Great to hear! You're welcome! ... View more

Thanks for the update! Hopefully, they'll get both issues fixed up soon! EDIT: On a side note, I've since found SQLite and DuckDB and their :memory: databases to be good, simple test harnesses for DBX functionality. DuckDB could also be a fun alternative for CSV-based lookups with a SQL overlay, although safety would be a concern. You'd need to carefully coordinate outputlookup, outputcsv, or external update mechanisms. ... View more

They're both good options! Your two-button solution should work in all supported versions of Dashboard Studio, which I think most folks will prefer. ... View more

Here's an alternative using a single button and a JSONata expression for Splunk Enterprise 10.2 and Splunk Cloud Platform 10.1.2507 or later. Also note that you can reference tokens in SPL comments without changing the logic of your search. I used the "Clockwise Gapped Circle Arrow (⟳)" Unicode character for fun, but Dashboard Studio doesn't provide a documented method to add ARIA labels. It's best to follow the Splunk Style Guide UI text guidelines and your organization's accessibility requirements. { "title": "refresh_button_ds", "description": "", "inputs": { "input_4GfEjPs7": { "eventHandlers": [ { "options": { "tokens": [ { "token": "refresh_token", "value": "$eval:toggle_refresh_token$" } ] }, "type": "drilldown.setToken" } ], "options": { "appearance": "standalone", "label": "⟳" }, "type": "input.button" }, "input_global_trp": { "options": { "defaultValue": "-24h@h,now", "token": "global_time" }, "title": "Global Time Range", "type": "input.timerange" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } }, "ds.spl2": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } }, "tokens": { "default": { "refresh_token": { "value": "1" } } }, "visualizations": { "global": { "showProgressBar": true } } }, "visualizations": { "viz_c1vF95VO": { "dataSources": { "primary": "ds_9V82Z8cg" }, "options": {}, "type": "splunk.table" }, "viz_nWCwXQxf": { "dataSources": { "primary": "ds_5dWrITzj" }, "options": {}, "type": "splunk.table" } }, "dataSources": { "ds_5dWrITzj": { "name": "Search_2", "options": { "query": "| makeresults\n| addinfo\n``` $refresh_token$ ```" }, "type": "ds.search" }, "ds_9V82Z8cg": { "name": "Search_1", "options": { "query": "| makeresults\n| addinfo\n``` $refresh_token$ ```" }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_global_trp", "input_4GfEjPs7" ], "layoutDefinitions": { "layout_1": { "options": { "height": 960, "width": 1440 }, "structure": [ { "item": "viz_c1vF95VO", "position": { "h": 200, "w": 1440, "x": 0, "y": 0 }, "type": "block" }, { "item": "viz_nWCwXQxf", "position": { "h": 200, "w": 1440, "x": 0, "y": 200 }, "type": "block" } ], "type": "grid" } }, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } }, "expressions": { "eval": { "eval_1": { "name": "toggle_refresh_token", "value": "$refresh_token$ = 1 ? 0 : 1" } } } }   ... View more

Hi @verd4nd1, Selecting a new time range should refresh all panels that use it. Can you describe your workflow in more detail? Is the goal to have a default time selection, e.g., Last 15 minutes, and then refresh panels on demand with the same time value? ... View more

You really can just add event types. I do this myself for parity with falconhoseclient. The code loops over them. Support will go the extra step of updating the UI and publishing a new add-on. ... View more

You can add tilde-delimited event type values to TA-crowdstrike-falcon-event-streams/local/inputs.conf: [crowdstrike_event_streams://example] ... event_types = ...~BehavioralRuleDetectionSummaryEvent The Splunk add-on trails behind the CrowdStrike SIEM Connector (falconhoseclient) in supplied event types, but most or all should work. I second contacting CrowdStrike support. In my experience (not an endorsement), they're open to fixes and improvements to their Splunk add-ons. ... View more

Hi @renie, Splunk_TA_snow inputs use a combination of sys_id and a glide_date_time field (sys_updated_on by default) as checkpoints, so a glide_date_time field is required. For batch inputs, I write scripted inputs in Bash, use curl to query the Table API, use jq to parse the results, and then loop over pages with sysparm_limit and sysparm_offset as needed. Python is fine, too. I don't have an active ServiceNow dev instance, but if you need help writing or testing a script in a specific language, I can spin one up. You can also use an app from Splunkbase to query the Table API, e.g., in no particular order: Custom REST Command (crest) (combined with the collect command to index events), REST API Modular Input (fee-based), etc. ... View more

As an aside, my dbxlookup tests appear to be scaling quadratically or O(n^2). Test results: | makeresults format=csv data=" count,iteration,elapsed_time 100000,1,21.530 100000,2,23.001 100000,3,21.602 150000,1,46.030 150000,2,35.049 150000,3,50.500 200000,1,77.613 200000,2,79.297 200000,3,97.364 250000,1,159.102 250000,2,171.384 250000,3,154.734 300000,1,264.394 300000,2,275.097 300000,3,277.158 " | chart values(elapsed_time) as elasped_time over count by iteration Linear scale: tscroggins_0-1783116239802.png Log scale: tscroggins_1-1783116282471.png While I avoid dbxlookup in practice and prefer the cached lookup approach I recommended earlier, the results are disappointing. There's likely a nested loop somewhere in the dbxlookup code. Since we're not using the same JDBC driver and RDBMS, it might be worth trying to duplicate your problem using Acolyte http://acolyte.eu.org/ or another JDBC test harness that doesn't interface with a real database.   ... View more

With debug logging enabled, the dbxlookup command should generate output similar to this: 2026-07-03 16:55:29.952 Trace-Id=51e10057-f38f-4de7-8ef7-b149c1835677 [main] INFO c.s.dbx.command.lookup.service.DbxLookupService - feature=lookup component=service action=do_lookup name=null status=success message=complete chunk for lookup, dataset_size=1000, batch_count=1 2026-07-03 16:55:29.954 Trace-Id=51e10057-f38f-4de7-8ef7-b149c1835677 [main] DEBUG c.s.d.c.lookup.processor.LookupRecordProcessor - feature=lookup component=processor action=process_chunk row_size=2 2026-07-03 16:55:29.954 Trace-Id=51e10057-f38f-4de7-8ef7-b149c1835677 [main] DEBUG c.s.d.c.lookup.processor.LookupRecordProcessor - feature=lookup component=processor action=process_chunk message=processing data, data={usesysid=10, usename=postgres_admin} ... 2026-07-03 16:55:29.995 Trace-Id=51e10057-f38f-4de7-8ef7-b149c1835677 [main] DEBUG com.splunk.dbx.command.DbxLookupCommand - feature=lookup component=command action=write_chunk record={_time: 1783112129,usesysid: 10,foo: bar,usename: postgres_admin} 2026-07-03 16:55:29.995 Trace-Id=51e10057-f38f-4de7-8ef7-b149c1835677 [main] DEBUG com.splunk.dbx.command.DbxLookupCommand - feature=lookup component=command action=write_chunk record={_time: 1783112129,usesysid: 3,foo: bar,usename: null} ... 2026-07-03 16:55:29.996 Trace-Id=51e10057-f38f-4de7-8ef7-b149c1835677 [main] INFO com.splunk.dbx.command.DbxLookupCommand - feature=lookup component=command action=execute_lookup name=null status=success elapsed_time=778 from SPL like this: | makeresults count=1000 | eval usesysid=random()%11, foo="bar" | dbxlookup chunksize=1000 connection=postgresql_splunk query="SELECT usesysid AS usesysid, usename AS usename FROM pg_catalog.pg_user" usesysid as usesysid output usename as usename If an error occurs when writing a chunk, you'll see a message like: ... Trace-Id=... [main] ERROR com.splunk.dbx.command.DbxLookupCommand - feature=lookup component=command action=write_chunk status=failed message=failed to write record to splunk, record={...} The Java process doesn't flush log output until the search is complete, so you won't see the log entries in real-time. In the action=write_chunk lines, you can see the field-value pairs associated with each event, including both lookup and non-lookup fields. If your missing field values are not missing in the log output, they're being lost in Splunk's reading of stdout from the Java process. If your field values are also missing in the log output, they're being lost somewhere in the Java process. What do you see? ... View more

I haven't been able to reproduce the issue myself in Splunk Enterprise 10.4,  Splunk DB Connect 4.3.0, and OpenJDK 21 on RHEL 10. Performance should vary by JDBC driver and RDBMS, and I'm testing with the PostgreSQL instance that ships with Splunk. You can increase logging verbosity in the UI or in $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/dbx_settings.conf. Try setting dbxquery and dbxlookup to DEBUG. After running a "bad" search, check: index=_internal source=*splunk_app_db_connect_commands.* In my own experience, dbxlookup does not scale. For large lookups, you may prefer to periodically pull data into a CSV or KV store lookup through a scheduled search using dbxquery. From there, use the standard lookup command. Keep an eye on the max_memtable_bytes setting (CSV) and  kvstore limits, depending on your choice.   ... View more

HI @Robi2, The exception may have been thrown after the logexperiment command failed to post data to the https://localhost:8089/servicesNS/admin/search/mltk/experiments/<id>/history endpoint. A stack trace should have been written to the job search.log by the ChunkedExternProcessor logger. Do you see more information in the job log? ... View more

Hi @BradOH, Which Splunk DB Connect version and JBDC driver and version are you using? Does the problem only occur when append subsearches are present? Does the problem occur when using makresults, e.g.: | makeresults format=csv data=" User_Login jdoe1 " | dbxlookup connection="DATABASE" query="SELECT User_Id, User_Login FROM db.Users" User_Login output User_Id On a side note, you can chain inputlookup commands directly without using append subsearches: | inputlookup region1_employees.csv | inputlookup append=t region2_employees.csv | inputlookup append=t region3_employees.csv   ... View more

Definitely depends on your ecosystem. If you're managing an on-premises Windows or Azure-native or hybrid cloud environment or developing bits in Visual Studio Code, you're probably using PowerShell. The VSCode PowerShell extension has been downloaded 20+ million times. There are about the same number of estimated Python users worldwide. The few PowerShell examples I've posted on the Splunk community use PowerShell syntax and flow control but with a focus on classes and methods over cmdlets, they feel more like C# than PowerShell. In all seriousness, I can't think of a company other than IBM that maintains the level of backwards compatibility that Microsoft does. The Win32 API is 33 years old, and the core Windows API from 1985 remains functionally the same. The shift to 64-bit processors after the last update to Windows 10 saw the end of 16-bit NTVDM and WOW, but until that point, you could run original Windows applications on 32-bit Windows. PowerShell and .NET will disappear someday, but I don't think it will be Microsoft that makes the decision; programming languages will just be made irrelevant by AI systems that produce whatever you want in whatever form you prefer. We're almost at the point today. ... View more

admon, MonitorNoHandle, WinEventLog, etc. are all modular inputs that ship with Splunk Universal Forwarder, although not all of them behave the way modular input documentation says they should behave. Splunk gets to break its own rules. It's all relative. I've used Splunk in AIX and Solaris environments with ksh and sh, respectively, but no GNU Bash. You do what you need to do. I like PowerShell on Windows because it's installed by default on every modern Windows SKU (edit: okay, not Windows Nano Server, but your SREs are going to complain about Splunk, too), and most environments have something like a 10:1 or better Windows to other ratio if you include endpoints. ... View more

PowerShell is pre-installed on every supported version of Windows and easy to install on all major Linux distributions. When PowerShell first arrived, I wasn't a Perl user, and I didn't embrace its influences. As Microsoft support for COM and automation interfaces waned, though, using PowerShell or embedding a CLR language like C# in a PowerShell script became viable. I still fall back to VBScript, JScript, and COM interfaces occasionally. Microsoft should have kept its JavaScript engine alive, but Node.js (edit: technically, V8) rules that space. JScript .NET is still a thing. Python isn't shipped with Splunk Universal Forwarder, though--only Splunk Enterprise. When I'm writing Linux-only inputs, I use Bash. I vary between Bash and Python for external lookups and use Python for custom search commands. In the environments I support day to day, you can't just install NuGet or pip and download code. You've got to use what the base OS provides and fight for more. ... View more

We start with something approximating a monitor input but operating at the worksheet level. System.IO.FileSystemWatcher for workbook-level change tracking, a header/footer hash for worksheet-level change tracking, etc. I wouldn't dive into mid-sheet changes or Excel's internal change tracking right away. PowerShell and .NET Standard are just convenient, cross-platform tools. It could be any bytecode or compiled language with libraries supporting the required OS abstractions, but on Windows, side-loading Python isn't my first choice. ... View more

I mean, this is a Splunk forum and not a Power Automate or [insert legacy office automation and content management tool here] forum. 😉 "Can I index Excel files?" is a common enough real-word question. This is as good a use case as any for walking through a modular input example. We tend not to think about how Splunk monitor and batch inputs work under the hood. Getting into the details of file system concurrency, change tracking, and so on is quite fun, and Excel is an interesting envelope. ... View more

My first thought was to treat workbooks as archives and then iterate over worksheets as files/sources, but unarchive_cmd isn't very flexible. We don't appear to have access to the same metadata that _auto provides. A scripted input would be another simple, one-shot alternative. It could also be a complex solution similar to a modular input. The only limit is the code we're willing to write (or have a machine write, but we wouldn't be here if we wanted that). ... View more

On Linux, don't forget to install PowerShell Core. ... View more

Hi @sonaralt, We can adapt an example I wrote for SQL Server audit files at https://community.splunk.com/t5/Splunk-Cloud-Platform/uploading-sqlaudit-files-into-Splunk/m-p/678857, but we'll treat Excel workbooks as archives and the first worksheet as a source. We could use Excel itself to read workbooks, but it requires Excel and Windows, and writing code for memory and thread safety in COM is a dying art. The consensus (read: Stack Overflow and Reddit) for a cross-platform, scalable solution seems to be Sylvan.Data.Excel plus Sylvan.Data.Csv. We can use these classes in PowerShell 5.1 and PowerShell Core for a cross-platform solution compatible with Splunk Universal Forwarder. We can bootstrap a development environment with NuGet and a lot of headaches, or we can skip all that and use the add-on I've uploaded to GitHub: https://github.com/groktrev/TA-xlsx. TA-xlsx/ TA-xlsx/bin/ TA-xlsx/bin/netstandard.dll TA-xlsx/bin/Stream-XLSX.ps1 TA-xlsx/bin/Sylvan.Data.Csv.dll TA-xlsx/bin/Sylvan.Data.Excel.dll TA-xlsx/default/ TA-xlsx/default/inputs.conf TA-xlsx/default/props.conf TA-xlsx/default/inputs.conf [monitor://C:\Temp\xlsx\*.(?i)(xlsx)] index = main sourcetype = xlsx [monitor:///tmp/xlsx/*.(?i)(xlsx)] index = main sourcetype = xlsx TA-xlsx/default/props.conf [source::...\\*.(?i)(xlsx)] unarchive_cmd = powershell.exe -ExecutionPolicy RemoteSigned -File "$SPLUNK_HOME\etc\apps\TA-xlsx\bin\Stream-Xlsx.ps1" unarchive_cmd_start_mode = direct sourcetype = preprocess-xlsx NO_BINARY_CHECK = true [source::.../*.(?i)(xlsx)] unarchive_cmd = $SPLUNK_HOME/etc/apps/TA-xlsx/bin/Stream-Xlsx.ps1 unarchive_cmd_start_mode = direct sourcetype = preprocess-xlsx NO_BINARY_CHECK = true [preprocess-xlsx] invalid_cause = archive is_valid = False LEARN_MODEL = false [xlsx] SHOULD_LINEMERGE = false INDEXED_EXTRACTIONS = csv KV_MODE = none DATETIME_CONFIG = NONE TA-xlsx/bin/Stream-Xlsx.ps1 #!/usr/bin/env pwsh Add-Type -Path ([System.IO.Path]::Combine($PSScriptRoot, "netstandard.dll")) Add-Type -Path ([System.IO.Path]::Combine($PSScriptRoot, "Sylvan.Data.Excel.dll")) Add-Type -Path ([System.IO.Path]::Combine($PSScriptRoot, "Sylvan.Data.Csv.dll")) $stdin = [System.Console]::OpenStandardInput() $stdout = [System.Console]::Out $reader = [Sylvan.Data.Excel.ExcelDataReader]::Create($stdin, [Sylvan.Data.Excel.ExcelWorkbookType]::ExcelXml) $writer = [Sylvan.Data.Csv.CsvDataWriter]::Create($stdout) # We can iterate over worksheets with ExcelDataReader.NextResult() and # retrieve the worksheet name with ExcelDataReader.WorksheetName, but we # can't modify the source field midstream. Only the first worksheet's # header row will be recognized by INDEX_EXTRACTIONS = csv. #do { # $writer.Write($reader) | Out-Null #} while ($reader.NextResult()) $writer.Write($reader) | Out-Null On Linux, verify Stream-Xlsx.ps1 is executable: $ chmod 0750 $SPLUNK_HOME/etc/apps/TA-xlsx/bin/Stream-Xlsx.ps1 In more recent releases of Splunk Universal Forwarder, you may need to modify the server.conf allowed_unarchive_command setting. $SPLUNK_HOME/etc/system/local/server.conf [general] allowed_unarchive_commands = _auto,splunk-compresstool,zstd,powershell.exe,/opt/splunkforwarder/etc/apps/TA-xlsx/bin/Stream-Xlsx.ps1 See your release's server.conf.spec and https://advisory.splunk.com/advisories/SVD-2026-0302 for more information. Note that Splunk expands environment variables before verifying the command. Sylvan.Data.Csv.CsvDataWriter reads the Excel file from stdin through Sylvan.Data.Excel.ExcelDataReader and writes the first worksheet to stdout as a CSV stream. INDEXED_EXTRACTIONS = csv will parse the stream before forwarding events to a receiver. I haven't found a way for an unarchive_cmd process or script to update the source field and signal the start of a new source. The source file name is not passed as a command-line argument or as part of the input stream, and HEADER_MODE = always and the ***SPLUNK*** directive are ignored whether or not INDEXED_EXTRACTIONS or a custom structured data header extraction configuration is used. The next alternative is a modular input with its own path monitoring and change tracking mechanism. Because a modular input has complete control over the events it generates, it can inject metadata fields like source as needed. I prefer PowerShell over Python because Splunk Universal Forwarder doesn't ship with a Python interpreter, and PowerShell is available by default on most Windows systems. Python may be installed on some Linux systems, but it's not available on Windows or macOS by default, and PowerShell Core can be installed on Linux and macOS just as easily as a Python distribution. If Splunk Enterprise is installed on the endpoint, the Python for Scientific Computing app provides Pandas for access to Excel files, and Python becomes a viable, Splunk-supported option for modular input development. If you're interested in exploring and testing modular inputs, we can put something together in this thread. ... View more

Thanks for the Slack link. Dashboard Studio has gotten better at time zone detection relative to SplunkWeb user preferences and browser locale, but it would be clearer if it worked the same way every time, i.e., it used a zone offset if provided or else used the SplunkWeb offset. There are other ways to confuse Dashboard Studio, e.g.: | makeresults | fieldformat _time=strftime(_time, "%d-%b-%Y") _time is detected as a "time" field, but Dashboard Studio displays "Invalid Date" because the underlying JavaScript object is not a Date object. ... View more

Hi @yuanliu, Did you come up with a satisfying answer? From my brief experiments, Dashboard Studio appears to cast or convert the field value to a JavaScript Date object using the Date.parse() method. If the string is in a date-time format recognized by the browser's JavaScript engine*, a valid Date object is returned, and Dashboard Studio gives the label or value a type of "time"; otherwise,  the label or value may have a type of "number," "string," or "unknown" depending on additional tests. The behavior changes when the search coerces a variant field to a specific type with, e.g., the replace() or tostring() functions. If I'm poking around in the right spot, the logic is: IF Finite AND Number THEN // x.isFinite() && x.isNumber(x)     "number" ELSE IF Date THEN // !Number.isNan(Date.parse(x))     "time" ELSE IF String THEN // Number.isNaN(Date.parse(x)) && typeof x == "string"     "string" ELSE     "unknown" END IF There is necessarily some conversion from Splunk field to JavaScript variable when Dashboard Studio parses search results in client-side JavaScript. The logic contradicts the behavior change, though, as date-time values coerced to strings should pass the (inferred) !Number.isNan(Date.parse(x)) test and have a type of "time" and not "string." * Different browsers support different date-time string formats, but the standard formats should be universal. ... View more

I love engineering/systems-oriented dashboards and applied puzzle solving, but when I try to do something "pretty" ... the Titanic flute fail meme comes to mind. My favorite dashboards tend to be simple things with 3-5 metrics (principal component analysis maybe?) that say this is your root cause.  ... View more