I need a button on a dashboard that does three things: Appends the dashboard's search with additional search activities (spec.: " | fields ReaderUserKey | outputcsv mycompany_WS_leads.csv") in order to dump a single field from the search (ReaderUserKey) to a CSV file under $SPLUNK_HOME$\var\run\splunk\ Open a popup prompt to accept the Splunk user's email address Fire a powershell script, sending it the CSV filename (from #1) and the email address (from #2) I've successfully gotten the button to do #1. I'm able to get the JS "alert" style popup to come up (related to #2), but this is too basic - I'd actually like to be able to pop up something like the "Save as Report" popup that you get off the flashtimeline view, where you enter some criteria and hit the "Save" button and it goes off and does its thing. It looks like the popup is just a special view of some sort, but I'm not sure how to get it to display as a popup in a custom form. I'm not sure how to tackle #3. I'm trying to figure out how to implement this solution: http://answers.splunk.com/answers/115237/add-button-to-view-to-call-script CURRENT PROBLEMS: The JS popup is too basic for our needs Not sure how to get it to fire the powershell script (I think I want to use the "Redirector" module, but I'm not sure if that's the best way to do it - and I haven't gotten it to work yet) Code: <view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html" stylesheet="application.css" script="application.js"> <label>Leads</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="SideviewUtils" layoutPanel="appHeader" /> <module name="Message" layoutPanel="messaging"> <param name="maxSize">1</param> <param name="clearOnJobDispatch">False</param> <param name="filter">*</param> </module> <module name="Message" layoutPanel="messaging"> <param name="maxSize">1</param> <param name="clearOnJobDispatch">True</param> <param name="filter">splunk.search.job</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="URLLoader" layoutPanel="viewHeader" autoRun="True"> <!-- Start Time Range Dropdown --> <module name="Pulldown" layoutPanel="panel_row1_col1"> <param name="name">customRange</param> <param name="label">Time Range: </param> <param name="staticOptions"> <list> <param name="label">Last 7 days</param> <param name="value">-7d@d,@d,7d</param> </list> <list> <param name="label">Last 30 days</param> <param name="value">-30d@d,@d,30d</param> </list> </param> <module name="ValueSetter"> <param name="name">multiValueTimeRange</param> <param name="delim">,</param> <param name="value">$customRange$</param> <!-- End Time Range Dropdown --> <!-- Start Saved Search Loaders --> <module name="Search" layoutPanel="panel_row5_col1"> <param name="search"><![CDATA[| loadjob savedsearch="admin:mycompany:WS_Leads_$multiValueTimeRange[2]$"]]></param> <module name="Gate"> <param name="to">leadsGate</param> </module> </module> <!-- Start Drop-down Panels --> <!-- Start Product Dropdown --> <module name="Search" layoutPanel="panel_row1_col1"> <param name="search"><![CDATA[| loadjob savedsearch="admin:mycompany:WS_Sales_$multiValueTimeRange[2]$" ]]></param> <module name="Pulldown"> <param name="name">selectedProdDesc</param> <param name="label">Leads</param> <param name="size">4</param> <param name="template">ProdID="$value$"</param> <param name="separator">+OR+</param> <param name="outerTemplate">( $value$ )</param> <param name="staticFieldsToDisplay"> <list> <param name="label">Any</param> <param name="value">*</param> </list> </param> <param name="searchFieldsToDisplay"> <list> <param name="label">Product</param> <param name="value">ProdID</param> </list> </param> <!-- End Product Dropdown --> <module name="HTML" layoutPanel="panel_row2_col1"> <param name="html"> <![CDATA[<div class="splHeader splHeader-dashboard"><h2 title="Includes" s:group="Includes">Inclusion Parameters</h2></div>]]> </param> <!-- Start Custom Fields Dropdowns --> <!-- Start Job Title Dropdown --> <module name="Search"> <param name="search"><![CDATA[| inputlookup WSCF.csv | search CustomField="olWSTitleCF"]]></param> <module name="Pulldown" layoutPanel="panel_row2_col1"> <param name="name">selectedJobTitle</param> <param name="label">Job Title</param> <param name="size">4</param> <param name="template">WSTitleCF="$value$"</param> <param name="separator">+OR+</param> <param name="outerTemplate">( $value$ )</param> <param name="staticFieldsToDisplay"> <list> <param name="label">Any</param> <param name="value">*</param> </list> </param> <param name="searchFieldsToDisplay"> <list> <param name="label">ValueDesc</param> <param name="value">ValueDesc</param> </list> </param> <!-- End Job Title Dropdown --> <!-- Start Refresh Results Button --> <module name="Button" layoutPanel="panel_row4_col1"> <param name="label">Refresh Results</param> <param name="allowSoftSubmit">False</param> <param name="allowAutoSubmit">False</param> <!-- End Refresh Results Button --> <module name="Button" LayoutPanel="panel_row4_col1"> <param name="label">Save to Email List</param> <param name="allowAutoSubmit">False</param> <param name="customBehavior">confirmationPopup</param> <module name="Search"> <param name="search"> <![CDATA[| loadjob savedsearch="admin:mycompany:WS_Leads_$multiValueTimeRange[2]$" | search $selectedJobTitle$ $selectedProdDesc$ | fields ReaderUserKey | outputcsv mycompany_WS_Leads.csv]]> </param> <module name="CustomBehavior"> <param name="requiresDispatch">True</param> </module> </module> </module> <!-- Start Searches for ad-hoc loads --> <!-- leadsGate search --> <module name="Search"> <param name="search"> <![CDATA[ | loadjob savedsearch="admin:mycompany:WS_Leads_$multiValueTimeRange[2]$" | search $selectedJobTitle$ $selectedProdDesc$ ]]> </param> <module name="Gate"> <param name="to">leadsGate</param> </module> <module name="SearchControls" layoutPanel="panel_row4_col1"> <param name="sections">export</param> </module> </module> <!-- End pageGate search --> <!-- End Searches for ad-hoc loads --> </module><!--Refresh Button--> </module><!--Job Title Pulldown--> </module><!--Job Title Search--> </module><!--Inclusion HTML panel--> </module><!--Product Pulldown--> </module><!--Product SavedSearch--> </module><!--Time Valuesetter--> </module><!--Time Pulldown--> </module><!--URLLoader--> <!-- First Results Panel --> <!-- Start First Results Panel --> <module name="Gate" layoutPanel="panel_row5_col1"> <param name="id">leadsGate</param> <module name="Pager" group="Lead Report"> <param name="count">120</param> <module name="EnablePreview"> <param name="display">False</param> <param name="enable">True</param> </module> <module name="Table" /> <module name="JobProgressIndicator"/> </module> </module> </view> ... View more

I'm running two Windows Splunk servers (combo search heads and indexers, v6.0.1). One is dedicated to our non-production, development environment; it's intended to be used for developing new reports without interfering in any way, shape, or form with the live production environment. The biggest problem we have is that the data in our development environment is stale, to put it mildly. This makes it extremely difficult to develop new reports because we never have decently fresh data to work with. The second problem is that on those rare occasions when we refresh the data in our development environment using production data, we're going to end up consuming an undesirable amount of our license bandwidth when the development Splunk server indexes the refreshed data. We're able to easily copy the bucket folders between the servers, but our searches (which rely heavily on fields that were extracted at index time) break because the extracted fields "don't exist". I'm guessing there's a metadata file or something somewhere that should be copied along with the buckets, but I haven't been able to find one. Is there a way to copy the data under $SPLUNK_HOME$\var\lib\splunk\index_name\db from the production server to the development server, with the field extractions intact? I thought perhaps this was related to the sourcetypes (since in production, we use a sourcetype of "application_www_datatype" and in development, we use "application_dev_datatype"), but I created the "www" sourcetype on the development server and that didn't solve the field extractions issue. ... View more