Ok, try this. I have used Advanced XML and what I am basically doing is creating a customized time picker using the StaticSelect module , which then uses a stringreplace intention to customize your search.You could do this in Simple XML also.You can add more time selection options yourself.I tried using the TimeRangePicker module, but couldn't determine a way to extract the earliest/latest values to set as intentions. <view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html"> <label>Unique count for total logged in users</label> <module name="AccountBar" layoutPanel="appHeader" /> <module name="AppBar" layoutPanel="navigationHeader" /> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="Message" layoutPanel="messaging"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">1</param> </module> <module name="StaticSelect" layoutPanel="panel_row1_col1"> <param name="settingToCreate">time_numeric</param> <param name="staticFieldsToDisplay"> <list> <param name="label">Day</param> <param name="value">-1d</param> </list> <list> <param name="label">7 Days</param> <param name="value">-7d</param> </list> <list> <param name="label">30 Days</param> <param name="value">-30d</param> </list> </param> <param name="label">Find count of users logged on for the first time in the previous </param> <module name="ConvertToIntention"> <param name="settingToConvert">time_numeric</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="time_numeric"> <param name="value">$target$</param> </param> </param> </param> <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="true"> <param name="search"><![CDATA[index=myindex sourcetype="my_log" login latest=@d | stats min(_time) as firsttime by uid | where (relative_time(now(),"$time_numeric$@d") <= firsttime) AND (firsttime < relative_time(now(),"@d")) | stats count ]]> </param> <module name="SimpleResultsTable"></module> </module> </module> </module> ... View more

"Event Types" are your friend 🙂 http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Abouteventtypes ... View more

It is not mandatory to use a UF as there are several potential topologies to push and pull data into your Splunk Indexer(s). It really boils down to your particular data source & architectural requirements. 1) UF on each server 2) Dedicated UF instance where a UF can not be installed ie: to receive and load balance syslog feeds from network devices or to open up privleged ports 3) No use of a UF...raw feeds to TCP/UDP socket inputs on the Indexers, syslog, scripted inputs that remotely poll your sources, rsynced log files to your Indexers etc... Universal Forwarders are certainly a best practice to data collection and can further augment your architecture with load balancing, data cloning, compression, encryption, indexer acknowledgement,throttling, centrally configurable using Deployment Manager etc... I certainly try to use a UF wherever it is possible, but if not possible, Splunk has many other avenues for Indexing your data. This should help : http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor ... View more

Splunk does not use a Relational Database to store and manage its data. It uses flat files on the file system called "Indexes". http://docs.splunk.com/Documentation/Splunk/latest/Admin/WhatsaSplunkindex ... View more

A few things to troubleshoot : Are you sure the search is returning results ? Have you "enabled" summary indexing on the scheduled search ? Are you sure the search is being fired ? What does the time schedule pattern look like(Basic/Cron) ? ... View more

Hello NK 1, What does "ensure you have enabled the poll_jmx.sh / poll_jmx.bat script input" mean? In SPLUNK Web, go to Manager->Data Inputs->Scripts ,and ensure that the "status" for the script is "enabled". By default when you install SPLUNK4JMX, the "poll_jmx" script is disabled . The reason being so that you can first configure your XML config file with your environment settings before SPLUNK starts to poll your JMX servers. Furthermore, read over the PDF docs..there is heaps of good gravy in there 🙂 ... View more