Hey, I have tried to implement the answer on the following page: http://answers.splunk.com/questions/925/in-the-titlebar-module-is-it-possible-to-limit-the-list-of-actions-to-only-export I have an export button now but when I execute a form search and it is completed, clicking on this button displays this message, "You haven't run a search yet. Run one first". Any ideas of how I can get the export button to work? Could it be the layoutPanel? This is currently set to viewHeader. Thanks in advance for your help. ... View more

Hey, I have a Titlebar module in my form with the following code: <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> When I carry out a search in my form and click on the Actions dropdown menu, the 'Export Results...' option is not displayed. How can I get this option to be displayed in my form after a search is carried out? Furthermore, When I commented the following line of code as shown below and executed a form search: <module name="TitleBar" layoutPanel="viewHeader"> <!-- <param name="actionsMenuFilter">dashboard</param> --> </module> the following was shown when I clicked on the Actions menu. 'Export Results...' cannot be selected: How can I change that? Thanks in advance for your help. ... View more

Hey, I have been looking at the index=_internal and index=_audit data to get a feel for the data stored in these indexes. I would like to know the following: Is there a way of keeping track of who is using my splunk instance? The number of new users is growing every week and it would be great to see how many times particular user ids (e.g. admin) log in to my splunk instance. Thanks in advance for your help. ... View more

Hey, I have written the following code for a form: <form> <label>Combo box test</label> <!-- <searchName>Test SavedSearch</searchName> --> <searchTemplate>index="general_logs" name=$name$ | fields name type source</searchTemplate> <fieldset submitButton="false"> <input type="dropdown" token="name" searchWhenChanged="true"> <label>Name</label> <populatingSavedSearch fieldForValue="name" fieldForLabel="name">names_list</populatingSavedSearch> <choice value="*">Any</choice> </input> </fieldset> <row> <table> <title>Test Data</title> <option name="count">50</option> <option name="showPager">true</option> </table> </row> </form> At present, each time a name is selected from the dropdown list, the name selected is used to automatically run the search inside the searchTemplate tags. I tried to use a scheduled saved search (which is identical to the search in the searchTemplate tags) to achieve the same results (see commented out searchName tags in code above) but it does not produce the same results when I choose a name from my dropdown list. I don't think that the field $name$ in my saved search is being populated with the data selected in my dropdown list. How can I get this to work? Thanks in advance for your help. ... View more

Hey, I am trying to do something and I cannot get it to work so here goes: I have a form written in advanced XML that contains a SubmitButton. This form contains an ExtendedfieldSearch (text box) called Name. When I click on the SubmitButton, I want it to take me to another view where another search is run and the text inside the Name text box is used to fill "..." in this search where it says: search Name="..." Any ideas of how I can use the data that the user enters in a text box as an argument in another search? Thanks in advance for your help. ... View more

Hey, I want to switch off what seems to be a default function in Splunk. I am trying to drill down on the following chart: When I click on the cell highlighted above in the search, a search that I have defined via the HiddenSearch module is run in a new popup window. However, by default, Splunk adds success="919" to this search. When I click on this particular cell, the following search is run: index=main onb="wk42_2tue" success="919" but this is the search that I want to see being run instead when I click on this cell: index=main onb="wk42_2tue" The following extract of code from my view makes the above index=main onb="wk42_2tue" success="919" search possible: <module name="HiddenSearch" autoRun="true"> <param name="search">index=main</param> <module name="ConvertToIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="onb">$click.value$</param> </param> </param> . . . Is it possible to add a module and/or param to my code that stops success="..." from being added to the end of my search when I click on one of these cells? Thanks in advance for your help. ... View more

Hey, I am aware that you can drilldown from a chart so that clicking on a cell will open a new view where another search that you have specified is run. However: If my flashchart has a number of different coloured cells (e.g. yellow = completed, blue = not_complete) How can I drill down on each cell so that clicking on blue runs a search index=a and clicking on yellow runs a search index=z? Essentially, the search that is executed and the view that the user is redirected to is dependent on the colour of the cell in the chart that is clicked. E.g. Clicking yellow could take me to a view named dashboard_completed_info and clicking blue could take me to a view named dashboard_issues ... View more

Hey, I have a column flashchart on a dashboard called dash_usage.xml. When I click on a bar(e.g. called User where value="Myself") on this chart, I want to be redirected to another dashboard (called dash_user_details.xml) which automatically runs a search (different to the one for the flashchart) where the field User in this search is set to the User I clicked on the previous page (i.e. Myself) and the timepicker is set to last 24 hours by default. How can I go about achieving this? ... View more

Hey, How can I remove/hide the red error bar which is displayed across the Splunk UI whenever an error occurs? Thanks in advance for your help ... View more

Hey, I have a question about the following icon shown in the image below: This icon is usually shown after you execute a search in Splunk. Is it possible to hide/remove this matching events icon so that it is not displayed when a search is run? Thanks in advance for your help. ... View more

Hey, I have a question about customising the following menu: Is it possible to remove the Manager, App and Jobs links whilst keeping the Logout link? How would I remove any one of those links? It would be good to be able to control which of these links different types of users (admin, dev etc) can see but for now, just knowing how to remove some of those links whilst keeping others would be great to know 🙂 I think that this is another application.css job but I am not sure. Thanks in advance for your help. ... View more