It looks like it's not extracting successfully because the "clientId is missing a closing quote. Adding in back in and using the following settings extracts the fields successfully:   BREAK_ONLY_BEFORE = ^{ \"sessionId MUST_BREAK_AFTER = }$ TIME_PREFIX = timestamp\"\:\ \" KV_MODE = json   ... View more

For ITSI v4.4 and above, you'll need to add report_as=text to the | rest portion of the SPL.   ITSI REST API reference  ... View more

use the param.search_name="YOUR CUSTOM NAME". you can update the other fields in similar fashion: param.notable_field="YOUR VALUE" sendalert documentation ... View more

You may need to create a click event handler and set preventDefault(); See this example of custom handlers: http://dev.splunk.com/view/webframework-codeexamples/SP-CAAAEV8 ... View more

Yes, change the link target. https://docs.splunk.com/Documentation/Splunk/7.0.0/Viz/DrilldownLinkToDashboard#Open_the_target_in_another_browser_tab ... View more

Have you tried the curl --data-urlencode option instead of -d? I suspect it's because your query is being mangled in transport. Do the Splunk logs give you any information on the search that was received when sent my curl? ... View more

You have the SID of the search that triggered the alert -rt_scheduler_adminsearch_RMD5cf6dac5adc7385e1_at_1510141830_38328.0 Then use one of the endpoints (/services/search/jobs, /services/search/jobs/{search_id}/results) to get the search results using the SID. ... View more

join command? index=analysisFilesUserAccess srcip="src_ipFromAboveResults" | stats count by user, srcip | join srcip [ search index=network sourcetype=analysisFiles file_accessed="zip" | stats count as count2 by srcip, hostname, data] ... View more

Nice find! This had me stumped for a while before I came across your solution. ... View more