**My basic question is as follows**: Is there a text alternative for specifying greater or less than, rather than using the symbol?
This is why I ask:
I have a search that queries failed login attempts greater than 10 across all servers in the index. It works a treat!
I've added that search to a Splunk Dashboard, and it populates beautifully and serves us well.
However, unlike every other section in the dashboard, clicking an entry returns a permission error: *You don't have permission to access /en-US/app/search/search on this server.*
If I edit the search string to remove "search count>10 ", the links are clickable and go straight to the search app. I tested on a second dashboard search with the same results.
I don't' know if this is an issue with Splunk, or more likely our SSO blocking **>** as the URL is passed to the search application.
Rather than explore allowing > in the URLs, I'd prefer to just specify an alternate term, if such a term exists.
PS - this is my first post. I did look for an answer to this, and apologize if it exists and I just didn't find it!
↧