Thanks Kamlesh,  Nice solution and it does work for me ever.  But this time when I try to reproduce it, it does not work. I have checked the code and xml both are copied directly from you but really do not work.  Any experience with this issue? or what setting can I configure, many thanks!  ... View more

I think all these 4. Also preparing for the exam. Good luck! ... View more

Hi Giuseppe,  Thanks for the quick response, the slides are from this link (Splunk for Security - Baseline eLearning, page 14) if you have access to it.  Partner Learning Center (mindtickle.com) Based on the slides, I think on-perm is no doubt, if like you said, it designs for cloud, maybe the answer is for both.  But it is really hard to determine if the official do not provide the correct answer. 😕 ... View more

Slightly disagree but not sure. I think Security Operations Suite is on-perm (see in picture), and Splunk Security Cloud is cloud. For this question itself, seems like it includes both sides, so I think the answer is both. Welcome to challenge if any other thoughts ... View more

Great solutions! It also helped me, thanks Sundareshr ... View more

Hi, I would appreciated if any expert could show your experience: I want my title shows  ALL Status when * Status is showed, now I have set a second token as  <title>$displaykeystorestatus$ Status Overview</title> if part of type is selected, then should show a certain type <title>$form.type$ Status Overview</title>  Now either of them can be achieved separately, but I cannot make the title into the conditional one,  could you help to share how to use the < change> and <condition> to combine these two scenarios? Many thanks. ... View more

Same question, just wonder how do you insert the <change> Bec I also want to change the title based on the token condition, but <title> is not <input>, I do not find the correction to insert the <change> code My goal is also to replace the * with ALL, thanks for support! ... View more