I have an default Navigation Menu for a custom app that i copied from my old server <collection label="Dashboards"> <view name="metrics" default="true"/> <divider /> <view source="unclassified" match="dashboard"/> </collection> <collection label="Searches"> <view name="current license utilization"/> <view name="previous day index utilization"/> <view name="sum-kb-host"/> <view name="sum-kb-host-table"/> <view name="audit cleared"/> <view name="failed-logins-24h"/> <view name="installs-lastday"/> </collection> The Dashboard Menu is showing but the Searches menu is not showing. ... View more

I am tracking open session VPN activity VPN activity can be over long periods of time. I am traking the user activity useing the transaction command on "src and user" like this sourcetype="vpn" | transaction src user I know that the session ends with the msg="NWC30993: Closed connection to*" In theory I could do something like this to find open sessions sourcetype="vpn" | transaction src user | search msg!=*NWC30993*" This gives me different results every time I run the search and different results with different time windows. I also noticed that sometimes if I use transaction with "src & user" and the users session is closed and then reopens the session that the new session is part of the old transaction and will not show up in the search becasue the "NWC30993" is part of the transaction. I can do this sourcetype="vpn" | transaction src user endswith="msg=*NWC30993*" but this excludes any open transaction that do not end with the "closed connection" event. Let me know if this makes sense Any suggestions would be great ... View more

I would rather not have the "Find More Apps" button visible for the user to experiment with How can i turn this off ... View more

I have this search index=_internal source="*metrics*" group="per_index_thruput" series="customindex" host="*MyIndexers*" this gives me the sum(kb) for each "customindex" that is recorded on each indexers metrics.log When I do this index=_internal source="*metrics*" group="per_index_thruput" series="customindex" host!="*MyIndexers*" this gives me the sum(kb) for each "customindex" that is recorded on each hosts metrics.log Since the host is sending and the indexers are receiving how is it that the hosts are sending less than what is being received? ... View more

I have this log entry in the "license_usage.log" file 10-20-2014 23:56:16.888 -0500 INFO LicenseUsage - type=Usage s="" st="WinEventLog:Application" h="" o="" i="27AA4E28-C9C6-4177-84F1-9A79462121BB" pool="auto_generated_pool_enterprise" b=55412 poolsz=xxxxxxxxxxxx I don't know what system is sending these logs. How do I know what system is sending these logs and if I am being charged for the logs from this system? ... View more