Let me rephrase... 😉 The option to convert your XML dashboard to HTML and have that be rendered properly in splunkweb was introduced in version 6. You will need to upgrade your Splunk version to take advantage of that feature. Version 6 was a pretty massive release with respect to UI changes/features. There is no way to do it in 5.x. What are you trying to achieve? ... View more

Could you make it one field if the other Q contains what you need...? index=accesslog | eval ipHost = ClientIP+":"+Hostname | stats count as CPM by ipHost | .... ... View more

Is this a question? 😉 Or an enhancement request? ... View more

The option to convert your XML dashboard to HTML was introduced in version 6. You will need to upgrade your Splunk version to take advantage of that feature. ... View more

This app may be of interest to you. Docs here. ... View more

You can see deployment client connections using this search: index=_internal source=*splunkd.log component=ClientSessionsManager But, this is the _internal index, which doesn't survive much past 30 days or so, so if you want a history, you'll probably need to keep track of them yourself; maybe with a temporal lookup table you append to with results from the above search (scheduled to run periodically)? ... View more

Is this a FIX log format, by any chance...? If so, have you seen this: http://apps.splunk.com/app/431/ ... View more

You are on the right track. There are multiple ways of getting data in and the UI is OK if you want to index files from the same server. If the data comes from a different box, you'll want to use a universal forwarder to watch a file/directory and forward to your indexer. Depends on your architecture. I'd recommend watching this for starters: http://www.splunk.com/view/education-videos/SP-CAAAGB6 and reading through this http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor for more details on the various options. ... View more

And it works just as well with your SEDCMD/RegEx ... View more

See my answer below. What version of Splunk are you on? ... View more

I have just tested it succesfully with this props.conf entry: [answers_json] SEDCMD-StripHeader = s/^.*(\{.*$)/\1/ KV_MODE=json pulldown_type=1 ... View more

I beg to respectfully differ. 🙂 I believe your RegEx only matches 'J', because you used a lazy match (?). So, if you like your RegEx better, try it without the '?': SEDCMD-stripjsonheader = s/^[^{]+// Note that I also don't think you need the global flag, so I removed it. ... View more

No problem. Strange that you didn't see the computerID, I had tested it with your raw data sample to make sure it works. Oh well, glad you got it working! ... View more

Try */5 19-24,1-6 * * * It appears that ranges have to be ascending, i.e. 19-6 doesn't work, but the above does. ... View more

If your context is Splunk's internal authentication system, then yes. Password changes produce an entry in the _audit index: index=_audit "action=password change" Will show you the relevant log entries. If you are using an external authentication mechanism (AD/LDAP), you will probably need to go to the source. But I am not sure about that one. ... View more

What is the search timeframe for each search...? Can you post an example from your savedsearches.conf? ... View more

It would, as this attribute is not documented for 6.0.3.; likely added in 6.1 with other cool new UI stuff. You may like a SH upgrade to 6.1.1. 🙂 ... View more

NOTE: For some reason, it changes the 'A' of the second 'agent' in the first REGEX to lowercase when I comment. Make sure the case matches on all references to fields. ... View more

Please read up on props/transforms; you are very likely not dumb, this stuff takes a little practice. 😉 This works for me: 1) props.conf [mySourcetype] REPORT-AgentFields = get_agent, get_folder, get_computer 2) transforms.conf [get_agent] REGEX = Agent=(?P [^,]+) FORMAT = Agent::$1 [get_folder] REGEX = ^(.*)/ SOURCE_KEY = Agent FORMAT = folder::$1 [get_computer] REGEX = ./(.?)$ SOURCE_KEY = Agent FORMAT = computerID::$1 It probably can be simplified a bit more, but I hope you get the idea. ... View more

You can attach the extraction to your sourcetype/source/host, either via the UI (Settings->Fields->Field Extractions) or by directly editing props.conf. Details: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsatsearchtime [Please accept answer if it solved your problem] ... View more

Is this what you mean? base search | stats sum(value) as sum by field Some example data would help, if that's not what you needed. ... View more