Our current setup looks like this: Deployment Server Deployer Indexer 1 Indexer 2 Search Head 1 Search Head 2 Search Head 3 A couple of months ago, I added a db_input for our Management app. The input took raw SQL. Within that SQL it returned a warning level and alarm level hard coded. Warning = 4000, Alarm = 3500. However, this week, I took the SQL and stored it as a Stored Procedure on our MSSQL database. I edited the exact same db input, replacing the SQL with "EXEC splunk.dbo.moves". In that stored procedure, I changed Warning to 3000 and Alarm to 2500. I have the input to run every 5 minutes. Now, it returns both the old data and the new data. Meaning I am seeing Warning = 4000 sometimes and 3000 other times. Same goes for Alarm. I restarted Splunk on all 7 systems that we have. I checked db_inputs conf on both Deployment Server and under shcluster apps folder, and the Deployer. I am not seeing anywhere that has the old code in it. Is there anywhere else to check? Or any other ideas? I just created a brand new db_inputs called something else with just the stored procedure so we can get our data. However, the old stuff is still getting indexed, and they're a waste of space. Thanks, hope this makes sense. ... View more

Hello, I added a dropdown input at the top of my dashboard with various time intervals to refresh each chart. Now, on the charts' subtitles, I would like to display that auto-refresh rate. The token for the dropdown input is $AutoRefresh$: Name: Value: 1 minute 1m 5 minutes 5m 10 minutes 10m 15 minutes 15m 30 minutes 30m In the subtitle I have: This chart auto refreshes every $AutoRefresh$ This displays, for example, 5m when I would like it to display 5 minutes. Reading the documentation I am not seeing any "additions" to tokens, such as $AutoRefresh.Name$, etc. Is this possible to do? ... View more

I know you can do the following in order to make a dashboard as the default view for an App: <nav search_view="search" color="#ff9999"> <view name="dashboards" default='true' /> </nav> However, is there a way to make a specific dashboard the default view when the user clicks on the App? For example, if I have a dashboard titled "Total Sales". I tried the following, but it does not work: <nav search_view="search" color="#ff9999"> <view name="Total Sales" default='true' /> </nav> ... View more

Hey all, The company I work for has purchased a license to use ITSI and have put me in charge of getting it installed at our site. However, when I search ITSI in Splunkbase, I only see a contact Customer Sales button instead of a download button since ITSI is a premium app. I have sent Splunk Customer Sales THREE messages over the course of a month and a half asking how I can get it installed, but have yet to get a reply back. Has anyone downloaded this at your site and have any information for me? Thanks SO ... View more

Hello, I am getting the error "there was an error processing your request. It has been logged" when I try to save the following query in a Data Lab Input for DB Connect: SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED SELECT CONVERT(CHAR(10),LL.run_datetime,101)+' '+CONVERT(CHAR(8),LL.run_datetime,108) AS Date, CAST(CONVERT(CHAR(10),LL.run_datetime,101)+' '+CONVERT(CHAR(8),LL.run_datetime,114) AS VARCHAR(20)) AS Measured_Date, LL.prod_id INTO #TempData FROM eng..lost_loads LL INNER JOIN met..range_radius RR ON RR.prod_id = LL.prod_id WHERE LL.run_datetime BETWEEN DATEADD(mi, -15, GETDATE()) AND GETDATE() order by LL.run_datetime SELECT Date, CONVERT(smalldatetime, Measured_Date) AS Measured_Date ,COUNT(1) AS TempData FROM #TempData GROUP BY Date, CONVERT(smalldatetime, Measured_Date) ORDER BY Measured_Date DESC DROP TABLE #TempData I entered the query manually in the db_inputs.conf as per this thread: https://answers.splunk.com/answers/607692/splunk-dbconnect-311-build-34-there-was-an-error-p.html However, I am still not seeing it when I refresh the Data Inputs page, I am assuming the server may need rebooted, but this is not an option at this time. Any suggestions? Thanks ... View more