Hello, Im trying to accumulate and analyze a persons risk score every day, once per day, and only fire when the total score for a given user esceeds a pre-determined threshold for that amount of time has been exceeded. for example, if I have a threshold chart for: 1 day 1 week 2 weeks 3 weeks 1 month 2 months  3 months  etc I want a running total of the all the persons generated risk, but I only want to review it when the accumulated total exceeds the threshold for the given period of time index=summary_events  |bin _time span=1d |table _time,user,base_score    | timechart useother=f span=1d sum(base_score) as total_score by user didnt produce the results I was expecting because it was only giving me the totals for that day, but not the accumulated total. the accum command doesn't seem to take a by clause.   kind of striking out on how to properly approach this.  would love some suggestions?     ... View more

I've run into a scenario where when running stats over an index, its possible I can generate a multivalue field with over 11K unique 38 character guid values but it can be as small as 1 38 character guid.  I have a need to pass those resulting guids as a string into something that has a character length limit of 999 characters. Is there a way whereby incrementing by 38 characters, I can split the field into multiple fields up to 950 characters max per field (which should be 25 guids), dynamically since I wont know how many are going to come in at any given time? ... View more

I have a scenario where I am analyzing the format of a given string to determine what the name of the format is (e.g. UPN, Samaccount, etc)  From there, I am trying to do a conditional enrichment via lookup to determine more information about the user in question.  The trouble is I have 4 "potential" systems of record the account could come from, and different authoritative key/value pairs to uniquely identify the user.  The good news is there is at least one value in each of these systems of record that is the same thing, so I need to normalize that down. My method of attacking this: user=jimbob@joe.com AccountType=(formula to determine "samact", "upn", or "other) I have to use lookup because inputlookup does not appear to have any idea what $variables$ are in an eval statement. SOR1_upn=if(AccountType = "upn", [makeresults count=1 |eval user=$user$ | lookup SOR1.csv userPrincipleName AS user | fields givenName |head 1|return $givenName], "") I would have expected this to work using normal subsearch logic, so I dont know if its a problem using it with eval or if there is some additional escape character I should be providing. Another method I thought of  for attacking this is just to create unique values for every possible outcome I want by  from the different SOR's with unique names, and then coalesce them all together but this seems like there should be a more elegant way to do this in splunk.   In summary, Identify the type of account it is, check 4 different sors for the presence of that account, return a fixed set of values that should ideally all represent the same individual if they do exist in more than one place from each one, and then coalesce them together ... View more

Greetings. I've been trying to build a correlation search that sets a default disposition value when it runs but so far it doesnt work as advertised.  I've tried this one of two ways:   1) manually setting it to a valid value e.g.     | eval disposition="disposition:7" | eval disposition_label="My cool disposition label"     2) by editing the correlation search in the advanced search editor and setting the parameter myself: I've tried this with and without quotes, but I still always get a disposition:6 set by default.   I have validated that this disposition and label does exist and is enabled in Incident Review settings, and can manually be set. Can someone shine some light on what I'm doing wrong? Many thanks! ... View more

I have a situation where I want to launch lookup editor in a new window, load a particular lookup and have a pre-determined filter that is set by a token on the dashboard I'm coming from.  All work BUT the filter portion because it appears that the filtering takes place in jquery and therefore I dont have a way to pass the string.  Is there a way to pass the string in the url with an undocumented property so that I can get the dashboard link to launch completely? ... View more

I'm still struggling getting some basic xml tokenization concepts working in Dashboard studio. I have a simple text box input someone types into.  from there, I want that to set a token that I use in the base search.  Next thing I want to do is take a field value pair in the results and set the value in a token to use in another panel thats going to fill in a URL and grab an image so: Base ds_lrth34 datasource: Textbox -> Chain Search off ds_lrth34 that runs        .. | fields MyField       I want to do something that I would have otherwise done this way in simple XML:       <set token="myField">$result.MyField$</set>        but I havent found a structure to make this work at all so that when I create an image viz I could do something like this:     "visualizations": { "viz_TRhGkelt": { "type": "viz.img", "options": { "src": "https://myCompany.sharepoint.com/_layouts/15/userphoto.aspx?AccountName=$MyField$&Size=L" } } },     This is heavily utilized methodology in our simple xml dashboards, I would love the right way to tokenize things like this in the new workflow. ... View more

I'm trying to set a new dashboard token on click of a country in a choropleth that would populate with the iso2 value of that country and feed other panels, but the only option in dashboard studio I have is for a custom url.  Is there a way to accomplish what I'm trying to do using Dashboard studio?   ... View more

Greetings. I'm trying to rewrite (because converting didn't work so well) a dashboard I'd written in simple xml to dashboard studio that heavily relies on search base.  Whenever I try to create a map viz object in studio, it only prompts me with the option to create a new data source.  However, I've already setup a search base and built multiple search chains off of it.  I'd like to reference the search chain to feed the visualization but I haven't been able to successfully do this.  Any ideas on how to approach it? ... View more

I've seen a few of my colleagues recently use a command called multireport which seems to be largely undocumented to solve some search conditions that have been very challenging to solve otherwise.  Is there a splunk dev who is close to the developer of multireport who would care to shed light into a full synopsys of how this command can be used and any potential arguments it accepts? ... View more

I'm trying to use a link list dropdown to fill in URL's of specific csv files from the splunk lookup editor app into a dashboard panel.  I've followed the instructions to re-enable iframes in splunk 8.0x+ and the frame itself forms, but its stuck saying "loading"  After doing some web browser debugging, it appears this is because the lookup editor app is calling javascript and there is an HTML tag that sets class="no-js" but I'm not a very good HTML debugger and I can't tell if this is being done in the parent apps css or in the child apps css.  I think however, if I could get the iframe to support the javascript I should be in good shape.  Its all the same splunk instance, but I haven't had any luck yet.  Any help is greatly appreciated! ... View more