In my dashboard, i display log messages in a table. There are logs which has double quotes. I use custom drilldown to goto search app. Now when i click messages with double quotes, I get unbalanced quotes error. I can escape in search app with a slash and it works. But if i use eval - replace in my dashboard to add a slash, that slash is escaped automatically by splunk and i get \" instead of \". I know i can remove double quotes in my dashboard to make it work, but im looking to escape the quotes in-order to show users accurate error messages ... View more

I'm having a query that has a sub-search. I want to pass one time-period to outer query and another to sub-search. I would like to do that using TWO Time Pickers. How can i make it work. I can i uniquely identify a time picker? Anand ... View more

Hi Splunk base users, Do you think it will be a good idea if splunk provides a UNIQUE id to find an event like a primary key to each event Anand ... View more

I'm trying to write a query that converts table 1 to table 2 Basically, i want to retain first value of flower for city-place combination for all rows Any easiest way to do this? table1 city place flower NC A rose NC B lily NC C sunflower DE A scarlet DE B rose DE C lily Table2 city place flower NC A rose NC B rose NC C rose DE A scarlet DE B scarlet DE C scarlet ... View more

How to add delete update tags using | rest command? I do see examples using curl in doc, but i would like to know the syntax using | rest command in ui | rest splunk_server=local /servicesNS/-/-/ Anand ... View more