Thanks Derek, If I find some more details I will post it here.. ... View more

This morning version 7.2.1 became available to me. I conclude from this that the roll-out of new versions are per region, but the (bulletin) messages you see in your instance are sent immediately all over the world after a release in US regards Ashley pietersen ... View more

Still showing version Splunk 7.20 (we are located in the Europe/Netherlands, maybe they rollout per region) - I will it tomorrow again.. Thanks ... View more

I think so but the Splunk webportal should show the latest version, but it did not, just showing 7.20. Cleared all browser caches I could find . So you were able to download the new version!? - I will check myself . Thanks ... View more

Ok after creating a support ticket, restarted and rebooted several times, disabling Dashboard_example app, run the splunk7.2.0.msi repair over it. My Splunk behaves as expected again. Splunk Splunk Support assumed that the dashboard.css was overwritten somehow by the dashboard.css of the Dashboard_example app. What could explain what has happend. Apperently, during my testing with the Dashboard_example 7.2.0 app and trying to build a new dashboard in the Search app I might have of accidently copied the dashboard.css of the Dashboard_example app (located in C:\Program Files\Splunk\etc\apps\simple_xml_examples\appserver\static) in to Search app under directory: $SPLUNK_HOME/etc/apps/search/appserver/static. I am happy that everything is running as expected again and I like to thank 493669 and Splunk support for the help, tips and support. Best regards Ashley Pietersen ... View more

Yes I understand what you say, the dashboard below is running in...../en-GB/app/search/overlay3 (search app) Btw: In the meantime I have created a supportticket. And further I have restarted and rebooted my splunk instance and Win2012R2 -system. Disabled Splunk-Dashboard-examples app and also run a repair from the recent Splunk720...msi. Now in the process of testing it all again (clearing cache etc...) Latest update: it seems it is running normal again. No source code info below dashboards (in search App) anymore, but still in the proces of testing it. Keep you posted ... View more

@493669 · as far as I can see this dashboard has been created in search & reporting. I have already restart and reboot system. Disabled Splunk-Dashboard-examples app and also run a repair from Splunk720...msi Now in the process of testing it all again (clearing cache etc...) Keep you posted. ... View more

Hi, thanks for your response, This is what I see: For self-created dashboards under app search&reporting, so not exclusively under dashboard-examples Q: So by what script or config file is this controlled? ... View more

Hi jkat54, Thanks for the code, that was very helpful. this works fine for what I am trying to achieve,. I will need to look in to the details about your using "return $helpdoc" and the fact that you start with inputlookup which is the other way around as I did. Thanks again!! My final code is now: |inputlookup [ | makeresults | eval msgtxt="$nr$" , msgcode=substr(msgtxt,5,2) | table msgcode | lookup EVENTLIST_3v3 nr as msgcode OUTPUT helpdoc | fields helpdoc | return $helpdoc ] | table help best regards Ashley Pietersen ... View more

HI TISKAR, Thanks, I will need to test. It runs everyday. I will let you know asap. regards Ashley Pietersen ... View more

See below: index=XXX AND MachineID=YYY AND (Tag="Application.MM_PD.scMachineControl_RBS.iCntHourRuntime") | dedup _time | timechart span=1d@d max(Value) as maxhours min(Value) as minhours | eval daily_hrs=(maxhours-minhours)/2 | appendcols [search index=XXX AND MachineID=YYY AND Tag=sText AND Value="*error" | dedup _time | timechart span=4h dc(Value) as err_4h | timechart span=1d@d sum(err_4h) as err_day ] | eval MachineID="DeBaenst2" | table MachineID _time err_day daily_hrs maxhours minhours ... View more

Hi Adonio, Thanks for your response. Understood! regards Ashley Pietersen ... View more

Hi Chuckers, Please read my post again, I my opnion it does exactly what you want: embedding a dashboard (NO REPORT) in an iframe. we use it now for some weeks and it still works fine. If you want I can show/send an example regards Ashley Pietersem ... View more

I had the same question and struggle: how to embed a full dashboard of Splunk into our own content management system (cms). (In stead of adding single panels in an iframe that also must be explicit enabled for embedding in Splunk to use it in an iframe elsewhere. Struggled for months with this issue, ie using (reverse) proxy etc.... Solution appears to be simple, at least sofar... 🙂 We have Splunk version 6.5 running and want to embed dashboards in our Liferay CMS. (a mulit-tenant environment) In web.conf look for the lines and change the setting of 1 to 0 (see below) # setting X-FRAME-OPTIONS header to SAMEORIGIN helps to prevent "click-jacking" attacks x_frame_options_sameorigin = 0 Now I can embed a full dashboard into our own Liferay CMS that works as an front-end to our Splunk instance. Nb. if you have set the insecure_login option you can add name and password in the url Nb. if you add some extra parameters in the <dashboard : hideChrome="true" hideEdit="true" > at the beginning of your the source and add per panel the "<option name="link.visible">false</option>" it seems to work fine without the ability to drilldown or be redirected to the main Splunk instance. hope this will work for you too Note: added later, in same web.conf to enable insecure_login (name and password in url): # Toggle the insecure login endpoint enable_insecure_login = 1 (from 0 -> 1) http://splunk.aaaaa.com/en-GB/account/insecurelogin?username=aaaaaa&amp;password=bbbbbbb&amp;return_to=/en-GB/app/search/yourdashboardname regards Ashley ... View more

Hi WilsonWu94 Is this what you mean? <panel> <html encoded="1">&lt;img src="http://splunk.eremote.nl/en-GB/static/report-head-icoll-L-43.png" /&gt;<p></p></html> </panel> Note: unfortunately this did not work for me. Allthough I like the Splunk product very much, the pdf report function is below any standards I have seen over the years. I have been struggling now for month to work-around and use a third-party solution for it but was not succesful yet to integrate. Now I am now using Fireshot to create periodically manualy pdf reports of our dashboards. In fact the only thing I need is a screenshot of my dashboards and packaged in a pdf with some text added in a scheduled email. I do not need all kind of links or any other smart pdf things. How difficult can that be for these smart Splunk wizzkids-guys. 🙂 I am afraid it is a lack of urgency/focus on the presentation layer of the management or marketeers at Splunk. This is most frustrating because it is the only way to show my customers any results from Splunk. Note: A login in for my customers is not allowed by Splunk copyright limitations. !? So what is left? nb. there are tons of free and commercial webbased and standalone pdf tools and solutions. Now I am trying to create some kind of script based on Phantomjs. But I am not a programmer it cost me lot of effort to replace/workaround this lame part of Splunk. A waste of time and money because I probably need an extra server instance too for this. And at the end no good for Splunk self, because my customers do not appreciate this poor scheduled reports either. And yes, for the rest I am very happy (and have great fun) with the Splunk engine 🙂 Regards Ashley Pietersen ... View more

Note: I have stored the images in this diretory (was a suggestion from an other post on this forum) c$\Program Files\Splunk\share\splunk\search_mrsparkle\exposed right or wrong regards Ashley Pietersen ... View more

Yes, I have the same issue. Version 6.5.0. But I am a newbee with Splunk. I have added some lines (row) to the report as a header: <panel> <html> <img src="http://<splunk-server>/en-GB/static/report-head-icoll-18.png" /> </html> </panel> It is very crucial feature to us, we need to have a kind of branding in our scheduled report. Manual printing of the report to a pdf is working OK. Have no clue where to look for s solution. It should work as a standard feature. Hope someone has a clue or hint Regards Ashley Pietersen ... View more

I agree, this is a poor feature. Hope they will come up soon with a WYSIWYG solution. This is far from perfect when you have long table output. Disappointing for a Big Data tool as Splunk. ... View more