Here's my story for others to follow and hopefully improve upon I mostly followed the Splunk docs to configure single sign-on. For doing a SAML group to Splunk role mapping, you need to use the AAD group IDs which you can get using the Powershell Get-MsolGroup commandlet. I also put in the line nameIdFormat = urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress to the [saml] stanza. This means usernames will be the UPN rather than a horrible object ID. So I wrote a migration script to do the migration which requires csvcut. I have a lookup file in my splunk instance already, built daily using an ldap search which is where the sAMAccountName to userPrincipalName mapping comes from. The script does the following: Rename the users directory Do an in-place sed to change ownership of all public objects Build a file of new users to insert into authentication.conf Saved searches require an existing user to run (else they are orphaned). With Azure AD as an identity provider, Splunk needs to create a cache, so to speak, of users. It does this by putting a username = list;of;roles into authentication.conf under the stanza [userToRoleMap_SAML] when a user first logs in. I want all scheduled searches to run, so whenever a public knowledge object is found, I add that user to the new-auths file. Then I imported it into the authentication.conf file manually as a seed. ... View more

Absolute the duration in the conversion and prepend it with a - or empty string. | stats count | eval count=-5 | eval duration=if(count<0, "-", "") + tostring(abs(count), "duration") ... View more

The solution I used was to run Nginx in front of the universal forwarder to wrap the event data and add the header: location /webhook-GUID { proxy_pass https://localhost:8088/services/collector; proxy_read_timeout 90; proxy_connect_timeout 90; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # wrap the webhook body for splunk proxy_set_body "{\"event\":$request_body}"; # Add the Splunk token into the Authorization header proxy_set_header Authorization "Splunk HTTP-EC-TOKEN"; } Wrap a webhook for delivery to an HTTP event collector is my blog post about getting webhook data from FogBugz into Splunk. ... View more

I can't figure out a way of doing it through point and click, but if you edit the source of the dashboard and add the earliest and latest fields to the search, it will work <search ref="FirstData - Swiped Count > Chip Count"> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> ... View more