You can try experimenting with append and base searches. This is essentially using one search to power the entire dashboard. There are some limitations like no more than 10,000 results can be post-processed and you shouldn't run anything that returns raw data. The base searches link also provides some usage examples and techniques for getting the job done. Append will chain your searches together and will execute the searches sequentially but will return a single data set. You should account for this in your post-processing by limiting fields that are returned from the base search and used in the post process searches. I've done something similar in a service level dashboard I developed for my company's NOC which about 25 dashboard "icons" that are powered by only 3 base searches. ... View more

I thought I had the answer thinking you were using dbconnect1 but now I can see you are definitely using dbconnect2. One of the main thing to check is to be sure your data isn't older than 2000 days as there is a default limit in the app out of the box. Note: Be aware that DB Connect abides by the MAX_DAYS_AGO setting in the Splunk Enterprise props.conf file. When set, MAX_DAYS_AGO defines the number of days in the past, from the current date, that a date is considered valid. This means that any imported records with timestamps before today's date minus MAX_DAYS_AGO will not be indexed. The default setting for MAX_DAYS_AGO is 2000 days, so if you use DB Connect to consume database data that is older than that, you should increase that value in props.conf. Secondly and the most likely is your input timestamp format. See below input_timestamp_format = <value> * optional * specify the format of input timestamp column, in JavaSimpleDateString format. ... View more

Adding comment to bump this a bit. This doesn't explain why we cannot replace the svg block with another and fool splunk into thinking it's the same logo. Anyone know if part of this script validates the svg block prior to rendering? I tried replacing it with an svg rendered from my company logo and no luck, just white space. This really needs to be an option. Splunk's PDF support has been crap from the beginning. ... View more

Within the input configuration in the Splunk UI there should be a check box for "Index Error Responses" ... View more

Try installing it by simply uploading the unpacked app to your apps directory and restart Splunk. ... View more

If you're using Splunk 6+ you can convert dashboards to HTML and unlock many customization options. Hit the edit menu and convert to HTML. Then take a look at the source of the newly created dashboard and you'll probably feel more at home. ... View more

These are all passed as arguments to a script when alerting. Try setting your saved search to alert and capture the arguments. ... View more

Using the timestamp as the rising column may have some issues being serializable Imagine two rows being written on the same second. DB Connect would see the same values in a field it expects to increment. For your timestamp issue, perhaps try using %s as the input format and or leaving it off and converting it at search time using | eval _time = latest_update_date ... View more

Assuming the logs contain something like "installed", index=blah sourcetype=blah app_name "installed" | stats latest(_time) as Time ... View more

You shouldn't need to do the same join twice here and you can use join type=left to still get your original result set even if noting matched. Try removing the last join and change the first one to join type=left and let us all know the results. It may be that the joined result set has no matches or doesn't exist. ... View more

Tokens should help ... View more

This certainly happens once you first turn them on. Windows hosts will always send quite a bit more than Linux. The key is to index only what you need. Take a look at routing and filtering data and remember, this is why we're allowed 5 violations in a month. Cram them all in on the same day or stagger them out every weekend and you'll be good. ... View more

There's an easy to read presentation from conf 2013 on this. ... View more

Have you looked at the limits.conf spec? Seems to me you'll be hitting one if not many output limits here. Even if you adjust your limits.conf to allow more output, you'll still hit a ceiling, most certainly on sub searches. ... View more

Found it. Token filters Token filters ensure that you correctly capture the value of a token. Filter Description Wrap value in quotes $token_name|s$ Ensures that quotation marks surround the value referenced by the token. Escapes all quotation characters, ", within the quoted value. HTML format $token_name|h$ Ensures that the token value is valid for HTML formatting. Token values for the element use this filter by default. URL format $token_name|u$ Ensures that the token value is valid to use as a URL. Token values for the element use this filter by default. ... View more

Can you explain this more? At first I thought it was some kind of typo but now it looks like you're piping to a string? I wasn't aware of these kinds of token... commands is the word for it? ... View more

The splunk app for AWS has everything you need. Just create a new IAM user for Splunk and add it's access credentials to the technology add-on as per the documentation. ... View more

Excellent work. I'm always on the fence about using quotes. I try to only use them for values with spaces. ... View more

Depending on who you ask they'll say 800 IOPS or 1200 IOPS but the metric is definitely IOPS and not random seeks. Last I heard, it was 800, was increased to 1200 and recently backed down to 800 again. ... View more

No Problem. Happy Splunking! ... View more