Drilldowns are not the same as alerts. Since you are asking about Dashboard Studio, I will assume you are interested in drilldowns. Version 9.0.0 of Splunk Enterprise has increased the options available in Dashboard Studio for dropdowns. For earlier releases, try using classic dashboards (SimpleXML) as there are more choices available there. ... View more

index="_internal" status="skipped" search_type="scheduled" | eval Scheduled=strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") | stats values(Scheduled) as Scheduled values(status) as Status values(user) as User values(savedsearch_id) as Savedsearch_id values(savedsearch_name) as Savedsearch_name values(reason) as Reason by _time,savedsearch_name | sort 0 - Scheduled | table Scheduled Status User Savedsearch_id Savedsearch_name Reason Hi, Removed restriction by sort 0 - Scheduled 　 ... View more

While I normally agree with almost everything that @woodcock says, I must disagree a bit here. I know of at least 1 session at .conf2018 where the audience was told that recording and slides would be published but when everything was posted, that session was not published at the presenter's request . So if the content is critically important to you, you should go and make your own audio recording and take pictures or you might not ever see it again. Also, be sure to monitor the #conf2020 slack channel and announcements inside the app or you will miss out on important details like Free drones while supplies last at the Community Lounge which lasted for about 3 minutes (no I did not get one) and also The "NOCturnal" TShirts are in booth XYZ near the FuBar in X Hall (I did get this). ... View more

thank you!!! It works like a charm. ... View more

kamlesh_vaghela, thanks for the input, thanks to you I have it working. But SourceA is not needed where it is. #2 SourceC is listed twice, and the 2nd time should be SourceA if it is removed from the beginning. The working command looks like this: [ search SourceB | dedup field1 | fields field1] OR [ search SourceB | dedup field1 | fields field1] | join field1 [ search SourceA | dedup field1 | fields field1] | table field1 | dedup field1 ... View more

I am updating my answer to include commenting out the lines in inputs.conf. This bug will be fixed in version 6.0.1 ... View more