How do you search for all the names/definition of saved-searches local to an (my) app? I'm trying to create a help-screen (dashboard/view) with the following panels: For a list of all tags, I use the search: index=myapp | tags outputfield=name | top name | sort + name For a list of all eventtypes, I use the search: index=myapp | top eventtype | sort + eventtype but for saved-search list, I'm not sure what the search should be?? any ideas? ... View more

hi, I'm trying to setup a custom help screen (via advanceXML) which lists all Tags, Eventtypes, SavedSearches, and Fields extracted for my app. For Tags, I want the panel to look similar to that of admin_ntags.xml For Eventtypes, I want the panel to look similar to that of Splunk>Manager>eventtypes For SavedSearches, I want the panel to look similar to that of Manager>Searches and Reports ... For all listings in each panel, I would obviously remove the App column because I only want to show the Tags/Eventtypes/Saved/Fields associated with this app; as well as removing some non-essential columns such as owner, alert, status, sharing, and action, etc.. I have tried using metadata cmd to find the event(listing), so maybe this can be a search string - but no luck. I have tried using ServerSideInclude, and include the admin_ntags.xml... but haven't got very far with that. Any help is greatly appreciated. ... View more

I'm trying to use the "savedsearch" command in the search-bar on the CLI, but it always returns 0 results. But if I went into the savedsearch.conf file and copy the actual search string out and paste it into the search-bar, results are returned. Whats up? am I using the savedsearch command improperly? in the search-bar, I type: savedsearch klee_test_save ... View more

Hi all, I'm testing a setup in which there are two Windows servers. Both Splunk instances also have the Windows app installed and setup. However in this scenario, I want one of the servers (the smaller one) to only forward the Windows events (and performance data) to the second (primary) server. And I want to be able to report on the performance data of both servers from my primary server. I have figured out how to setup; and have setup the forwarding of data from my smaller server to my primary server (over port 9997). Also, I have turned off all scheduled searches on my smaller server, since I won't be keeping a local copy of data before forwarding. Now, I can see all of the data related to my smaller server on the primary server. But then, I realized there is something called Remote Performance Monitoring (on the Manager/Inputs page). So I go in and set that up as well. In short, I simply appended the remote host-name to all of the existing saved configuration, for example, CPUTime used to be specified only for localhost, now it is specified for both localhost as well as the hostname to the smaller-server. Now the question is: are my events coming in from the smaller server going to be duplicated/redundant? Should I use one method over the other? What if my the smaller server wasn't running Windows (ex. Linux, AIX, etc.)? Any help would be greatly appreciated. ... View more

hi, I'm having problems trying to display results in a PostProcess module. My present scenario is this, I am trying to use a simple Search module to define a generic search, something like ==> search AccountNumber=a1010023 Then within the Search module, I would define a refined PostProcess module and a SingleValue module to display specific results. If my PostProcess module contains an empty search string ==> *, and a FlashTimeline module, the results get displayed. If my PostProcess module contains a search string such as ==> | stats count(MessageType) as count, and a SingleValue module with field=count, I get an weird error message displayed in the SingleValue box. If my PostProcess module contains a search string such as ==> search * | stats count(MessageType) as count; or ==> search AccountNumber=a1010023 | stats count(MessageType) as count; I always get the result returned as 0 (zero). But testing this command in a regular search bar, I can get like 10060 What is going on? am I using the PostProcess module correctly. The reason I choose to use PostProcess is to improve performance of my dashboard. Otherwise I would have like 20 or so active searches going on at once when the dashboard is loaded. I am hoping to start off the dash with a generic search, such as one that gets all the messages of a specific account-number; then within the search module, I would place a bunch of PostProcess modules which gets the specific info it needs to display for that account-number. Any help is greatly appreciated. ... View more

Splunk is not recognizing my configured fields to display. I have a TextField module for entering AccountNumber. Inside this module is Search command and an EventsViewer. Since I am searching by AccountNumber, there is absolutely no reason for the AccountNumber field to be displayed - yet it is. I have tried using HiddenFieldSelector module, which doesn't seem to help. I have tried using the 'field' param inside EventsViewer, but the documentation doesn't specify whether i should use comma delimited, space delimited, or whatever. Which is not to say, I haven't tried everything. Please help thanks in advance ... View more

From the documentation here I can see that drop-downs are pretty easy to accomplish using basic dashboards. But I want to accomplish the same affect in an advanced xml dashboard. I have already done a search on this topic and found nothing quite what I'm looking for. Please help. Here is a reference to the other topic I'm referring to. And to answer the inquiry from the other topic - the reason I am trying to use advanced XML instead of simple XML dashboard is because I am trying to put 2 eventviewers on the same dashboard, driven by one search (click) many thanks. ... View more