This is a poor workaround and results in errors in the btool.log for one.  This needs a better supported solution for checking deployment apps before they are pushed out (or after). /opt/splunk/bin/splunk btool check --dir=/opt/splunk/etc/deployment-apps-symlink --debug | grep Splunk_TA_windows Even with or without the symlink to 'system' under this new deployment-apps-symlink, there are btool errors about spec files either not being present, or being in the incorrect place as per.     ... View more

The dashboard executes when the page refreshes + when the button is pressed. How to disable the "refresh" page? ... View more

Hello Chris, in the same way, I would like to know if it is possible to color the node(from or to), when using the link rows? Thank you BR Nordine ... View more

Hi @hoangtony  Can you please share how you are dynamically able to set the border using node fill color using the color field when generating search results ? If possible, it would be great if you could also share the SPL as well. thanks. ... View more

This App seems to be really useful - https://splunkbase.splunk.com/app/5482/. The App auto-updates the MaxMind database without going into the backend every week. It also allows you to run a search command on Splunk search to manually download and update the latest database. ... View more

Please check below query guys the best result i have got,   | `inactive_accounts(30)` | eval LastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S.%Q") | sort -_time   happy splunking!!! ... View more

hi  i want to know how i do alerts if specific users if they have 5 count failed password ... View more

I have a same problem and it seems like, im useing Python-2.7. Can anyone help me on this.  ... View more

Go to this folder and check: /opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db. May be due to some Permission Issues. ... View more

I have finally added this functionality. Please download version 1.4.10 and let me know how you go. https://splunkbase.splunk.com/app/4657/ ... View more

I have fixed this bug in version 1.0.3  https://splunkbase.splunk.com/app/5153/    Thanks for taking the time to report this issue ... View more

I just released version 1.0.3 which allows for customising the colours: https://splunkbase.splunk.com/app/5153/  Let me know if you find any problems! ... View more

This is an endorsement by a Cribl employee. As a previous user of Cribl, I would not recommend it. ... View more

I suppose that, if you have enough fresh version of systemd this should work on any Linux? r. Ismo ... View more

Thanks Chris, There's an enhancement that would be very useful. Currently the path is what describes the hierarchy, but it also acts as the labels for each node. It would be very useful to have a label field, also with a suitable separator that is used to render the description, whereas path just describes the hierarchy. I have a use case, where names are not unique, so my path components have to be ids to separate the distinct hierarchies, but these are not meaningful from a display point of view. One other suggestion 😀 it would also be cool to colour and weight the lines, so for each row, you could define #colour and #weight for the ascending line to the parent. Enjoy the holiday Cheers Antony ... View more

I have updated the Flow Map viz (to version 1.4.9) so that you can now stack nodes underneath everything else by setting the "order" field to a negative value.   https://splunkbase.splunk.com/app/4657/ ... View more

Hi, I have changed the said file to  [default] display.page.search.mode = [smart]   Location of file : C:\Program Files\Splunk\etc\system\local But still UI is showing default as VERBOSE.   ... View more

Hi Chris, Thanks for your quick response. ... View more

I am sorry but I have no thoughts about why you would not be receiving any data at all. It sounds like the script is not being started correctly by Splunk itself. As soon as the script starts it will at the very least print the system time. I would check that the input is enabled, but it sounds like you have probably already done this. ... View more

Thanks for the quick response Chris. We'll give it a go in a test environment first anyway, but good to hear that it should work and thanks for the specific pointers. ... View more

I used both your solutions in the one to get the output i was hoping for 🙂 index=main sourcetype="*:application" | stats sum(eval(event_severity_code="SUCCESS")) as good sum(eval(event_severity_code="ERROR")) as errors sum(eval(event_severity_code="WARNING")) as warn by host | eval from=host, to="BEL" | append [| makeresults | eval raw = "node=BEL label=\"BEL\" icon=cog" | makemv delim="###" raw | mvexpand raw | rename raw as _raw | extract ] | append [ search index=main sourcetype="*:application" | stats count by host | eval icon = "tablet" | rename host as node | table node icon ] | table to from good warn error node icon label ... View more

I am having this same problem. Did you happen to find the solution? ... View more

OK I have fixed the bug and pushed a new version (1.6.6) to Splunkbase. https://splunkbase.splunk.com/app/4537/ Thank you so much for reporting the bug and providing such a reproducible test case. ... View more

good stuff. glad its sorted ... View more

Hi, I'd like to show near real time web traffic without refresh dashboard, any pointers would be appreciated. ... View more