Hi guys I am definitely a splunk novice. I want to run a search with the splunk REST API. it is a tstats on a datamodel. the issue i am facing is that the result take extremely long to return. when i run the same search on the front end its extremely fast but via the rest API for 3 results it takes between 7-10 min where as on the front end it returns the results quickly. my search is structured as follows: https://<server>:8089/services/search/jobs -d " search= |  tstats summariesonly=1 values(<value>) (there are a few values after this) from datamodel=<datamodel name> WHERE (some values for the values option before the from) | head 3" -d earliest= -5m@m -d latest =now -d output_mode=json So when running an index search on which the datamodel is built (which is slower on the front end) it returns results as soon as i run the /results endpoint but the datamodel search takes extremely long. Any ideas as to what my problem could be. The search does eventually return the results but it takes very long for the result size im requesting. ... View more

Hi guys I'm trying to run a search to the /jobs endpoint. however I get a  bash: syntax error near unexpected token `(' error message. my search has quotes in it for a | rex command and I tried escaping the quotes with the \ but is till seem to get the issue. when using the \ I get a  <msg type="ERROR">Unparsable URI-encoded request data</msg> error. My search is structured as follows: |  tstats summariesonly=1 values(<values>) ....(there are a lot of these) from datamodel=<name> WHERE (some values for the previous section) | lookup <lookup> | rex field=<name> "(?<new field name>[^.]{9}$)" ...  there are about 4 lookups in total and 2 rex command. however when i try to escape in the rex command I get the Unparsebale URI error.   Anybody come across this error before?   ... View more

Hi guys I'm having a problem my drilldown menu for the panels on my dashboard is disappearing. when I render the dashboard its there but when i try to click it it vanishes.   there are no scripts or custom visualizations on the dashboard so I don't understand why this happens. the permissions are also global for the dashboard ... View more

hi guys i want to run a custom splunk command via a button i can put on the dashboard. i want to do it via a visualization and not editing the xml. I want it work like a panel that can be added via the add panel option on the dashboard. i know it should be done via the visualizaions.js file in a custom visualization but i would like some help on how to write the visualization_source.js file for it.   So the logic is  button - visualization.js - custom command  im assuming the command will have to be run via REST   any help is appreciated ... View more

hi so im having a problem I ingested data(and i receive the successful page) but whenever i search for data the index shows up empty/there are no events i already checked the license and im good with licensing. I have a developer licensing. I check the monitoring console and it shows that i did not use any license at all. So its very weird because i am getting a successful ingested message but then the index is empty and the monitoring console says i did not ingest anything. Any suggestions as to what the problem could be ... View more