You should be able to do this in simple XML using the drilldown attribute with a link of /en-US/app/search/flashtimeline?sid=$row.sid$: <table> <title>Dashboard of Jobs </title> <searchString>| rest /services/search/jobs | search dispatchState="DONE" delegate="scheduler" | fields label sid </searchString> <drilldown> <link>/en-US/app/search/flashtimeline?sid=$row.sid$ </link> </drilldown> </table> Please ignore that extra space on each of the tags. For the life of me, I cannot get Splunk-Base to list list the literal XML. See http://pastebin.com/Jf8eNqMF for a better version. ... View more

I'm not sure of the exact root cause but I think it was due to some overly aggressive logging. Reportedly, the messages no longer appear with 5.0.2 and later. Incidentally, I don't see them anymore ever since I upgraded my installation. ... View more

You can do this with application.js (if you dashboards are bundled in a separate app). The nice thing about this approach is that it works in simple XML. Step one: update application.js First, add the following to $SPLUNK_HOME/etc/apps/YOUR_APP/appserver/static/application.js: if( Splunk.Module.SimpleResultsTable ){ Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, { renderResults: function($super, htmlFragment) { $super(htmlFragment); if (this.getInferredEntityName()=="events") { this.renderedCount = $("tr", this.container).length - 1; } $.each( $('.simpleResultsTable td'), function(index, value) { $(this).attr('data-value', $(this).text() ); }); } }); } This code will add the value of the field to the table cell which allows you to write CSS that matches the table such that you can stylize it. Your table cells will look like the following and will contain an attribute named "data-value" which allows you to write CSS selectors to match and stylize table cells: td class="d" field="ScanStatus" data-value="Not up to date">Not up to date Step two: define CSS Next, make the CSS selectors in $SPLUNK_HOME/etc/apps/YOUR_APP/appserver/static/application.css. Something like: .SimpleResultsTable tr td.d[field="title"][data-value="Not up to date"]{ font-weight: bold; background-color: #C42323; color: white; } I am using this technique in an application I am writing right now and it works well. See http://lukemurphey.net/projects/splunk-website-monitoring/wiki for a screenshot. ... View more

How can the error code be matched up to the PDF? It is as simple as a one-to-one match? If so, you could probably just use a lookup (CSV) file which matches up the error code to the URL and produces a new field with the URL (like error_code_url). If you really want to make the link easy to use, you could make a custom event renderer that converts the field into a URL. ... View more

There is an app on Splunk-base which will allow authentication via RADIUS and incorporation of roles from the server. See radius-authentication. The setup screen will allow you to select the vendor-specific attribute that contains the user roles. You can also map the roles using a lookup file if you want to override the server provided roles. ... View more

I highly recommend taking a look at dev.splunk.com. Here are a couple of useful links: Controller how-to Module how-to If you are creating a controller, you may want to look at the /paths endpoint (http://127.0.0.1:8000/en-US/paths) which provides a list of the registered paths (similar to the /modules endpoint [http://127.0.0.1:8000/en-US/modules]). ... View more

There is a couple ways to do this but the best is probably to use a suppression rule. The nice thing about suppressions is that you apply to all matching events and you can easily modify the suppression to reverse the effects if if doesn't work the way that you hoped. Below are directions: Open the ES Configuation page and open "Notable Event Suppressions" Click "new" to make a new one Create the suppression with a search that matches the events you want to suppress. If you want to suppress all of them, them make the search something simply "index=notable". Make sure to set an expiration date, otherwise, your notable events will all be hidden. Save the suppression once you are done. By default, the suppression does not apply retro-actively. However, you can change this by editing the suppression. Click the suppression to edit it and set the time appropriately. Since you have a new installation, you may just want to set the time such that it matches all events before the current time. This can be done by editing the part of the search with "_time>=" to something like "index=notable _time<1359784000 _time>=0" Here are some notes on the contents of the search: index=notable: this needs to be present in all of the suppressions so that the associated eventtype matches notable events _time >= 0: this defines start of the time range that the suppression applies to _time < 1359784000: this defines end of the time range that the suppression applies to ... View more

A defect in Windows causes sockets to be leaked. This can be fixed by applying a patch; see the Microsoft KB. ... View more