All, I'm curious if there is a way to permission a form input in Splunk. Right now I have some basic permissioning in place. It uses thi query to populate a dynamic dropdown: | inputcsv userAccess.csv | join [rest /services/authentication/current-context/context | search username!="splunk-system-user" | fields + username] | eval hasPermissions=`hasPermissionsCheck(username)` | where hasPermissions="Yes" | table server_name | sort server_name The thing that I really want to do, however, is make sure that users can't manipulate the URL to type in a server that they don't have access to. I realize Splunk isn't the best at permissioning a single form input, but can anyone think of a way to do this? Thanks! ... View more

All, I'm having an issue where one of my indexers is complaining about a lookup table that I have setup on my search head. I get the error [IndexerMachine] Streamed search execute failed because: Error in 'lookup' command The lookup table 'groupIdToName' does not exist. From what I can tell from other Splunk Answers, the lookup table should be replicated to the search peers as part of the bundle replication (http://answers.splunk.com/answers/28541/lookup-table-does-not-exist.html). However, when I look at $SPLUNK_HOME/var/run/searchpeers/{most recent bundle} on the search peer, I don't see the lookup that should have been copied. In fact, I don't even see the system folder in that bundle. So, I have two questions: How should a lookup be set up for a distributed search environment (i.e. should the lookup live on the search head, indexers, or both)? Assuming my set up is correct and the lookup should only live on the search head, how do I make sure that the lookup gets copied as part of the bundle replication? Thanks! ... View more

All, I have a search that populates monthly browser usage across all browsers. base search | timechart span=1mon count as browserCount by Browser usenull=f We want to display this search in a table so that we can display the actual number. We then want to drilldown into a separate dashboard after we click a value in the row. From what I understand from this documentation, we should just be able to set the time picker in the dashboard drilled into by using $earliest$ and $latest$ . So, I would assume this would look something like: <drilldown target="Drilldown into usage by Browser"> <link> <![CDATA[ /app/MyApp/browser_usage_drilldown?form.groupId=*&form.browserId=*&form.timePicker.earliest=$earliest$&form.timePicker.latest=$latest$ ]]> </link> </drilldown> Instead of using the row's time, however, the drilldown chooses to use the global time of the dashboard. If I switch to a line chart visualization, then this drilldown works as expected. It uses the row's time. Is there a way that we can keep the table view, but still have the $earliest$ and $latest$ work as if it were a line chart? It seems weird to me that changing the visualization would affect the time fields, since the documentation seems to suggest otherwise. EDIT - Here's the XML. Again, if I change this to a line chart, it works as I'd expect it to. Basically I want it to pass through the month that I clicked on. <panel> <table> <title>Count by Browser</title> <search> <query>base search | timechart span=1mon count as browserCount by Browser usenull=f</query> <earliest>-6mon@mon</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> <drilldown target="Drilldown into usage by Browser"> <link> <![CDATA[ /app/ProductMgmt/browser_usage_drilldown?form.groupId=*&form.browserId=*&form.monthVar.earliest=$earliest$&form.monthVar.latest=$latest$ ]]> </link> </drilldown> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="drilldown">cell</option> </table> </panel> ... View more

All, I'd like to do something like the following | dbquery MyDatabase "SELECT * FROM myTable WHERE timestamp > '$earliest$'" replacing $earliest$ with the value of the earliest timestamp from the time range picker. I see a bunch of somewhat related answers on here, but nothing quite like what I am hoping for. So, how can I get a dbquery command to respect the time range that I have picked on my timerange picker. Thanks! ... View more

All, I'd like to allow users to create a dashboard of saved searches without it counting towards their search quota. As it stands now, it seems like any dashboard will run the saved searches under the user account that created these saved searches. For example, if Jon creates a dashboard comprised of saved searches that he wrote, then Smith opens the dashboard, it still counts towards Jon's search quota. At least that's what I'm seeing. Is there any way around this issue? What's the best practice for handling this? Thanks! ... View more

Hey all, I've seen some similar questions around this, but none are quite what I want. I have a field with >10 values that I want to display the percentage of total for each value using a timechart. Right now I can easily get the count by doing something like [baseSearch] | timechart count by myField . The problem that I have is that there's no good way to append the total count to get the percentage. I tried using the appendCols function, but my columns don't appear to be lining up correctly. I'm seeing zero values for total count when the "count by" is non-zero and vice versa. Does anyone know how I can display the percentage over time rather than the count? Thanks! ... View more