Thanks for all your advice.   Will study and test. For successful BIND operation, the RESULT event has the corresponding DN which is much easier to link up. However, for those failed one, there is no DN or related information except the connection ID while some client will use same connection for multiple login operation.  When busy, we can see something like this for the same conn ID: bind1 bind2 blah blah bind3 blah blah result1 result2 blah blah result3   Can only assume those RESULT events come in same order as BIND, though there are lot of 'noise' events in between and even transaction may not work if the maxevent is small enough. Thanks again. Best Rgds ... View more

The "transaction" command is one of the WORST scaling commands in all of splunk so it should never be used for a production use-case (because it fails without any indication and gives bad results).  You should use "streamstats" instead (you can google this site for "woodcock correlationID" and get many examples that will get you there. ... View more

Hi all,   Thanks for your help.    Found that the problem is caused by putting some settings in props.conf in the wrong place. The problem is resolved after putting following on the UF: INDEXED_EXTRACTIONS = json TIMESTAMP_FIELDS = timestamp and put KV_MODE=none on search head. I have mistaken that index extraction always occurs on indexer which seems depends, based on this: https://www.aplura.com/assets/pdf/where_to_put_props.pdf Thanks again. Best Rgds   ... View more

You should run then command first and after that this key combinations works. ... View more

Hi,   Is there any way I can create more than one search bar in the same dashboard?   ... View more

@stwong I don't understand what you mean. Perhaps if you gave some concrete examples of your queries and data we might be able to help more. ... View more

Hi, thanks for your help.  It works when using with <done>.      Rgds ... View more

You can use a saved search as a base search with   <search id="baseSearch" ref="savedSearch"/>   As for re-triggering searches to run, I use a token in the search that when the token value changes, will result in the search rerunning. I typically do with with   <init> <set token="trigger">0</set> </init>     Then in the place where I want to trigger the search to run again, this could be a <change> condition or a <done> clause of a search, and do   <eval token="trigger">$trigger$+1</eval> The search will then have  <search depends="$trigger$">   ... View more

Thanks for your help. ... View more

seems need to put plaintext Splunk username/password in SplunkJS configurations. ... View more

Thanks. Found that it's done by a transform in the CIM add-on $SPLUNKE_HOME/etc/apps/Splunk_SA_CIM/default/props.conf. Thanks a lot. ... View more

thanks a lot. ... View more

Noted and thanks. Will try it out. ... View more

Thanks. I have similar error on other add-on, which was fixed by adding following to /etc/hosts on corresponding Splunk instance host: ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 Maybe this case can also be fixed similarly. Anyway, we switched to test the new add-on https://splunkbase.splunk.com/app/4055/ instead per support's advice. Thanks for all responded. ... View more

Hi, it works perfectly. Thanks a lot. ... View more

@stwong, if it works for you then please accept the answer. ... View more

Hi Giuseppe, Thanks. Will try it out. /STwong ... View more

@stwong, your limitation is not from Timepicker, it is actually because of post-processing you have used in the snippet posted here. You should try to incorporate the following: 1) Base search should ideally contain transforming command, you should evaluate all the searches which refer to your base search i.e. baseSearch and ensure that baseSearch only retains the required fields as a result of some transforming (statistical) command like stats or chart etc. Refer to the Best Practices for Post Processing Searches. The post process searches will drop events or timeout if the limitations are breached. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices 2) When you use post processing, ideally you do not require earliest and latest tag in post process searches, which will be ignored anyways. 3) You can try out the following example. Since you have used post processing, I expect that you have some other post process searches running in your dashboard and the actual answer might change based on which fields you have used. If there is just one post process search using the base search then Post Processing is obviously not required. As per the dashboard Simple XML snippet, only one field in your example I have use | fields Type , you can extend to the other fields you need. PS: This is just for testing (or rather make your code work). You should change | fields * with the transforming command you need. 4) If you are not able to use transforming command in your base search due to any of your post process search. You would be better off running independent searches instead of post processing which might perform better and not truncate results/timeout due to limitations of post processing. <form> <label>Dashboard 1</label> <search id="baseSearch"> <query>sourcetype=syslog | fields - _* | fields Type </query> <earliest>$time_tok1.earliest$</earliest> <latest>$time_tok1.latest$</latest> </search> <fieldset submitButton="false"> <input type="time" token="time_tok1" searchWhenChanged="true"> <label></label> <default> <earliest>-1mon@mon</earliest> <latest>@mon</latest> </default> </input> </fieldset> <row> <panel> <table> <search base="baseSearch"> <query> stats count by Type </query> </search> </table> </panel> </row> </form> ... View more

Thanks for all your replies. We're doing query to correlate some windows event, and keep all fields in all 3 related events. some of the fields in different events have the same field name. event a: field1 -> find event b field2 -> find event c field3 field 20... event b: field 1 field 10 field 11 field 20 event c: field 2 field 15 field 16 field 20 Seems using join repeatedly + rename works. Thanks again. /st ... View more