Hello Splunk colleagues! I'm trying to create a new correlation search that generates a notable event, and uses a field I generate for the title.  The title field in the notable indicates I can use variable substitution, and I've verified that the field is being created for every event the correlation search generates.  the field is called my_rule_title In the notable event, I am putting in $my_rule_title$ and when the notable is generated, the rule title on incident review literally says "$my_rule_title$" and not the contents of the field my_rule_title. what am I doing wrong to get the rule title in incident review to display the value of my_rule_title?  the other variable substitutions I'm doing in the correlation search for $description$ and $urgency$ are working as expected, just not the title. ... View more

Im running splunk 9.0.5 (with no option to go to 9.1 right away), and I'm trying to do something I've done 1000 times in simple xml. The screenshot below describes it perfectly. I want to take the number in one panel, and multiply it by the number in a seond panel, and I want the answer to be in a third panel.  I can only appear to set drilldown tokens, but I just want to <set token="THISTOKEN">$result.THISFIELD$</set> and another <set token="THATTOKEN">$result.THATFIELD$</set> so that I can ... | eval RESULT=$THISTOKEN$*$THATTOKEN$ I would greatly appreciate anyone who can point me in the right direction to do this in studio....  I feel like I've time warped to Splunk 5.x here... ... View more

Hello, Im trying to accumulate and analyze a persons risk score every day, once per day, and only fire when the total score for a given user esceeds a pre-determined threshold for that amount of time has been exceeded. for example, if I have a threshold chart for: 1 day 1 week 2 weeks 3 weeks 1 month 2 months  3 months  etc I want a running total of the all the persons generated risk, but I only want to review it when the accumulated total exceeds the threshold for the given period of time index=summary_events  |bin _time span=1d |table _time,user,base_score    | timechart useother=f span=1d sum(base_score) as total_score by user didnt produce the results I was expecting because it was only giving me the totals for that day, but not the accumulated total. the accum command doesn't seem to take a by clause.   kind of striking out on how to properly approach this.  would love some suggestions?     ... View more

I've run into a scenario where when running stats over an index, its possible I can generate a multivalue field with over 11K unique 38 character guid values but it can be as small as 1 38 character guid.  I have a need to pass those resulting guids as a string into something that has a character length limit of 999 characters. Is there a way whereby incrementing by 38 characters, I can split the field into multiple fields up to 950 characters max per field (which should be 25 guids), dynamically since I wont know how many are going to come in at any given time? ... View more

I have a scenario where I am analyzing the format of a given string to determine what the name of the format is (e.g. UPN, Samaccount, etc)  From there, I am trying to do a conditional enrichment via lookup to determine more information about the user in question.  The trouble is I have 4 "potential" systems of record the account could come from, and different authoritative key/value pairs to uniquely identify the user.  The good news is there is at least one value in each of these systems of record that is the same thing, so I need to normalize that down. My method of attacking this: user=jimbob@joe.com AccountType=(formula to determine "samact", "upn", or "other) I have to use lookup because inputlookup does not appear to have any idea what $variables$ are in an eval statement. SOR1_upn=if(AccountType = "upn", [makeresults count=1 |eval user=$user$ | lookup SOR1.csv userPrincipleName AS user | fields givenName |head 1|return $givenName], "") I would have expected this to work using normal subsearch logic, so I dont know if its a problem using it with eval or if there is some additional escape character I should be providing. Another method I thought of  for attacking this is just to create unique values for every possible outcome I want by  from the different SOR's with unique names, and then coalesce them all together but this seems like there should be a more elegant way to do this in splunk.   In summary, Identify the type of account it is, check 4 different sors for the presence of that account, return a fixed set of values that should ideally all represent the same individual if they do exist in more than one place from each one, and then coalesce them together ... View more

Greetings. I've been trying to build a correlation search that sets a default disposition value when it runs but so far it doesnt work as advertised.  I've tried this one of two ways:   1) manually setting it to a valid value e.g.     | eval disposition="disposition:7" | eval disposition_label="My cool disposition label"     2) by editing the correlation search in the advanced search editor and setting the parameter myself: I've tried this with and without quotes, but I still always get a disposition:6 set by default.   I have validated that this disposition and label does exist and is enabled in Incident Review settings, and can manually be set. Can someone shine some light on what I'm doing wrong? Many thanks! ... View more

I have a situation where I want to launch lookup editor in a new window, load a particular lookup and have a pre-determined filter that is set by a token on the dashboard I'm coming from.  All work BUT the filter portion because it appears that the filtering takes place in jquery and therefore I dont have a way to pass the string.  Is there a way to pass the string in the url with an undocumented property so that I can get the dashboard link to launch completely? ... View more

I'm still struggling getting some basic xml tokenization concepts working in Dashboard studio. I have a simple text box input someone types into.  from there, I want that to set a token that I use in the base search.  Next thing I want to do is take a field value pair in the results and set the value in a token to use in another panel thats going to fill in a URL and grab an image so: Base ds_lrth34 datasource: Textbox -> Chain Search off ds_lrth34 that runs        .. | fields MyField       I want to do something that I would have otherwise done this way in simple XML:       <set token="myField">$result.MyField$</set>        but I havent found a structure to make this work at all so that when I create an image viz I could do something like this:     "visualizations": { "viz_TRhGkelt": { "type": "viz.img", "options": { "src": "https://myCompany.sharepoint.com/_layouts/15/userphoto.aspx?AccountName=$MyField$&Size=L" } } },     This is heavily utilized methodology in our simple xml dashboards, I would love the right way to tokenize things like this in the new workflow. ... View more

I'm trying to set a new dashboard token on click of a country in a choropleth that would populate with the iso2 value of that country and feed other panels, but the only option in dashboard studio I have is for a custom url.  Is there a way to accomplish what I'm trying to do using Dashboard studio?   ... View more

Greetings. I'm trying to rewrite (because converting didn't work so well) a dashboard I'd written in simple xml to dashboard studio that heavily relies on search base.  Whenever I try to create a map viz object in studio, it only prompts me with the option to create a new data source.  However, I've already setup a search base and built multiple search chains off of it.  I'd like to reference the search chain to feed the visualization but I haven't been able to successfully do this.  Any ideas on how to approach it? ... View more