Hi, Each version of splunk comes with his own license and each license has define data volume consumption per device per day. You can't modified this file to increase the define volume. The only ways to increase this volume are whether you buy a new license or you add more licences on the existing license,Hi, Each version of splunk has his own license and each license has a define data volume consumption per device per day. You can't encrease this volume but you can decrease it. The only ways to encrease it are whether you buy another license or you add new licenses. ... View more

Hi, I think that the data statistics of calls to Splunk are not updated because when you indexing the file option upload from file and directories and that is while when the file is updated on your disk, splunk doesn't take care of that changes. To resolve this problem, you need to index that file with option continuously index data from file and directories To reset splunk you can delete index and data that are containing in that index. To do it, run the CLI, go to the bin directory of spluk and run this commande: if you're on Windows : splunk clean eventdata -index <index_name> where is the name of the targeted index if you're on Windows : ./splunk clean eventdata -index <index_name> After deleted them you can now reindexing them with option continuously index data from file and directories ... View more

Hi, Do you have a field named users? ... View more

Hi, The Free license allows you a limited indexing volume and disables authentication, but is perpetual. This license includes 500 MB/day of indexing volume. So if you where indexing more than 500 MB/day before you changed the license for the test environment to a perpetual free license, now that you've change indexing has been stopped. When de indexing has be stopped, searches, display ... will be not able. To resolve the issue, add a new license. Here is the procedure to add new license to splunk: Navigate to Settings > Licensing. Click Add license. Either click Choose file and browse for your license file and select it, or click copy & paste the license XML directly... and paste the text of your license file into the provided field. Click Install. If this is the first Enterprise license that you are installing, you must restart Splunk. Your license is installed. ... View more

Hi, Up to now there is no way to globally define input forms that can then be added to dashboards when required? What i advice you is to save your source code on your disk and when you'll want to use this imput forms, just open the saved file, copy the code and paste it at the rigth place in your dashboard. ... View more

Hi guys, Here are solutions that I propose: First solution: Edit permissions of that dashboard. At option Display for tick All apps ;select read and/or write for option Everyone and save. second solution: Create the new app for the user; create that dashboard in that new app. ... View more

Hi Rob, The change that you made will just Show link buttons at the bottom of the panel. To make what you want try to use this option: link.openSearch.visible put it at true To see other options and configurations see: http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML ... View more

Hi sohnaeo the graph is not showing these numbers because timechart function have Required arguments: either single-agg or an eval-expression. In your case, to get those number you must use an eval-expression (eval, sum; avg ...) after span=5m. For example you can do this: index=number| timechart span=5m count by Random You'll got all results on your graph. ... View more

Hi, You're on the rigth way but you forgoted something or/and you make some mistakes. Summary indexes are there to accelerate the results of searches but it's not the only thing. You must know that the first condition to respect so that the performance of your dashboards can be improved is that each of your dashboards most not have more than 8 searches. This condition is essential for splunk to displays and runs correctly your dashboards. So before using Summary indexes, make sure that your dashboards respect that condition. ... View more

Hi, The problem is not at the level of tag but it's at the level of the function eval. The function eval work only with fields that have numericals values. So when you do this |eval newField=userName+age, if the values of field "userName" are not all numerics, you'll allways get "No Results Found". ... View more

Hi venkat; If when you added your file to splunk, you have choose to upload the file, any time that you'll have updates for that file, you'll need to re-indexing the new file for splunk to take care of the update. But if you choose to monitor the file (continuously index data from file and directory), you'll not need to re-index your file; you'll just need to overwrite the old file by the new file at the same location. NB: The new file most have the same name like the old file. In your case, choose the option that correspond to your needs. ... View more

Hi Dori, Here is the mistake that you make: The first option taht i propose to you is: If you want to use the option match in the tags saved and/or view, his value most be equal to one name of your saved searches that exists. The second option is very easy: Just remove this match="General" in those tags. ... View more

Hi everyone; You are not able to get the rows colored because you have some mistakes in your trial.css file: In your css file, remove this And it'll work very well. #highlight tr td { background-color: #c1ffc3 !important; } Now here was the problem: You gave background color to you table and after you gave some color to your rows; this make a conflict and it's the raison why there is no rows colored. ... View more

HI newbiesplunk Here is an exemple of what you need xml code: <dashboard script="my.js" stylesheet="my.css"> <label>Log Level</label> <description/> <row> <table id="highlight"> <title>Log Level</title> <searchString>index=_internal sourcetype=splunkd | stats count log_level |table log_level count </searchString> <earliestTime>-24h</earliestTime> <option name="drilldown">none</option> </table> </row> </dashboard> your .js file must look at this: require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { // Row Coloring Example with custom, client-side range interpretation var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { // Enable this custom cell renderer for both the active_hist_searches and the active_realtime_searches field return _(['log_level']).contains(cell.field); }, render: function($td, cell) { // Apply interpretation for number of historical searches if (cell.field === 'log_level') { if (value == ERROR) { $td.addClass('range-cell').addClass('range-severe'); } else if (value == INFO) { $td.addClass('range-cell').addClass('range-elevated'); } else if (value == WARM) { $td.addClass('range-cell').addClass('range-low'); } } } } // Update the cell content $td.text(value.toFixed(2)).addClass('numeric'); } }); mvc.Components.get('highlight').getVisualization(function(tableView) { // Add custom cell renderer tableView.table.addCellRenderer(new CustomRangeRenderer()); // tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row // tableView.$el.find('td.range-cell').each(function() { // $(this).addClass(this.className); // }); //}); // Force the table to re-render tableView.table.render(); }); }); Your css file must be like this: #highlight td.range-low { color: orange !important; font-weight: bold; } #highlight td.range-elevated { background-color: green !important; font-weight: bold; } #highlight td.range-severe { background-color: red !important; font-weight: bold; } NB: You must put the css and js files in the folder ''static'' of the app that contain the xml dashboard. If there is not change, think to restart splunk to applied changes. ... View more

Hi, hier is the solution to your probleme: XML file: <dashboard script="MY.js" stylesheet="My.css"> <label>colouring_header_of_the_table</label> <description/> <row> <table id="highlight"> <searchString>index=_internal | stats count(sourcetype) as number by source</searchString> <earliestTime>-24h@h</earliestTime> <latestTime>now</latestTime> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </row> </dashboard> MY.js file require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { // Row celloring Example with custom, client-side range interpretation var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { // Enable this custom cell renderer for the number field return _(['number']).contains(cell.field); }, render: function($td, cell) { // Add a class to the cell based on the returned value var value = parseFloat(cell.value); // Apply interpretation for number of historical searches if (cell.field === 'number') { $td.addClass('range-cell').addClass('range-severe'); } // Update the cell content $td.text(value.toFixed(2)).addClass('numeric'); } }); mvc.Components.get('highlight').getVisualization(function(tableView) { // Add custom cell renderer tableView.table.addCellRenderer(new CustomRangeRenderer()); tableView.table.render(); }); }); MY.css file /* Colum Coloring */ #highlight td.range-severe { background-color: red !important; } Put MY.js and MY.css files in the static directory of the concerne app. ... View more

Hi, Here is the correct source code: <form> <label>Balance Email Summary2</label> <fieldset autoRun="true" submitButton="false"> <input type="dropdown" token="Registry" searchWhenChanged="true"> <label>Select Registry</label> <choice value="INFO">INFO</choice> <choice value="ASIA">ASIA</choice> <choice value="ORG">ORG</choice> </input> <input type="text" token="Registrar" searchWhenChanged="true"> <label>Registrar</label> </input> <input type="time" token="time_range" searchWhenChanged="true"> <default> <earliestTime>-30d@d</earliestTime> <latestTime>now</latestTime> </default> </input> </fieldset> <row> <table> <searchTemplate>savedsearch="balance_email_sent"| search $Registry$ $Registrar$ </searchTemplate> <earliestTime>$time_range.earliest$</earliestTime> <latestTime>$time_range.latest$</latestTime> </table> </row> </form> Note that in this code, if you absolutely want to use a saved search, you most create a global saved search (it means that the search must not be spécified to a particular registry or registrar). Here the global search is called balance_email_sent There is another way; instead of using <searchTemplate>savedsearch="balance_email_sent"| search $Registry$ $Registrar$ </searchTemplate> You can use this for example <searchString>index=* $Registry$ $Registrar$ | ... </searchString> ... View more

hi, If your dashboard have more than 8 searches that are running (8 pipes) or if he had panels that sum of their searches is more than 8 searches, it'll not run because the maximun of searches in one dashboard is 8. Another thing is to check if the source code of your dashboard don't have errors ... View more

Hi If your dashboard have more than 8 searches that are running or if it have panels that the sum of their searches in more than 8, your dashboard will not run. Another thing is to verify that your dashboard don't have errors in the source code. ... View more

Hi, You can change the logo of your application in this way: Create your logo with your own software. This logo most have this dimensions: 72 x 72 or 36 x 36 Go and place that logo in this directory: $SPLUNK_HOME/etc/apps//appserver/static Think to restart your splunk to applied changes. ... View more

Click on the application “search and reporting” then on “dashboard” and create a second dashboard. After that add new panels to that dashboard. Open your first dashboard and edit all searches of panels that you want to remove. Copy those searches one after one, then go and create new panels with those searches in de second dashboard and save this dashboard. Finally delete those panels in the first dashboard ... View more

After you have add input time range with this source code: <input type="time" token="global_range" searchWhenChanged="true"> <label/> <default> <earliestTime>0</earliestTime> <latestTime>now</latestTime> </default> </input> Add this source code after each searches string that you have in your dashboard <earliestTime>$ global_range.earliest$</earliestTime> <latestTime>$ global_range.latest$</latestTime> And time range will be applied to each panel on your dashboard. ... View more

I realized that I can modified the dates default values under “presets”, “relative time” by modified their stanzas in time.conf file. But there is no way to modify the dates default values under “Rate Range”. Furthermore, the format of date is calendar. It means that we should also choose one day in the calendar. So the span between two date will be at least a multiple of 24 hours. ... View more

Hi, In the conventions of splunk, when one panel have more than 8 searches (more than 8 pipe in the search), this panel will be blank. Now you have 18 panels and in if i suppose that each search in one panel have one pipe, it means that your page have 18 pipes wich are to more. I advice you to create others dashboards and put some panels in them so that all your dashboards to run well. ... View more