As Martin Müller said ... You can use Javascript to find out which user/role a user have and you can manage your views/content depending on that user : http://answers.splunk.com/answers/91302/getting-user-role-in-javascript There are several mechanisms to control the content depending on user/roles ... eg. (http)redirect to (static)views, change (some) content within a view using JQuery, using Ajax to load entire content in panels, ... ... View more

I think, the best would be to write a Javascript with handling of session coockies ... -> http://www.w3schools.com/js/js_cookies.asp If you use simple XML, you can write a javascript extension and load that into your dashboard. If you are using Splunk 6, insert the schtip into the dashboard, form, ... - tag : <dashboard script="myscript.js>" or in Splunk 5, put it into the "application.js" ... View more

You can count duplicated event by using the "transaction" command. And then count the events by using "eventcount" eg.: eventtype="*" | transaction session_id | Where eventcount>1 | stats count by eventcount to find out how many duplicates occured or: eventtype="*" | transaction session_id | Where eventcount>1 | stats count(eventcount) to count how many different duplicated events occured or ... ... View more

Try this: | tstats count("event.status") AS Total sum("event.is_success") AS "Success" sum("event.is_failed") AS "Failed" from datamodel="events" where (nodename="event") | eval Percentage=round(((100/Total)*Success),2) I hope, this will solve your problem, Greetz, Robert ... View more

Great Jonuwz! But: This works in Splunk 5, but not in Splunk 6 😞 Any idea to have it for Splunk 6!? Please! 🙂 Thx, Robert ... View more

Hi, probably with a timechart (Users over time). Does this fulfill your requirements? Greetz, Robert ... View more

It's difficult to find a solution without knowing the searches 🙂 But some approach is to combine the 2 searches with "OR" and then pipe the result and make a "stats count" on that values "by parameter" ... and then do a "mvexpand" on that multivalues. But this is a very rough approach 🙂 Greetz, Robert ... View more

Im not exactly shure, what you wanna do ... But if you want to have a custom view where you can do things with the results by your own - I'll give you some ideas and code here: have a look at : Create a custom Splunk view to create a custom view using Django & JS Codesample for accessing results: updateView: function(viz, data) { console.log("The data object: ", data); var myResults = data[0]; console.log(myResults); } You can access the results (array) with data[0], data1, ..., data[0][0], data0, ..., data[1][0], ... accourding the array : data [recordindex][fieldindex] hope that helps, Robert ... View more

Hmm, I use a table in an app and I have the "export", "open in search" and "inspect" options under that table. Code I used : var deps = [ "splunkjs/mvc", "underscore", "jquery", "splunkjs/ready!", "splunkjs/mvc/simplexml/element/table" ]; require(deps, function( mvc, _, $ ) { var TableElement = require("splunkjs/mvc/simplexml/element/table"); var mychart = new TableElement({ "id": "my_chart", "managerid": "search1", "el": $("#RenderPanel") }, {tokens: true}).render(); }); "splunkjs/mvc/tableview" differs from "splunkjs/mvc/simplexml/element/table" - so try to use the simplexml-element. ... View more

The easy way ist to hide that section with CSS 🙂 Each section (Real-time, realtive, datetime, ... ) has a DOM-ID Hide that ID with an CSS : [hash]realtime_view6562 { display: none; } the number (6562) behind "realtime_view" is dynamic - it depends on your dashbaord - you have to find it out with DOM-Tools - like "firebug" (Mozilla FF) 🙂 ... View more

Hi Andrew, you can create a new (CSS)File within your $Splunkhome$/etc/apps/$App$/appserver/static context. Eg. custom.css and bind that within your XML-Dashboard: <dashboard stylesheet="custom.css"> Please mind following links, when migrate Splunk 5 to Splunk 6 : http://docs.splunk.com/Documentation/Splunk/6.0/AdvancedDev/Migration and http://docs.splunk.com/Documentation/Splunk/6.0.1/AdvancedDev/UseCSS hope that helps, Robert ... View more

Hello, a bunch of things were changed in Splunk 6 GUI - and so the CSS classes (from Splunk 5) won't work anymore! You have to look at the classes (via Firebug, etc.) and change them in your CSS! Here is a little overview of some new classes (for the header) Level 1: .header class contains .navbar & .app-bar Level 2: .navbar class contains .navbar-inner with subclasses .nav & .nav.pull-right .app-bar class contains .nav & .app-name .pull-right Here is a smal code-block, you might use : /* 1. Headers */ .header { background-color:#032644!important; } /* 1.1. APP-bar in Header */ .app-bar { background:#fff !important; } .app-bar .nav-pills>li>a { color:#5379af; } .app-bar .nav-pills>li>a:hover { color:#032644; } .app-bar .app-name { line-height: 40px; font-size: 18px; font-weight: 200; color:#5379af; } .app-bar .pull-right { background-color:#fff; } /* 1.2. NAVI in Header */ .nav { background:#fff; color:black; } .navbar .navbar-inner { background: #1f6cae; } .navbar .nav.pull-right { background-color:#fff; } .navbar .nav>li>a { color: #fff; background: #032644; } .navbar .nav>li.active.dropdown>a.dropdown-toggle:hover,.navbar .nav>li>a:hover{ color:#ffffff;background:#1f6cae;border-left:1px solid #111;border-right:1px solid #111; } .navbar .nav>li>a.active { background: #1f6cae; border-left: 1px solid #111; border-right: 1px solid #111; } .nav-footer { background: #fff; color: #333; } Hope that helps .... ... View more

Dear Nick, thank you for your support! As I said, I'm not very familiar with all that sideview-moduls, but I try to learn more 🙂 Regarding that usecase I need : a (custom) overlay (modal dialog) which opens on click within a table-cell, I have already a module for that. grab the $row.fields$ and display custom actions within that modal - eg. link to other pages/views with the selected $row.fields$ OR downstream to other moduls (in my case eg. a switcher/redirector/postprocess module) or like the pulldown-module to "filter" the table. Hope you can help me! Kind regards, Robert ... View more

Yes - copy your style to the applications.css. Adding a applications.css only applies scopes of the app(YourApp)-context - neither splunk-internal- (Manager, etc.), nor other apps are affected. ... View more

As I know, not, because each search uses one thread = one core ... ... View more

If you are new in regex - as I am 🙂 - try to use : Splunk's Field extractor (IFX) or this very usefull regex tester tool : http://www.gskinner.com/RegExr/ Greetz Robert ... View more

Try the regex as Kristian posted (mofidied) : (?msi)Accès\s+:\s+(ReadAttributes|SYNCHRONIZE) ... View more

I'm not shure, what you want to do ... Do you want to filter all events where the string "Accès" AND ("SYNCHRONIZE" OR "ReadAttributes") occur? Would be useful to specify your request. Maybe it's better to filter by (known)fields like EventId, EventCode, etc. than plain strings ... Greetz Robert ... View more

"require()" is a NodeJS (server-side) command - so if you run a (Node)JS on client-side you will get an error. ... View more

RegExr is an awesome tool! I like it! ... View more