Hello, I have been building a dashboard in dashboard studio and was looking for some help wrt implementing the fields option in XML dashboard in dashboard studio If my panel in XML dashboard has like 5 fields and I want to display only 3 in the table, we can use this <fields>[field1,field2,field3]</fields> However when I download the panel results, I will still be able to view all the 5 fields with this   I am looking to do something same in dashboard studio and I am not able to get the functionality. I have tried using header option in Table option and didn't get any success.   { "type": "splunk.table", "options": { "tableFormat": { "headerBackgroundColor": "#0E6162", "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)", "rowColors": "> rowBackgroundColors | maxContrast(tableRowColorMaxContrast)", "headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)" }, "backgroundColor": "#ffffff", "table": "> [\"field1\",\"field2\"]", -> didnt work "headers": "> table | getField([\"field1\",\"field2\"])", -> didnt work "showInternalFields": false }, "dataSources": { "primary": "ds_TlbXBz5i" }, "context": {}, "showProgressBar": false, "showLastUpdated": false } ... View more

I have two set of questions on which I am looking for inputs. 1. I have data from multiple tables for an application. I have onboarded it using db connect (mssql). I have to map the login data in tables to authentication datamodel. For achieveing this i need data from 2 separate tables (sources) to be joined which will give me valid login information along with other fields required for authentication datamodel. My question is, how do i implement CIM for a multi source data? 2. I would also be interested to understand how do I implement CIM compliance for date where I have to join 2 separate indexes. One way i thought was to use kv lookup for one index and make it automatic lookup for 2nd index and use the fields. This will make the lookup file too huge. Other way is to have a saved search and run it regularly to populate data from one index and use collect command to place it in second index. This again takes me to my first question as to how do i implement CIM for 2 sources in same index. ... View more

Hello, I am trying to run a simple batch script to open a web browser when an alert condition is met. Though the script is executing when run manually, I am unable to see the browser open. Going through the forum, I have seen the below explanation from this post: https://answers.splunk.com/answering/25308/view.html Are you trying to pop up a Window on your machine from a scripted alert? It's possible that it is happening, but is simply happening on the Splunk process' desktop, not one you're looking at. It would be expected that any programs that launch and open a window are going to open them in a desktop owned by the Splunkd service process, not by any logged-in user Can someone please guide me if there is a way to run the script in a way i can see the browser open i.e., run as a logged in user? Changes in script? or Splunk Configuration? ... View more