Hi, I have a table with fields such as Department, and days of the week spanning from Monday to Sunday. These fields dynamically update after midnight on Monday, reflecting the current date. For example, today's field name would appear as 'Wednesday 24/04/2023'. How can I adjust my XML to change the color of the value rows? The XML provided works when excluding the date, but fails to function when the date is included. I've considered using a "like" function,, something like:   <format type="color" field=like("Department")> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format>     But couldn`t get to the bottom of it.   Existing XML:     <format type="color" field="Department"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Monday"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Tuesday"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Wednesday"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Thursday"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Friday"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Saturday"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Sunday"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format>     ... View more

Hi Everyone, Has anyone managed to successfully use the "Akamai Prolexic DNS GTM and SIEM API (Unofficial)"  app ? I keep getting this error when testing the Prolexic API data input:         Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\akamai-api-integration\bin\akamai_api_integration\aob_py3\urllib3\connection.py", line 175, in _new_conn (self._dns_host, self.port), self.timeout, **extra_kw File "C:\Program Files\Splunk\etc\apps\akamai-api-integration\bin\akamai_api_integration\aob_py3\urllib3\util\connection.py", line 72, in create_connection for res in socket.getaddrinfo(host, port, family, socket.SOCK_STREAM): File "C:\Program Files\Splunk\Python-3.7\lib\socket.py", line 752, in getaddrinfo for res in _socket.getaddrinfo(host, port, family, type, proto, flags): socket.gaierror: [Errno 11001] getaddrinfo failed         The official Akamai SIEM app was not designed to ingest the Prolexic API so unfortunately is of no use to me. Many thanks. ... View more

Hi Everyone, We`ve created a new TA to get data in from an API - this was done on the HF and the data is being sent to our Cloud instance, however the field values are getting duplicated. Tried changing the INDEXED_EXTRACTIONS and KV_MODE settings on the HV as explained by many others without success. In Cloud there wasn`t a source type for this data feed, so we`ve created one manually and set INDEXED_EXTRACTIONS = none and KV_MODE = json however this made no change.  I`ve also added a stanza in local.meta on the HF as suggested by others as follows: export = system. Here`s a snap of the sourcetype stanza on the HF. As you can see INDEXED_EXTRACTIONS  and KV_MODE  are both set to false, but I`ve tried pretty much every combination possible - which suggests to me the issue is in the Cloud.   ADD_EXTRA_TIME_FIELDS = True ANNOTATE_PUNCT = True AUTO_KV_JSON = false BREAK_ONLY_BEFORE = BREAK_ONLY_BEFORE_DATE = CHARSET = UTF-8 DATETIME_CONFIG = CURRENT DEPTH_LIMIT = 1000 DETERMINE_TIMESTAMP_DATE_WITH_SYSTEM_TIME = false HEADER_MODE = INDEXED_EXTRACTIONS = none KV_MODE = none LB_CHUNK_BREAKER_TRUNCATE = 2000000 LEARN_MODEL = true LEARN_SOURCETYPE = true LINE_BREAKER = ([\r\n]+) LINE_BREAKER_LOOKBEHIND = 100 MATCH_LIMIT = 100000 MAX_DAYS_AGO = 2000 MAX_DAYS_HENCE = 2 MAX_DIFF_SECS_AGO = 3600 MAX_DIFF_SECS_HENCE = 604800 MAX_EVENTS = 256 MAX_TIMESTAMP_LOOKAHEAD = 128 MUST_BREAK_AFTER = MUST_NOT_BREAK_AFTER = MUST_NOT_BREAK_BEFORE = NO_BINARY_CHECK = true SEGMENTATION = indexing SEGMENTATION-all = full SEGMENTATION-inner = inner SEGMENTATION-outer = outer SEGMENTATION-raw = none SEGMENTATION-standard = standard SHOULD_LINEMERGE = 0 TIME_FORMAT = TRANSFORMS = TRUNCATE = 10000 category = Structured detect_trailing_nulls = false disabled = false maxDist = 100 priority = pulldown_type = 1 sourcetype = termFrequencyWeightedDist = false    Any help would be greatly appreciated. ... View more

Hi, Once a month we receive a file via email that we manually upload to Splunk as a lookup CSV file.  The current process is to delete the old file and to upload the new one, keeping the same file name. The existing reports use this file without any issues. There is now a requirement to compare the current file with the previous version and highlight if any values have been added or removed (the columns stay the same). Initially I wanted to use the "inputlookup" and "collect" commands to output the data into an index and then build a search to compare the data based on the ingest time, effectively comparing the 2 files. However, I`m getting the following error: "The lookup table 'test.csv' requires a .csv or KV store lookup definition." The file actually exists and it`s located in "/opt/splunk/etc/apps/test_app/lookups/test.csv" The lookup definition also exists: "test_LD" I suspect this is caused by the size of the lookup file (approx. 36 MB) and wanted to ask for suggestions or workarounds ? Many thanks. ... View more

Hi Everyone, Data coming in from an API is using the _indextime as the _time field because the timestamp format that is being sent is not recognised by Splunk. An example of the timestamp would look like this:     2016-06-21T01:18:51-07:00     OR     2018-02-16T06:34:31-08:00      As you can see, an offset of -7 or -8 hours is being added to the time field. The timestamp format we`re currently using for the sourcetype is:     %Y-%m-%dT%H:%M:%S%:z     This is no longer working after the sender made some changes to the timestamp, but I`m not entirely sure how to represent the new format. Using Splunk Cloud.  Any help would be greatly appreciated. Toma. ... View more

Hi, We`ve got a dashboard sitting on a problematic SH and would like to clone and move it to another working SH. Is there a way to redirect the users to the newly created cloned dashboard ? Many thanks, Toma ... View more