Hi @PickleRick Thank you for your response. Yes, I am able to get the desired results with Map command but the search performance is bad. Can you elaborate more on the Sub Search approach please? Or give me an example. ... View more

Hello @gcusello  Thank you for your response. Currently I am able achive it by using MAP command in Splunk, but the performance is very very bad. I am looking for other approaches for solving this problem/logic  I can't provide the data here but I can explain with an example about the scenario. Example for the Scenario: Let's say we have Data Base Manager tool which is managing all the DB Connections/Sessions. Users should log on to DB Manger first using their personal account and then initiate a connection to DB using the DB account. Each DB Manager Session Initiation log contains the following parameters: 1. User Account Name, 2. DB Account Name 3. DB Name 4. Session Initiation Time Each DB Login event contain the following parameters: 1. DB Account name 2. DB Name 3. Session Start time In this process, each login event on DB will have a corresponding session Initiation log on DB Manager tool. Let's assume the max. Time difference between these two logs is 10 mins.. means for each DB Login Event we should have a log on DB Manager in last 10 minutes. Now we have to create a Report for all the DB Login Events and add the parameter "User Account Name" on DB Manger corresponding to it. ... View more

Thanks for your answer; but the problem here is that we don't know the earliest and latest time intervals for Q2; they should come from Q1 results/output. Lets say Q1 is having 10 events in the output, each event will have the earliest and latest time parameters; We have to pass those parameters to Q2 and run it only in that time interval. In this way, we have to run Q2 for 10 times (as Q1 is having 10 events in the output). ... View more

Hi @gcusello  Please find my question below: We have two different Search Queries, lets say Q1 and Q2; For each Event or Result in Q1, we have to run Q2 by passing the parameters from Q1 (for example: earliest and latest time, Username etc..). and add some parameters from the Q2 result (for example: Supervisor Id for the Username) to each event in Q1. ... View more

Hi @Atavius  I have followed the CyberArk documentation and it worked for me for Windows Events. Please check the below configuration for your reference. #outputs.conf [syslog] defaultGroup = noforward   [syslog:pta_syslog] server = PTA-IP:514 type = tcp timestampformat = %s syslogSourceType = sourcetype::linux:messages   #props.conf [source::WinEventLog:Security] TRANSFORMS-win = pta_syslog_win   #transforms.conf [pta_syslog_win] REGEX = .*<your filter>* DEST_KEY = _SYSLOG_ROUTING FORMAT = pta_syslog ... View more

Hi @gcusello  Looks like good solution to my requirement. Thank you.   Could you please help me on how to clear search tokens in a Dashboard with more than 2 panels and all are getting tokens from previous panels? Example: There are 4 panels, Panel2 gets tokens from Panel1. (click on Panel1) Panel3 gets tokens from Panel2. (click on Panel2) Panel4 gets tokens from Panel3. (click on Panel3)   If user clicks on panel1 row then I need to clear all the tokens on Panels 2,3,4 which are assigned previously. ... View more

@gcusello  if OK click on a row if it isn't OK no click?--> This won't work for me. Because every time user have to click on a row in Dashboard Panel1 and he could see the results in Panel2. Panel2 Output might be like this: 1) Data is validated successfully and saved to Index. 2) Data validation is failed. Here validation is simple one, like if the tokens matches with certain parameters (Example: Ticket_Status="Approved") ... View more

Hi @gcusello  Thank you for your reply. I don't need any Button. On selecting a row on Panel1, all the required tokens will be passed to Panel2. My requirement is to validate the tokens on Panel2,. 1) if tokens values are passed the validation then I need to save the data to Splunk Index.  2) if validation fails, then the data should not be saved on Splunk Index. ... View more

@richgalloway  My requirement is just to skip few lines of SPL query if a certain condition is met. So is there any possibility to skip few lines or jump to a specific part of SPL based on condition ? Exact Requirement: I have two panels in my Dashboard. In First Panel, we have data for different tickets/sessions which will be passed to panel 2 on selection. In Panel2, we have to validate certain parameters and if all ok then save the data to Splunk index (using collect command) and show success message otherwise throw error message on to panel2. ... View more

Hi @richgalloway , Thank you for your answer. I know that my requirement is directly not possible as SPL is not procedural language. But are there any alternatives/ tricks, I mean indirect way to make it possible ? ... View more

@woodcock  So potentially every user might have his own comment for every row? All the table data (for all Users) is fetched from an index except Comments field.  Administrator will access the dashboard to view and to approve/reject each row item with comments. So, Basically if the administrator is already approved/rejected a row, it should be shown in the dashboard so that he can take actions on other items.   ... View more

Hi @woodcock, Could you please help me on this? ... View more

Hi @somesoni2 Thank you for sharing your idea. I never used the KV Store lookup. I will explore on it. Could you please check if you can help me on the below: As explained in my main question, in Dashboard Panel 1 there are multiple rows. Each row has "COMMENTS" field. I want to display the text box only if the user clicks on any row/column. Let's say user clicked on row 1 COMMENTS field, then I want to show test box to user so that he can input the data into it, when he clicked submit, I want to save the "Entered" data into COMMENTS field of row 1. Is something we can do like this?  ... View more

@rbal_splunk @kaurinko  @thambisetty @nick405060  Hi Guys, Please help me on this. ... View more

@thambisetty We need to forward the raw data from Splunk to CyberArk PTA(3rd Party) tool. We need to forward the data through SYSLOG TCP. (PTA will listen to SYSLOG TCP on xyz port). Is there any option to forward the data from Search Head without saving it locally?     ... View more

@suresh301086 For me PTA functionality is working for Windows Events and not for Linux Events. Currently we are working on developing custom plugin for Linux Events. Could you please share your forwarding configuration that you defined on Splunk Indexer/HF?  ... View more

@suresh301086 By default PTA won't support Linux Events. We need to develop custom plugin on PTA to understand Linux Events. ... View more

Hi @hexx Is there a way to configure an automatic lookup to occur only locally on the search-head now? ... View more

Hi @richgalloway The Regex is working fine and it is applied to only Windows Events Source Type but not other Source Types. ... View more

@kaurinko I think the above error is due to Port issue, may be the port is being used by some other process.. I have changed the Port and now it's working Perfectly, thanks for your help. ... View more

Hi @richgalloway  I have updated the question with complete details, could you check and help me in finding the resolution. Basically PTA server is listening (Syslog) on some port let's say 514. We need to forward all the logs in/coming to Splunk Indexer to PTA Syslog server on some port (514) . ... View more