The closest thing you have is using the heatmap overlay option or rangemap command, however what you want can only be accomplished with js. ... View more

What you could do is set up a dedicated deployment server to be used by your search head cluster masters or use your existing. Then within the deploymentclient.conf change the repositoryLocation on your cluster masters. [deployment-client] repositoryLocation = $SPLUNK_HOME/etc/shcluster/apps [target-broker:deploymentServer] targetUri= deploymentserver.splunk.mycompany.com:8089 This method will update $SPLUNK_HOME/etc/shcluster/apps on all masters, but you will still have to run splunk apply shcluster-bundle on your masters. If possible I would use a git repository for all apps. From the deployment server Clone all repos from the master git repos. Check out my .conf presentation Nordstrom ITOps ... View more

Take a look at Splunk 6.x Dashboard Examples. It contain many example and has what you are trying to do. ... View more

Seem like a relatively small deployment. Whats your indexing volume? What Splunk apps are you using? Was your indexer ever a search head (All-in-one deployment)? Have you configured the distributed management console, it has a lot of good diagnostic information. I would look at CPU Usage per Splunk Processor. More indexers wont hurt, but adding hardware before you know what your bottle neck is won't necessarily fix your issue. ... View more

I think you want to use extract(kv). This should give you fields for any dynamic range of files in the counts field ...| rex "Counts=\[(?<Counts>[^\]]+)\]" | field _time Counts|extract pairdelim="," kvdelim="=" | fields _time 100* | stats count(*) as * by _time ... View more

I would advise against use sos be instead configure Distributed Management Console. The DMC has a lot more information and is more responsive. Works well with clustered search heads and indexers. It really easy to setup ... View more

What does your current topology look like? How many transforms (index time extractions) be performed? ... View more

Mind voting the question up if it helped you. ... View more

You will want to place the eval statement before the transaction command. | eval JobProcessStarted=if(Event=="JobProcessStarted",DateTime,null()) | eval VariantProcessCompleted=if(Event=="VariantProcessCompleted",DateTime,null()) | transaction JobId | table ProductionId JobProcessStarted VariantProcessCompleted | sort by DateTime desc ... View more

Look at using transaction command ... View more

Within your props.conf you need to specify the ** TIME_FORMAT**. #props.conf [mysource] TIME_FORMAT = < strptime > Use this reference Configuretimestamprecognition ... View more

Do you you have a proxy or load balancer in front? ... View more

I would install the Splunk Reference App -PAS and AUTH0. These contain example data set for Splunk Developer Guidance which uses the Event Gen app. I use it all the time to fake data. Dev Guide Splunk Code Repo Splunk Test Repo Eventgen app on Splunk Base ... View more

I think you want to create new fields called JobProcessStarted and VariantProcessCompleted which contain DateTime. Then you can use transaction and table to make a single row. Not sure if spath is needed. ... | eval JobProcessedStarted=if(Event=="JobProcessStarted", DateTime, null()) | eval VariantProcessCompleted=if(Event=="VariantProcessCompleted", DateTime, null() | spath | table ProductionId JobProcessStarted VariantProcessCompleted ... View more

Mapped drives / CIF Share have problems. You will see data being forwarded but if there is a network or file lock the forwarder will stop forwarding data. ... View more

The fields panel (include interesting fields) is not exposed through the web framework. The search page is render through set of html partials, templates, and minified javascript. Not to say you could not use the components. Many of the components can be found under $SPLUNK_HOME/share/splunk/search_mrsparkle. I believe you can find the field picker code under $SPLUNK_HOME/share/splunk/search_mrsparkle/modules/search Hope that gets you started. ... View more

That does not answer the question of users who are apart of multiple roles. Yes if they are a part of one role I could just use btool with debug after using the rest command. I want to know know the final layering of permission of users who are apart of two or more roles, NOT inherited roles. ... View more

Ok, to me the only thing that seems to be consistent in your two examples is every event ends with time (epoch). I would do is use MUST_BREAK_AFTER instead of BREAK_ONLY_AFTER. [yourSourcetype] MUST_BREAK_AFTER=,"\d{13}" HEADER_FIELD_LINE_NUMBER=1 NO_BINARY_CHECK=true SHOULD_LINEMERGE=true TIMESTAMP_FIELDS=field6 ... View more

You also need to set rotatePeriodInSecs which defaults to 60 seconds which will check if any events need to rotated to frozen. Potentially you could see 240 second delay before events are moved. Think of frozenTimePeriodInSecs as the a threshold and rotatePeriodInSecs as the frequency Splunk checks data for the threshold. ... View more

Why not use post process searches. ... View more

I would recommend reviewing the component reference for Splunk Web. Using Javascript you can select splunk object by id and most Splunk objects how multiple event listeners. //using TextInputView and MultiDropdownView var hostInput = splunkjs.mvc.Components.getInstance("host-input"); var dropdownManager = splunkjs.mvc.Components.getInstance("multidropsearch1"); dropdownManager.on('change', function() { hostInput.settings.set("value", '') }) This is only a snippet. If you want to add an event listener I would start by extending backbone object to added an on click event. Just the on change should meet your need. ... View more

similar question has been answered. http://answers.splunk.com/answers/287850/am-i-able-to-use-tokens-for-a-report-selection-dro-1.html#answer-287853 ... View more

You might want to look at rex Non-capturing which may do what you want with some rex trickery, but with out some samples its tough to tell. http://www.regular-expressions.info/refcapture.html ... View more