Is it possible to save viewstates (using viewstates.conf) of Splunk Web Framework Components (http://docs.splunk.com/Documentation/WebFramework) within a custom Dashboard?
I have Screen 1 for which I have set default time range in viewstates.conf for a user as follows:
[Screen_1:_current]
TimeRangePicker_0_0_0.default = Last 7 days
When Screen Loads for f...
For example, I want to only display "host", "sourcetype" for an app A in the default search result of "Events Table", but only "source", "eventtype" for app B. How can I do this?
We just upgraded to Splunk 5.0 and all of our upgraded saved searches and reports can no longer be deleted or moved via SplunkWeb. Why do we have to remove or move them manually from the server?
...
Can someone please tell me what is viewstates referring to under metadata?
And if I want to hide only Settings for Splunk users (Only able to search and logout button), what should I do?
Thanks
...hart/report type used. I looked in the savedsearches.conf file, but there was no reference to the chart type, only to the search string, and some alert based options.
I have flicked through the rest o...
I am trying to modify the 'Overview-Top Clients by IP' search on the dashboard overview page in Splunk for BlueCoat. I go to the 'Apps Manager\splunkforbluecoat-View Configurations\Overview - Top Cli...
...avedsearch name obviously), but cloning and modifying 400+ times seems wasteful
is there a way to do this using copy/pasta in savedsearches.conf/viewstates.conf?
would i need to manually create vsid values?