http://docs.splunk.com/Documentation/Timeline/1.1.0/TimelineViz/TimelineXML I don't use this app, but I don't see anything in the docs about hiding the legend. ... View more

does your input have any spaces or anything? you might need quotes around it? maybe try something like | search XXX_NAME=$series|s$ ... View more

my suggestions need to be at the top. you have autorun="true" in the <query> try to take that out of the query. <fieldset submitButton="true" autorun="true"> <input type="dropdown" token="series" searchWhenChanged="true"> ... ... View more

You can check out the Search Tutorial http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchTutorial/WelcometotheSearchTutorial and the Search Manual http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/GetstartedwithSearch There are a ton of great docs out there for you to read. The Admin Manual and Knowledge Manager Manual. There are docs specific to Splunk Enterprise Security, if you're going to use that. Also, I suggest downloading the Dashboard Examples app if you plan on creating dashboards, as it gives great guidelines to different features and visualizations. https://splunkbase.splunk.com/app/1603/ ... View more

you might need to play with the stats command at the bottom, join by any of the column names that might be in common, or do a latest instead of values. |stats values(*) as * by ExecutionInstanceGUID ... View more

for the issue with MV fields and concatenation, you can always use mvjoin first to get all of the Signature Names comma separated (or any other delim) sourcetype="incident"| sort +Severity | lookup geoip clientip as SourceIP_Address| lookup subnetlookup ip as SourceIP_Address OUTPUT subnet_name AS location | eval client_country=replace(client_country," ","") | strcat client_city ", " client_region " " client_country mylocation | eval final_location=if(mylocation==", ",location,mylocation) | rex field=final_location "(?.) (?.)" | eval Signature_Name=mvjoin(Signature_Name,", ") | eval Event_Detail=Signature_Name+ ";" +Vendor_Signature+ ";" +Incident_Detail_URL+ ";" +Analyst_Assessment | table CreateTimeStamp_GMT Data_Source Reference_Number SourceIP_Address SIP_Region SIP_Country Severity Incident_Category Incident_Classification Event_Detail | outputcsv SymantecReport.csv ... View more

do you have a submitButton="true" / "false" in the fieldset? or autorun="true" / "false" in the fieldset? or searchWhenChanged="true" / "false" in the inputs? your dashboard might require a submit button or one of these options be set. ... View more

if you change your cron to 0 */12 * * * does that help? ... View more

what schedule are you trying to get this on? every 12 hours? ... View more

http://docs.splunk.com/Documentation/SplunkCloud/6.5.0/User/Admintasks Editing and .conf directly in Splunk Cloud requires a Support Ticket with Splunk Support. http://docs.splunk.com/Documentation/SplunkCloud/6.5.0/User/Useraccounts You can change user account settings, such as the password as @arowsell has mentioned, and remove the searches. After doing that you can delete the user account. ... View more

if they are lookup files, maybe something like this: |inputlookup file1.csv|table City|append [|inputlookup file2.csv|table City]|append [|inputlookup file3.csv|table City]|stats count by City|fields - count ... View more

There are a couple of ways you can resolve this issue. If you wish to delete/disable/unschedule the orphaned searches, you can do so under Settings>Searches, reports, and alerts or delete it from the Reports listing page. You can reassign the search in savedsearches.conf by cutting the stanza out from the invalid user and pasting under a valid user and restart your instance. http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Resolveorphanedsearches#Delete_an_orphaned_search ... View more

try my updated syntax. I used a stats command at the bottom to bring back the values of the PackageName by the ID and Error, so it should join the 1s and bla1/bla2s. ... View more

https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Metadata if you're filtering type=host, you cannot search for sourcetype=tps, as metadata only brings back a host column. ... View more

so when ID=1 and PARENT_ID=1, you want to join? if so, try something like this: ....|appendpipe [stats max(CREATION_TIMESTAMP) as CREATION_TIMESTAMP2 by PARENT_ID|rename PARENT_ID as ID]|stats values(CREATION_TIMESTAMP) as CREATION_TIMESTAMP values(CREATION_TIMESTAMP2) as CREATION_TIMESTAMP2 by ID|eval timeDiff=CREATION_TIMESTAMP2-CREATION_TIMESTAMP ... View more

try something like this, maybe: UPDATED index=MYINDEX source=MYSOURCE | eval Day = strftime(_time,"%F") | eval DateTime = strftime(_time,"%Y-%m-%d %H:%M:%S") | stats Latest(LogType) as status Latest(Result) as Result Latest(DateTime) as When by PackageName ,ExecutionInstanceGUID, Day | sort When | streamstats count as "Execution Nr" by PackageName, Day | sort - When | table When, PackageName, "Execution Nr", status, Result, ExecutionInstanceGUID | eval AlertLevel = case(Result=="OK",1,Result=="WARNING",2,Result=="KO",3) | rangemap field=AlertLevel low=1-1 elevated=2-2 severe=3-3 default=guarded | fields - AlertLevel |appendpipe [stats count by ExecutionInstanceGUID | join type=outer ExecutionInstanceGUID [ search index=MYINDEX source=MYSOURCE | rename ExplodedPackages{}.Error AS Error, ExplodedPackages{}.Package AS Package, ExplodedPackages{}.TimeStamp AS TimeStamp | eval x=mvzip(TimeStamp,mvzip(Package,Error)) | mvexpand x | eval y=mvzip(ExecutionInstanceGUID,x) | mvexpand y | eval z=split(y,",") | eval ExecutionInstanceGUID=mvindex(z,0) | eval TimeStamp=mvindex(z,1) | eval Package=mvindex(z,2) | eval Error=mvindex(z,3) | table ExecutionInstanceGUID,TimeStamp, Package, Error]] |stats values(PackageName) as PackageName by ExecutionInstanceGUID Error ... View more

can you provide syntax with how you get current tables? You might be able to use appendpipe. ... View more

if you go to Settings>Searches, reports, and alerts (upper right) you can find the searches that are scheduled and under Actions (on the right) you can click 'Run' ... View more

try this: a space in the value and two spaces in the suffix before inputfield. it worked in a test dashboard. <input type="multiselect" token="lookup_tok" searchWhenChanged="true"> <label>Geofences</label> <choice value=" lookup_a">A</choice> <choice value=" lookup_b">B</choice> <default>A</default> <valuePrefix>| lookup</valuePrefix> <valueSuffix> inputfield inputfield2 OUTPUTNEW field2</valueSuffix> <delimiter> </delimiter> </input> OR two spaces after the prefix and two spaces before the suffix <input type="multiselect" token="lookup_tok" searchWhenChanged="true"> <label>Geofences</label> <choice value="lookup_a">A</choice> <choice value="lookup_b">B</choice> <default>A</default> <valuePrefix>| lookup </valuePrefix> <valueSuffix> inputfield inputfield2 OUTPUTNEW field2</valueSuffix> <delimiter> </delimiter> </input> my output was | lookup lookup_a inputfield inputfield2 OUTPUTNEW field2 ... View more

do you want a separate pie chart, then for OS Score and one for App Score? ... View more

can you just add |addcoltotals ... View more