well, im using splunk cloud so JS is not an option and  i've tries the second option but its not working maybe something in the copy paste became wrong ?  <input type="multiselect" token="categories"> <label>Categories</label> <choice value="*">ALL</choice> <fieldForLabel>testCategories</fieldForLabel> <fieldForValue>testCategories</fieldForValue> <search> <query>index="stg_observability_s" sourcetype=SplunkQuality earliest=$time.earliest$ latest=$time.latest$ | search AdditionalData.domain="$domain$" AdditionalData.pipelineName="$pipelineName$" AdditionalData.buildId="$jobid$" AdditionalData.repoUrl="$repo$" | stats count by testCategories</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <default>*</default> <initialValue>*</initialValue> <delimiter> AND </delimiter> <valuePrefix>testCategories="</valuePrefix> <valueSuffix>"</valueSuffix> <change> <eval token="form.categories">case(mvcount('form.categories')=0,"All",mvcount('form.categories')&gt;1 AND mvfind('form.categories',"All")&gt;0,"All",mvcount('form.categories')&gt;1 AND mvfind('form.categories',"All")=0,mvfilter('form.categories'!="All"),1==1,'form.categories')</eval> <eval token="categories_choice">if('form.categories'=="All","categories=\"*\"",'categories')</eval> </change> </input> ... View more

thanks its working is it also possible to set it like that so when object is selected it will remove the "ALL" automatically ? ... View more

well... if im removing the table i see the entire event with the real structure, but i want to see only the testlogs.log part how can i do it ? using |fields does not help ... View more

"AdditionalData":{"time":"2025-06-19T11:52:37","testName":"CheckLiveRatesTest","testClass":"Automation.TestsFolder","fullName":"Automation.TestsFolder","repoUrl":"***","pipelineName":"***","buildId":"291","platform":"Backend","buildUrl":"https://github.com/","domain":"***","team":"***","env":"PreProd","status":"Failed","testDuration":"00:00:51.763","retry":1,"maxRetries":1,"isFinalResult":true,"errorMessage":" Verify live rates color\nAssert.That(market.VerifyLiveRatesColor(), is equal to 'true')\n Expected: True\n But was: False\n","stackTrace":" ***","triggeredManually":true,"hidden":false,"testLog":{"artifacts":{"Snapshot below: ":"http://www.dummyurl.com"},"logs":["[06/19/2025 11:51:45] Initializing BaseTestUI",["EndTime: 06/19/2025 11:51:47","Duration: 00:00:01.7646422","[06/19/2025 11:51:45] Driver configurations:\r\nIs local run: False\r\n ... View more

AdditionalData: { [-] buildId: 291 buildUrl: https://github.com domain: *** env: PreProd errorMessage: Verify live rates color Assert.That(market.VerifyLiveRatesColor(), is equal to 'true') Expected: True But was: False fullName: Automation.TestsFolder hidden: false isFinalResult: true maxRetries: 1 pipelineName: *** platform: Backend repoUrl: *** retry: 1 stackTrace: at *** status: Failed team: *** testCategories: [ [+] ] testClass: Automation.TestsFolder testDuration: 00:00:51.763 testLog: { [-] artifacts: { [+] } logs: [ [-] [06/19/2025 11:51:45] Initializing BaseTestUI [ [+] ] [06/19/2025 11:51:47] Initializing EtoroWorkFlows [ [+] ]   So if im using the query in my post, i don't see the [+] inside logs : .. i see it flat as one event ... View more

I want to monitor such behavior myself and not count on Splunk to update me when such thing is happening  ... View more

Hello I know for sure that its Splunk end because Splunk told us that they had issue with sending emails Im getting the logs after running your example  ... View more

im getting the log all the logs are in level INFO I know for sure that splunk had an issue with sending emails at specific time but i cannot see any logs in _internal ... View more

im looking for a solution that i will be able to monitor if emails stopped receiving , not for troubleshoot for specific issue ... View more

we know for sure that Splunk had issue with sending emails during this time so for sure its in splunk's end  ... View more

{"Time":"2024-07-29T08:18:22.6471555Z","Level":"Info","Message":"Targeted Delivery","Domain":"NA","ClientDateTime":"2024-07-29T08:18:21.703Z","SecondsFromStartUp":2,"UserAgent":"Mozilla/5.0 (Linux; Android 9; Redmi Note 8 Pro Build/PPR1.180610.011; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.64 Mobile Safari/537.36 ,"Metadata":{"Environment":"Production"}} ... View more

in the event i have the name of the domain, that is the only key i can use all of the logs are in one big index and i need to split it  ... View more

i will try to explain it from start i have one index that contains lots of data for many domains we need to split this index so the logs for each domain will be indexes to the relevant index (which is already exist) the problem we have with keeping this large index is that we are saving the data for long retention and not all of the domains needs this data for the same time ... View more

the regex is just an example, its not the real one since the regex is not the issue here the purpose of this step is because we need to separate the logs per domain so my question is if the props.conf example is the right way or maybe there is different way to do it ? ... View more

each index is for different domain  we want to split the logs per domain ... View more

Hello Thanks for your reply I cannot attach the real logs but let have an example The log will start with timestamp so 08:30:23 Started by Sarit Shvartzman Raw Raw Raw 08:32:34 Finished: I want all of this to be in one event Instead of as it now that it breaks by raw ... View more