I would also like to know how to modify this to reflect a real timestamp.  "Today", "yesterday" are not useful. Thanks, Kris   ... View more

Hi - I can't offer any suggestions, but am also running into the same issue.  Using a DM on Splunk 7.2.1 with no problems.  The DM constraints use tags from eventtypes that include the index/sourcetype.  Have never seen the "Dataset constraints must specify at least one index" on 7.2.1 However migrating the DM over to an 8.0.6 splunk, this error appears for each root search:  "This object has no explicit index constraint. Consider adding one for better performance." and editing a constraint results in "In handler 'datamodeledit': Error in 'WT_CloudInfrastructure': Dataset constraints must specify at least one index."   All relevant tags/eventytpes exist.   As Joe asked, is it possible to disable or fix this problem? Thanks, Kris ... View more

Thanks for the follow up. The %% didn't work - possibly because it's in a regex statement within the drilldown? both %%3A and %25%253A were tried. the working regex (7.21) is set up to match url:port - | regex _raw="https((%253A)|(:))((%252F)|(\/))((%252F)|(\/))([a-zA-Z0-9.]%2B)((%253A)|(:))(\d%2B)" On 8, splunk translates %253A to :, %252F to /, but 8 also completely ignores the + (%2B) - no matter if it's a hard coded +, ++, +, %2B or %252B. when the drilldown executes, the regex in the search window looks like: regex _raw="https((:)|(:))(()|(\/))(()|(\/))([a-zA-Z0-9.] )((:)|(:))(\d )" (note where the + should be is just a blank space ) or with the %%: regex _raw="https((%%3A)|(:))((%%2F)|(\/))((%%2F)|(\/))([a-zA-Z0-9.]%%2B)((%%3A)|(:))(\d%%2B)". Although the initial dashboard panel search shows 6 matches (single value), but the drilldown completely fails and returns 0 results. ... View more

Thank you manjunathmeti. Your solution works. Any thoughts on how to stop splunk 8 from translating hex values? Observing how splunk translated %2524 to %: had us test another search that contains regex to find urls containing %3A, %2F. a snippet of the drilldown regex - https((%253A)|(:))((%252F)|(\/)) In 7.21, the drilldown works - in the browser bar this appears as https((%3A)|(:))((%2F)|(\/)). splunk 8 translates to https((:)|(:))((/)|(\/)) - any urls in our logs containing %3A, %2F are ignored. Thanks! ... View more