Your email Id please... ... View more

Hi @laksman239, thanks for the assist. I was trying to use a data model field that an autolookup props.cong entry was more suitable for. props.conf entry: [my_source_type] LOOKUP-class = mylookup LookupID as SourceIdentifier OUTPUT LookupField Thanks! ... View more

I wasn't asking how to connect to the REST API. I can do that. I was asking how to pull down source files from my apps using the REST API. ... View more

Thanks Rich. ... View more

Hi @niketnilay, thank you for responding. The heatmap would get warmer for the sum of the numbers. I essentially want the heatmap of the second chart applied to the first chart. (The second just shows the sum of the numbers from the first). ... View more

niketnilay, This is a fantastic solution. Thank you. I didn't know that I could hide a row and add custom css from the style tag in a panel. Neat!! Best, Ben ... View more

This absolutely works, multi-values and all. I suggest converting this to an answer so the poster can accept it. ... View more

@kamlesh_vaghela, instead of using <init> section, I would use submit button so that search runs when user confirms after providing both model and make. <fieldset submitButton="false"> I would also add depends to row, so that row is displayed only when both tokens are present. <row depends="$tkn_make$,$tkn_model$"> Finally, the search query should filter results as early as possible which would be in the base search i.e. <query> <YourBaseSearch> Make="$tkn_make$" Model="$tkn_model$" | <YourRemainingSearch> </query> ... View more

@behudelson, second search is a run anywhere search. From the | stats command onward you can try out one command at a time to see and understand how each one of them behave. You should also refer to Splunk Docs for each command used for reference. For example, transpose command has a default limit of 5. You will definitely have more zip codes than that, so you may have to use transpose with required limit. | transpose 5 header_field="zip" column_name="ethnicity" http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transpose Do let us know if you have any questions and accept the Answer once your issue is resolved 🙂 ... View more

Just in case anyone is still seeking an answer to this question. somesoni2 is partially correct. Configure your link as follows: ...... <link> <![CDATA[/app/search/seconddashboard?form.sourcetype=$click.name2$&form.field1.earliest=$earliest$&form.field1.latest=$latest$]]> </link> ...... In the link above the token name is the same name as the token name in the destination dashboard. In this case, it is using the default names. If you then configure your destination dashboard panels to use the Shared Time Picker (field1), the panels will load with the intended values. You should not have to change any Simple XML markup on the destination page for this to work. ... View more