Thanks... don't have admin access. Will be waiting for it to be added to app. ... View more

That answers my question. It is not ideal for my use case though. ... View more

In short, yes, it is possible. I have dashboards where you click on any of 3 charts/tables to select what is broken out in another 2 panels. The documentation provided above should get you started. There is a learning curve... but not too bad. I would take a look at the Splunk example dashboards too. ... View more

Tstats syntax is a little tricky. I suspect you don't have everything you need there on variable names. Try doing a pivot and then looking in search detail (at normalized search I think ) I think maybe you want to do something more like the following with subsearches... | tstats `summariesonly` count AS Count1 from datamodel=X by dest severity | append [ | tstats summariesonly=t count AS Count2 from datamodel=XX by dest severity ] OR maybe to join same dest severity row... | tstats `summariesonly` count AS Count1 from datamodel=X by dest severity | join type=left dest severity [ | tstats summariesonly=t count AS Count2 from datamodel=XX by dest severity ] ... View more

I suspect these are scheduled jobs that have not started yet (and should have) so if your instance is running behind on scheduled jobs these start to stack up... which of course is exactly when you are most likely to be looking at activity, when things are slow. Suspicion is based on feedback from related case we are working through with Splunk. Take a look at your skipped jobs ratio at the same time you are seeing these in DMC app/splunk_management_console/scheduler_activity_deployment ... View more

When I have had success with save searches, I converted to report in the web interface. I suspect that removed the time tokens for that search. Let me dig up syntax. <panel> <title>Major Incident Count by Program</title> <table> <search ref="KCI_MI_COUNT_BY_PROGRAM"></search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="drilldown">none</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> </table> </panel> Yes, I was correct... there is no time picker tokens, so if you have any in here that is probably why it is trying to run the search. If you convert to report in the interface you should get syntax above. ... View more

Will have admin check, but I think we killed real time. We do have accelerated data models and reports. ... View more

Someone else reported... https://answers.splunk.com/answers/426695/why-i-have-very-old-time-in-my-job-list.html#answer-432343 ... View more

Yes https://answers.splunk.com/answers/321611/why-are-jobs-showing-as-dispatched-at-123169-and-k.html ... View more

And a step further to handle both use cases of absolute date range and relative. In this case time picker is called timerange <query>| loadjob savedsearch="username:APP:searchname" | eval start_time_rel=relative_time(now(),"$timerange.earliest$") | eval end_time_rel=relative_time(now(),"$timerange.latest$") | eval start_time=coalesce(start_time_rel,"$timerange.earliest$") | eval end_time=coalesce(end_time_rel,"$timerange.latest$") | where _time>=start_time AND _time<=end_time</query> I am sure there is a better way to do this (setting tokens or something) but this is what I cobbled together for now. ... View more

Yeah, what he said. ... View more

Perfect used case for label/value functionality... I partially changed below. Basically you need to carry changes into your search. <input type="dropdown" token="source1" searchWhenChanged="true"> <label>Source</label> <search> <query>| inputlookup Lookup.csv | stats count by source | table source</query> </search> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> </input> <input type="dropdown" token="service1" searchWhenChanged="true"> <label>Service</label> <search> <query>| inputlookup Lookup.csv | search source="$source1$" | stats count by service | table service ServiceCode</query> </search> <fieldForLabel>service</fieldForLabel> <fieldForValue>ServiceCode</fieldForValue> </input> <input type="dropdown" token="method1" searchWhenChanged="true"> <label>Method/Operation</label> <search> <query>| inputlookup Lookup.csv | search (source = "$source1$" AND service = "$service1$")| stats count by method | table method MethodCode</query> <earliest>0</earliest> </search> <fieldForLabel>method</fieldForLabel> <fieldForValue>MethodCode</fieldForValue> </input> <input type="time" token="time" searchWhenChanged="true"> <label>Last Transaction Time</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> <panel> <event> <title>Most Recent Event</title> <search> <query>| inputlookup Lookup.csv | $serviceCode$ = search (source = "$source1$" AND service = "$service1$" AND method = "$method1$") |sort -_time | head 1 <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <fields>["host","source","sourcetype"]</fields> </event> </panel> ... View more

No luck so far. ... View more

I am not familiar with these dashboards, but I have done a fair amount of drilldown. You will need a couple of things... Determine params the receiving dashboard needs. If you can set it up the way they want it to be and see the params in the address bar you are most of the way there. Make a copy of this... Add drilldown to starting dashboard - MAKE A CLONE FIRST... below is an example from simple xml dashboard with timepicker named timerange with table drilldown to JIRA, another dashboard, and an open search with specific parameters named in each depending on row/column clicked. <table> <title>My Ttiel</title> <search> <query>mysearch | eval Events="Events" | table KER Events JIRA_Issues count </query> <earliest>$timerange.earliest$</earliest> <latest>$timerange.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="drilldown">cell</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> <drilldown target="My New Window"> <!-- Access the input on the target form, which is in the same app --> <!-- sourcetype.tok is the token for an input to the target form --> <condition field="KER"> <link>KER_RECORD_EDITOR?selectedKER=$row.KER$&amp;earliest=$timerange.earliest$&amp;latest=$timerange.latest$</link> </condition> <condition field="Events"> <link>search?q=KER=$row.KER$%20$indexes$%20eventtype=KER_HTML5_ERROR&amp;earliest=$timerange.earliest$&amp;latest=$timerange.latest$</link> </condition> <condition field="JIRA_Issues"> <link>https://issues.paychex.com/issues/?jql=text%20~%20$row.KER$</link> </condition> </drilldown> </table> ... View more

So now I seem to be able to modify email subjects. Further investigation it seems like you cannot include search fields specific to results in Subject, e.g. This string: Subject Test: Search: $name$ Results: $results.count$ Date: $result.Date$ Client: $result.Client$ In Subject: Subject Test: Search: This is Search Name Results: 1 Date: Client: In Body: Subject Test: Search: This is Search Name Results: 1 Date: 2016/04/05 Client: 12345678 It doesn't seem to matter what other email parameters are. Per result, per search, inline table, etc, from splunkweb does not want to put $result.fieldname$ in subject. @woodcock thanks for your feedback. Will probably go that direction. SPLUNK: It would be extremely helpful to be able to do per result emails with field values in subject... this would allow same email to indicate actionable or not, etc. Please consider putting this capability in Splunkweb. ... View more

We just updated to Search head clustering and 3.3.11. Will play with the console stuff when I get a chance. ... View more