Interesting. Can you email me at nick [at] sideviewapps.com The code is pretty simple so there's only a few things to try, in order to troubleshoot. I could email you back with a version of SavedSearch.html. Basically the module tries to get the most recent job for the given saved search, when the page loads. The mechanism it uses to do so is fairly simple... but possibly there's some idiosyncracy around search head clustering that it doesn't know about or account for. ... View more

There's no way to do this currently in the Sideview Table module. However it's an easy feature to add and you're the second or third customer to ask for it, so it has been added. It will go out in the next release which should be in a week or two. How it works is there will be a new optional param called "allowSorting". 99% of the time you will leave it blank and you'll get the current behavior with the clickable column headers and arrows etc. If you set <param>False , then the column headers will not be clickable and wont have little arrows. If you really need a short term hack and you're somewhat comfortable in Javascript and able to edit application.js, you could explore using a customBehavior param on the Table, and defining in your customBehavior that the "onSortClick" method should do nothing at all. ... View more

or ... | timechart count by "File Name" for that matter. ... View more

if the field really is called "related_hosts", then it would look like group='appldev' | stats count by related_hosts If the field is simply "host", then group='appldev' | stats count by host and if you want to sort by count, group='appldev' | stats count by host | sort 0 - count ... View more

I know, because I was to some level involved in the conversations around its creation, that the searchtxn command was developed in large part to specifically address this exact use case - of confusing transitive relationships between icid, dcid, mid specifically in ironport logs. That is to say no one id is the crux to stitching together the desired end result - instead it's a confusing story of icids and dcids and mids. It has come up multiple multiple times, with folks trying to construct things with transaction and with subsearches, somewhat depending on whether you're trying to report on everything, or analyze just a slim subset of traffic. The bad news is that I cannot recall any exact details of how you construct the searchtxn search here, nor does there seem to be that much on answers or in the docs. =/ I'm a little surprised that a dcid+mid+icid example isn't one of the official examples for the searchtxn command, complicated though it would be to document. http://answers.splunk.com/answers/29489/using-transaction-with-one-to-many-relationships.html http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Searchtxn and you can see my answer long ago on a similar question -- http://answers.splunk.com/answers/76785/complex-subsearch-need-to-extract-value-of-field-and-pipe-into-another-search.html ... View more

If I understand right, the nuance here is that you still want to filter to the usernames that appear more than once in the overall list, but you want to list BOTH the username and the ip address. If that's the case, adding the IPAddress field to the stats command will cause a problem cause it'll harm your ability to do that filtering . If the filtering was left intact, ie where count>1 , you would actually filter out users that accessed once from ip X and once from ip Y. So there are a couple answers. One is to roll up all the IP addresses in values(IPAddress) as IPAddress inside the stats command, and then mvexpand them after the filter. sourcetype= Filed=X [search sourcetype= Filed=X | iplocation IPAddress | stats dc(Country) AS Multiple_Country_login by Username | where Multiple_Country_login > 1 | table Username ] | iplocation IPAddress | dedup UserAgent | table Username, UserAgent , IPAddress| stats count values(IPAddress) as IPAddress by Username | where count > 1 | mvexpand IPAddress There's another way to get the same end-result, by doing by UserName IPAddress , and then instead of | where count>1 , have instead | eventstats sum(count) as totalUserCountForUser by UserName | where totalUserCountForUser>1 And.... to make a side comment, the search is a little strange. I assume the sourcetype terms in the base search are just typos, btu theer's something odd about the dedup UserAgent , and I'm not sure that's doing what you think it's doing. As written, for each value of UserAgent in the whole set, you'll get only the UserName and IPAddress about the single most recent event. So if bob uses mozilla version X from IP Y, and then alice uses mozilla version X from IP Z, because of that dedup, your end report will have no information at all about alice. Which seems wrong but maybe I'm missing something. ... View more

That's very strange. The feature is certainly tested to work with power- and user-level users, and our testcases still pass at least with Sideview Utils 3.3.2 on Splunk 6.2.1 I'm exporting results as a user-level user now and I can't see any problem. It sounds like "rkbask_na_p" is another user account, and you are using distributed search, such that the guest account is somehow mapped to "become" the user rkbask_na_p" on one of your configured search peers, yet that runs into trouble at runtime. Of course how that could manifest only when results are exported... i have no idea! Maybe we have a bug where "warn" messaging supercedes the actual results when we're writing out the response. I do see similar error messages showing up in other cases - is "user XXX could not act as Y" http://answers.splunk.com/answers/114224/streamed-search-execute-failed-because-user-could-not-act-as-xxx.html ... View more

This is really two questions, and the answers are pretty complicated, so let me answer them one at a time. First -- "how can we make the Table with it's table-embedded Checkbox modules load so that the last known state is actually reflected in the checked/unchecked state of the checkboxes". You were optimistic that putting autoRun="true" on the Checkbox would do something, but that will do nothing good. The cardinal rule of autoRun="true" is that you should never have one downstream from another. Never nest an autoRun="true" inside another. It's very bad. So anyway, we want the individual Checkbox modules to select themselves if the row they represent has state="ack" . We can rely on some things. First, if a Sideview form module gets data from upstream, and it sees a key in that data whose name matches its own "name" param, it will try and set itself to the value. So if we can contrive to have a key called "state" whose value is either "ack" or "", then it'll just work. Here is XML where we use ValueSetter to do exactly this: <view autoCancelInterval="90" isSticky="False" onunloadCancelJobs="true" template="dashboard.html"> <label>Testing Sideview</label> <module name="AccountBar" layoutPanel="appHeader" /> <module name="AppBar" layoutPanel="appHeader" /> <module name="SideviewUtils" layoutPanel="appHeader" /> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="maxSize">2</param> <param name="clearOnJobDispatch">False</param> </module> <module name="TextField" layoutPanel="panel_row1_col1" autoRun="True"> <param name="name">wild</param> <param name="float">left</param> <param name="label">Search</param> <param name="default">*</param> <module name="Search"> <param name=”search”>`Test_Macro(wild=”$wild$”)` | eval Acknowledge="" | lookup myLookup myIdField OUTPUT state</param> <param name="earliest">-1d</param> <param name="latest">now</param> <module name="Pager"> <module name="Table"> <module name="ValueSetter" group="row.fields.Acknowledge"> <param name="name">state</param> <param name="value">$row.fields.state$</param> <module name="Checkbox"> <param name="name">state</param> <param name="onValue">ack</param> <param name="offValue"></param> <module name="Search"> <param name="search">| inputlookup myLookup | append [stats count | fields - count | eval myIdField="$row.fields.myIdField$" | eval state="$state$"] | stats last(state) as state by myIdField | outputlookup myLookup</param> <!-- This search is executed based on checkbox behavior to update the collection and state of events --> <module name="CustomBehavior"> <param name="requiresDispatch">True</param> </module> </module> </module> </module> </module> </module> </module> </module> </view> When the page is loaded, now all the checkbox states match the underlying states. And as you had already, when a checkbox is clicked, the embedded search is run, thus changing the underlying state of the lookup to match the now-changed state of the checkbox. Things go two ways and everything is marvelous. 2) Except the table doesn't refresh, so the "state" column still says the wrong thing. a) Really easy solution! Do not display the state as a column! You can give the Checkbox module a "label" param of "Acknowledged" and I submit that the usability is pretty good here. The users will trust the Checkboxes even if the whole table isn't updating. b) I've been down this road on several other interfaces exactly like this. actually after making teh Table refresh you'll have another problem you haven't noticed yet - making the Table reload back on whatever page number the user had paged out to. o_O. Ignoring the paging, the answer is to define two customBehaviors in application.js. One customBehavior is on a CustomBehavior module just upstream of the Table module, the other one is on that CustomBehavior we already have downstream from the embedded Search module(s). Then to get all the paging right, there has to be a third longer customBehavior on the Table. Like many seemingly easy UI customizations, it gets complicated. a) is recommended! just remove the "state" column from the Table. 😃 ... View more

Oh bummer - the data that all the examples use absolutely is on your system. However I think only admin-role users can see it, and possibly a well meaning admin may have even turned off the indexing of it. You can always install splunk on your laptop just to play with the working examples. The data they all use is splunk's own internal data so as soon as you install it, there will be data there. btw, post your XML somewhere and I'll probably spot the problem quickly. ... View more

If the ValueSetter sample I posted doesnt' work for you, now I'm suspicious that you're running 1.3.5, which is a VERY old, even ancient version. Current release of Sideview Utils is 3.3.2, and you can see from release notes that the difference in performance and features and docs even, between the two versions is kind of immense. http://sideviewapps.com/apps/sideview-utils/release-notes/ but... maybe that's not the case. Have you taken a look at the docs and examples page for the ValueSetter module? and while I've got you -- factor that autoRun="True" up much higher in the XML. You want generally one autoRun="true" up at the top, and definitely not deep in the hierarchy like this. And make sure there's only one - ie never nest an autoRun inside another one. You're doing the right thing - playing around and discovering. Make sure you stitch in some time going to docs and examples pages for relevant modules. I am still sorry that the docs haven't been rewritten to be speaking to someone who went straight from Simple XML to Sideview XML. They still seem to be speaking to a person who has endured and suffered with the legacy advanced XML (these people don't really exist anymore). I'll get them rewritten sometime soonish. ... View more

no worries. Here's a link to give you some insight into the difference between the stats and chart commands - http://answers.splunk.com/answers/32001/difference-stats-and-chart.html ... View more

An update - since I don't know of anything that would prevent the albeit very old 1.3.5 version from working with Splunk 6.2, I also updated the compatibility in apps.splunk.com to include 6.2. ... View more

Is this dashboard using Sideview XML or simple XML or splunk JS? I can tell you a couple easy ways to do this in Sideview XML. ... View more

Can you post the xml in pastebin or something similar or email it to me at nick [at] sideviewapps.com? One thing to double check is that there is a Message module on the page. It could be some other problem for which an error message is coming down, but due to the absence of a Message module, which message might not be getting displayed. Also are any JS errors appearing in the browser's error console? ... View more