.sh] interval = 60 sourcetype = iostat source = iostat                                                                                                                                                                                            index = linux disabled = 0 and I have already installed sysstat package. ... View more

Hi, I am having some problem to understand the usage of "(?msi)" with rex command,please help me regarding that? ... View more