Hi all, Just note that the macro 'cim_Authentication_indexes` of Splunk_SA_CIM has definition like following: [cim_Authentication_indexes] definition = () What does it mean? Sorry for the newbie question.   Thanks a lot. Regards ... View more

Hello, I'm writing a simple dashboard with a time picker and some panels. I try to display the from/to time selected by user in panel header. It works if user select Date/Time range, but for relative time period (e.g. last 1 day, last 15 minutes), the earliest and latest time are non-numeric values like -d@d, now, etc. Possible to get the search start/end time for relative time period cases? Thanks a lot. Regards /ST Wong ... View more

Hello, We're newbie to Splunk app development and using Splunk 7.3.5. We wrote a testing app  based on sample here https://docs.splunk.com/Documentation/Splunk/7.3.5/Viz/Buildandeditforms, with a time picker and a drop down list which is populated from the base search. We think the app will not do anything except populating the drop down list, until user select both time range and choice in the drop down list.   However, it doesn't work as expected.   When the page is loaded: - The drop down list keeps showing Populating...  for long time (usually the same search returns within 1 minute).     Then shows "Search produced no results" at end. - The searches in panel start to run  when the page is loaded even before any user input.  The search picks the default value in drop down list.   We tried to use full search instead of base search, the app works as expected. We must missed something in the code.    Would anyone please help? Thanks a lot.     <form> <label>WWW Statistics </label> <description>WWW statistics (department, browser information)</description> <search id="baseSearch"> <query> <![CDATA[index=application host="landing.itsc.cuhk.edu.hk" sourcetype=access_combined POST OR GET status<400 | rex field=uri "\/(?<deptcode>[^\/]+)\/" ]]> </query> </search> <fieldset submitButton="false" autoRun="true"> <input type="time"> <label></label> <default> <earliest>-1d@d</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="d_name" searchWhenChanged="true"> <label>Select a department</label> <search base="baseSearch"> <query> fields deptcode | stats count by deptcode </query> </search> <fieldForLabel>deptcode</fieldForLabel>splu <fieldForValue>deptcode</fieldForValue> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> </input> </fieldset> <row> <panel> <title>Access rate for department $d_name$</title> <chart> <search base="baseSearch"> <query> fields deptcode useragent| search deptcode=$d_name$ | timechart count</query> </search> </chart> </panel> </row> <row> <panel> <title>Time distribution of browser for department $d_name$</title> <chart> <search base="baseSearch"> <query> fields deptcode useragent | search deptcode=$d_name$ | rename useragent as http_user_agent | lookup user_agents http_user_agent | timechart count by ua_family usenull=f useother=f</query> </search> </chart> </panel> </row> <row> <panel> <title>Browser distribution</title> <chart> <search base="searchBase"> <query> fields deptcode useragent | search deptcode=$d_name$ | rename useragent as http_user_agent | lookup user_agents http_user_agent |stats count by ua_family</query> </search> <option name="charting.chart">pie</option> </chart> </panel> <panel> <single> <title>Total access for department $d_name$ between $fromDate$ and $toDate$</title> <search base="baseSearch"> <query> fields deptcode useragent | search deptcode=$d_name$ |stats count </query> <done> <eval token="Tearliest">strftime($baseSearch1.info_min_time$,"%F %T")</eval> <eval token="Tlatest">strftime($baseSearch1.info_max_time$,"%F %T")</eval> <eval token="fromDate">strftime($earliest$,"%Y%m/%d %H:%M:%S")</eval> <eval token="toDate">strftime($latest$, "%Y%m/%d %H:%M:%S")</eval> </done> </search> </single> </panel> </row> </form>   ... View more

Hi all, We set sourcetype in inputs.conf on universal forwarder, e.g. [monitor:///Firewall/*/*_pa_firewall.log] ignoreOlderThan=1d disabled = false host_segment = 2 index = network sourcetype = pan:log no_appending_timestamp = true Sourcetype of related logs changed to pan:traffic. Found that it's caused by an add-on defined on indexer that transforms the sourcetype for a matched pattern. Then configuration file on indexer is of higher priority than those on universal forwarder. Is that correct? Thanks a lot. /st wong ... View more