If the login name is always the last one to occur in the log line then u can try below: .*\"(?<loginid>[^\"]+)\"$ ... View more

At least on 6.4.2 "restricting to search upto a time" and "restricting search to few index" can be achieved by defining roles and then adding this role to any user. Try below Settings > Access controls » Roles » Add new On this "Add New" page go to section: Search restrictions, second option: "Restrict search time range" which defines: Set a maximum time window (in seconds) for searches for this role. For example, set this to '60' to restrict this role's searches to 1 minute before the most recent time specified in the search. You can also set this to '0' to explicitly make the window infinite, or '-1' to unset the window for this role (can be overridden by imported roles). On the same add new role page go right to bottom to find "Indexes" section to restrict a role from viewing only few indexes. Indexes Restrict this role's searches to the specified index(es). Search results for this role will only show events from these indexes. Once the role is defined, create a user and add this new role to the user. From here on the user will have access only to the indexes specified and will only be able to search in the time range specified on the role. ... View more

Try to set the token in drilldown since you want token to be passed on clicking a value. What you should be looking at is something as follows: < row> < panel> < table> < title> This is the chart on which you will click a row < /title> < search> < query>yourQuery that populates this panel table< /query> < earliest>earliestTIme< /earliest> < latest>latestTime< /latest> < /search> < drilldown> < set token="Name_tok">$click.value$< /set> < /drilldown> : :other table options < /table> < /panel> < panel> ** < chart depends="$Name_tok$"> < title>Title of the chart where the click is reflected in $Name_tok$< /title> < search> < query>your serach query making use of $Name_tok$ as that is what was clicked.< /query> ** < earliest>earliestTime< /earliest> < latest>latestTime< /latest> < /search> : :other chart options < /chart> < /panel> < /row> < drilldown> , < set token> and $click.value$ ensure that token is set on clicking a value < chart depends="$Name_tok$"> ensures chart is only shown up once the token is set. Use the token then in title, search or wherever you want once it is set. Note: Please remove the leading space in each of the tags, like < drillown>, as I do not know how to put tags without spaces in the answer 🙂 ... View more

If host is already a field then yourBaseSearch | timechart max(Avg) by host ... View more

Picked up str8 from the docs: Default Use a default value for an input when users do not make a selection. Initial Use an initial value for text inputs only. The initial value appears only when the form page loads. If a user clears the text field, the initial value does not reappear and the token value is set to an empty string. If you specify both an initial and default value for a text input, only the default value applies Not sure about any pros or cons though but more on inputs can be found here: http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/FormEditor http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/FormEditor#Specify_initial_and_default_input_values ... View more