You can use this with dbxquery, and you probably want to use the $token_name|u$ form to urlescape your query: <form> <label>Query_Builder</label> <fieldset submitButton="true"> <input type="dropdown" token="connection"> <label>Connection</label> <search> <query>| rest /servicesNS/-/-/db_connect/connections | table title</query> </search> <fieldForLabel>title</fieldForLabel> <fieldForValue>title</fieldForValue> </input> <input type="radio" token="options"> <label> Options </label> <choice value="shortnames=true">Short field names </choice> <choice value="shortnames=false"> Long field names </choice> </input> <input type="text" token="db_query"> <label>DB Query</label> </input> <input type="text" token="splunk_query"> <label>Splunk PostProcess Query</label> <default></default> </input> </fieldset> <row> <panel> <event> <title>| dbxquery connection=$connection$ query=$db_query|u$ $options$| $splunk_query$ </title> <search> <query>| dbxquery connection=$connection$ query=$db_query|u$ $options$ | $splunk_query$</query> <earliest>0</earliest> </search> <option name="count">10</option> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="rowNumbers">0</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <fields>[]</fields> </event> </panel> </row> </form> ... View more

Does: LINE_BREAKER = .{12}() SHOULD_LINEMERGE=false Work? Or possibly: TRUNCATE=12 ... View more

Give something like this a try: sourcetype=WinEventLog:Security EventCode=4660 OR EventCode=4663 | fields EventCode RecordNumber User_Name Object_Name Object_type Description_code | eval RecordNumber = if(EventCode==4660, RecordNumber - 1, RecordNumber) | stats values(Object_Name) as Name Values(Object_type) as Type values(User_Name) as user by RecordNumber Description_code host The trick here is subtracting one from the second event's recordnumber so it matches exactly. Alternatively you could do a transaction: sourcetype=WinEventLog:Security EventCode=4660 OR EventCode=4663 | fields EventCode RecordNumber User_Name Object_Name Object_type Description_code | transaction maxspan=3s host Description_code ... View more

You should configure any new indexes by putting an entry in an indexes.conf on the cluster master, then push out the configuration bundle. The cluster master will have an app under $SPLUNK_HOME/etc/master-apps/_cluster and you can add a new indexes.conf under the local folder there. Then you can distribute the configuration bundle. ... View more

I'd do it like this: | tstats count(dst_ip) AS cdip FROM bad_traffic groupby protocol dst_port dst_ip | tstats append=true count(dst_ip) AS cdipt FROM all_traffic groupby protocol dst_port dst_ip src_ip | stats sum(cdip) as cdip sum(cdipt) as cdipt values(src_ip) as src_ip by protocol dst_port dst_ip | search cdip>0 cdipt>0 does that give you what you want? ... View more