I'm trying to use the Mobile App. I have it installed just fine, but when I got to register a device I get prompted to login. I'm using Saml for auth, so I don't have a local Username in Splunk Enterprise. I've tried the admin user and it won't accept that user. How do I get past this step? ... View more

I'm working with custom alert actions. I've taken most of my example from this example. It basically takes the xml written to stdin and writes it to a log. This works fine. I've added a UI element, with a couple fields that a user can write to. I'd like the input from this also written to this xml, so that I can pass it to my script. I can't figure out how to do this. The ui input does show up in savedsearches.conf. How can I get the value entered into the ui elements to be passed to my script? Thanks! ... View more

I'm trying to use the metadata command to find hosts that have recently started sending logs. Basically when firstTime is more recent than 7 days. This is the search I have... | metadata type=hosts index=* | eval firstday=strftime(firstTime,"%Y-%m-%d") | where firstday>=relative_time(now(),"-7d") I have tried many variations of this, to no avail. The 'firstday' field shows accurately, but the results are not filtered. Is there something I don't understand about this metadata command? I appreciate the help! ... View more