Or do I just configure one HEC on the cluster and push this on the configuration bundle to all the indexers? If I do that what is the endpoint - as we are moving from one machine to 3 indexers? endpoint: "https://mx33456vm:8088/services/collector" ... View more

Hi  Thanks, that is perfect.  Thanks Rob ... View more

So this answer https://community.splunk.com/t5/Dashboards-Visualizations/How-to-disable-search-run-in-js-on-page-load/m-p/565782#M46488 by @haph has gotten me very close , but I just cant finish it ... View more

HI   Do you think you could publish the fill javascript for your answer, please.   Regards Robert ... View more

HI  I have done below and replaced the SPL with the following. BUt the .sh scripts run when I load the page the first time, how can I stop that from happening. I would like it to work just when I press the button. Regards Robert A simple | runshellscript Test_Script123.sh 1 1 1 1 1 1 1 1 .            require([ "jquery", "splunkjs/mvc/searchmanager", "splunkjs/mvc/simplexml/ready!" ], function( $, SearchManager ) { var mysearch = new SearchManager({ id: "mysearch", autostart: "false", search: "| runshellscript Test_Script123.sh 1 1 1 1 1 1 1 1" }); $(".button1").on("click", function (){ var ok = confirm("Are you sure?"); if (ok){ mysearch.startSearch(); alert('attempted restart!'); } //else { // alert('user did not click ok!'); //} }); });     ... View more

Hi This seems to work and thanks for your answer. Regards Robert Lynch ... View more

Wonderfull - thanks very much.   Also for other people if you want to add multiple columns  require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { console.log("Hie 1"); mvc.Components.get('tbl1').getVisualization(function(tableView) { tableView.on('rendered', function() { console.log("on rendered"); tableView.$el.find(`[data-sort-key='Header 1']`).find("a").attr({ "data-toggle": "tooltip", "data-placement": "left", "title": "My Tool Tip Value 1" }); console.log(tableView.$el.children('[data-toggle="tooltip"]')); tableView.$el.children('[data-toggle="tooltip"]').tooltip(); tableView.table.render(); }); }); }); require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { console.log("Hie 1"); mvc.Components.get('tbl1').getVisualization(function(tableView) { tableView.on('rendered', function() { console.log("on rendered"); tableView.$el.find(`[data-sort-key='Header 2']`).find("a").attr({ "data-toggle": "tooltip", "data-placement": "left", "title": "My Tool Tip Value 1" }); console.log(tableView.$el.children('[data-toggle="tooltip"]')); tableView.$el.children('[data-toggle="tooltip"]').tooltip(); tableView.table.render(); }); }); });     ... View more

Hi - Thanks for the answer. I did not try your answer as I was able to go with the accepted solution above. ... View more

Wonderfull thanks -  🙂  It works for a TIME token - cheers Also below is another example of how to do it <search base="basesearch_MAIN"> <!-- FInd out how many process are being monitored --> <query>| stats count </query> <progress> <condition match=" $result.count$ != 0"> <set token="Token_no_of_Process">$result.count$</set> </condition> </progress> </search>   ... View more

Hi - Just to come back - i reused this answer again for new issues, seriously great answer 🙂 - Hope to see you at the .cof 2021 🙂   The below 2 isnull commands were needed to get it going | eval firstHalfCountNonZero = mvcount(mvfilter(firstHalf>0)) | eval firstHalfCountNonZero=if(isnull(firstHalfCountNonZero),0,firstHalfCountNonZero) | eval lastHalf=mvindex(sparkdata, ceiling(mvcount/2), mvcount) | eval lastHalfCountNonZero = mvcount(mvfilter(lastHalf>0))       ... View more

Sorry i am gettign this when i do that   bash$ splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus QUERYING: 'https://127.0.0.1:9089/services/admin/inputstatus/TailingProcessor:FileStatus' This command [GET /services/admin/inputstatus/TailingProcessor:FileStatus] needs splunkd to be up, and splunkd is down. dell425srv autoengine /dell425srv3/apps/AMBER_FWD/splunkforwarder_AMBER_PSC47_SEC1/splunkforwarder/bin/ bash$ ... View more

Did you find a solution as i have the same issue ... View more