I have a data model called DM1 with a data set called DM1. There are evaluated fields in this data set with different display names. I want to make a table with the displayNames, so I ran this query: | datamodel DM1 DM1 search | fields DM1* | table * However, this doesn't return the display names. It returns all the fields as DM1.. Is there a way to access the displayName when searching a data set this way? ... View more

I have an alert that is setup to send an email when there are no results. The search is returning an error, no results, but no emails are getting sent. Is there a way to make an error the trigger for an alert? ... View more

I have a dashboard with a panel with a table that depends on $time_tok.earliest$ from the time picker. I have an option in a dropdown, token=deployment, to reset the time tokens and thus hide the table: <input type="dropdown" token="deployment"> <label>Deployment</label> <choice value="choice1">choice1</choice> <choice value="choice2">choice2</choice> <choice value="choice3">choice3</choice> <choice value="&quot;&quot;">Select</choice> <change> <condition value="&quot;&quot;"> <unset token="time_tok.earliest"></unset> <unset token="time_tok.latest"></unset> </condition> </change> </input> When I select this option to reset the timepicker tokens, the table is successfully hidden, but the time tokens aren't being set when I click Submit, so the table is never unhidden. How do I achieve this? ... View more

I have a multiselect input in a dashboard with a token value in a list like "value1","value2","value3". I input this token into a saved search | savedsearch SearchName carrier=$carrier$ In the saved search, I have | where Carrier IN ($carrier$) But this is returning no results. How do I pass in this list of values to use in an IN operator? ... View more

I have the following dynamic multiselect: <input type="multiselect" token="carrier"> <label>Carrier</label> <delimiter>, </delimiter> <fieldForLabel>CarrierName</fieldForLabel> <fieldForValue>CarrierID</fieldForValue> <search> <query>| inputlookup carrierlist.csv where [| rest /services/authentication/current-context/context | where username !="splunk-system-user" | fields roles | mvexpand roles | join type=inner roles [| inputlookup role_parent_carrier.csv ] | table ParentCarrierID]</query> </search> </input> Whenever I change the value of a custom input type, the dynamic search runs again and usually fails. Here is the definition of this custom date picker: XML: <input type="text" id="date_earliest" token="earliest"> <label>Earliest</label> </input> <input type="text" id="date_latest" token="latest"> <label>Latest</label> </input> JS: $("[id^=date]").attr('type', 'datetime-local'); $('#date_earliest').on('change', function(e) { var early = getEpoch($('input[id^=date_earliest]').val().replace(/(?<=[0-9])(T)/, " ")); defaultTokenModel.set('earliest', early); }); $('#date_latest').on('change', function(e) { var latest = getEpoch($('input[id^=date_latest]').val().replace(/(?<=[0-9])(T)/, " ")); defaultTokenModel.set('latest', latest); }); Why are the .on('change'...) calls causing the search to run again? ... View more

I have an XML dashboard. I want to hide the filters when the submit button is clicked and just show the results table. What javascript do I have to write to achieve this? ... View more

I have a dashboard with a table that has a drill down which takes values from the selected row and runs a saved search with this as an input. It works perfectly fine in Firefox and Chrome, but in Internet Explorer it is not capturing all the necessary fields. How have others tackled this problem? ... View more

I have a scheduled report for the previous day's data that gets emailed. I'm trying to include the previous days date in the subject line. I've tried evaluating a field ReportDate in which the value is yesterday's date and then hiding the field since I don't want it in the report. I then put $result.ReportDate$, but this of course did not work since that field isn't included. Advice? ... View more

I have a report in which a date/time field is converted from GMT to MST/MDT, depending on if it is currently in Daylight Savings Time. Since DST ends/begins on a different date every year, how do automatically change which timezone to convert to in the query? ... View more