Works very well . Thanks !! Is there any documentation regarding the deprecated XML in the new version ? ... View more

<form> <label>Dashboard Performance</label> <description/> <fieldset submitButton="false" autoRun="false"> <input type="time" token="field1" searchWhenChanged="true"> <label/> <default> <earliestTime>-7d@h</earliestTime> <latestTime>now</latestTime> </default> </input> <input type="multiselect" token="USER_ID" searchWhenChanged="true"> <label>Username</label> <choice value="">All</choice> <populatingSearch fieldForLabel="label" fieldForValue="USER_ID">eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by Name USER_ID | sort -count | eval label=Name." (".count.")" | eval USER_ID="USER_ID=".USER_ID</populatingSearch> <default/> </input> <input type="multiselect" token="DASHBOARD_ID" searchWhenChanged="true"> <label>Dashboard Name</label> <choice value="">All</choice> <populatingSearch fieldForLabel="label" fieldForValue="DASHBOARD_ID">eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by DASHBOARD_NAME DASHBOARD_ID | sort -count | eval label=DASHBOARD_NAME." (".count.")" | eval DASHBOARD_ID="DASHBOARD_ID=".DASHBOARD_ID</populatingSearch> <default/> </input> </fieldset> <row> <panel> <chart> <title>Dashboard Performance over time</title> <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$| timechart count | predict count | rename count AS "Report Execution Count"</searchString> <earliestTime>$field1.earliest$</earliestTime> <latestTime>$field1.latest$</latestTime> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">true</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="charting.chart.overlayFields">"Average Run Time (sec)"</option> </chart> </panel> </row> <row> <panel> <chart> <title>Most Accessed Dashboards By Username</title> <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ |stats count by Username | sort 10 -count | fields - total | rename count AS "Dashboard Execution Count"</searchString> <earliestTime>$field1.earliest$</earliestTime> <latestTime>$field1.latest$</latestTime> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">bar</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> <panel> <table> <title>Most Accessed Dashboards By Username</title> <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ | stats count by FirstName, LastName, Username| sort 10 - count | rename count AS "Dashboard Run Count"</searchString> <earliestTime>$field1.earliest$</earliestTime> <latestTime>$field1.latest$</latestTime> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form> That is the one of the dashboards that is not working. Any reason for not being compatible. ... View more

Splunk App for Salesforce. Some are loading and some are stuck at the loading phase . Same XML works in 6.5.3 https://splunkbase.splunk.com/app/1931/ ... View more

Yes, I have tried in incognito mode and other browser as well. Anyhow the documentation says the app is not compatible with Splunk 7.1, I want to know the reason behind it or is there a way to make the dashboard working. ... View more

Some of the dashboards aren't loading in the new version of Splunk (7.1.3) Has anyone configured it on Splunk 7.x and using it ? ... View more

Some of the dashboards aren't loading in the new version of Splunk (7.1.3) Has anyone configured it on Splunk 7.x and using it ? ... View more

Are you sure ? I am thinking of upgrading the Splunk version to 7.1.3 but stuck due to this app, whether it is going to work or not ... View more

chmod: cannot access ‘/var/lib/splunk/kvstore/mongo/splunk.key’: No such file or directory ... View more

Did you raise a support case ? They have suggested me to upgrade Splunk to 6.6+ ... View more

version 6.5.3 ... View more

Hi @harsmarvania57 , The DMC alert for the CRITICAL Disk usage uses the same query and calculation, | rest splunk_server_group=dmc_group_* /services/server/status/partitions-space | eval free = if(isnotnull(available), available, free) | eval usage = capacity - free | eval pct_usage = floor(usage / capacity * 100) | where pct_usage > 80 | stats first(fs_type) as fs_type first(capacity) AS capacity first(usage) AS usage first(pct_usage) AS pct_usage by splunk_server, mount_point | eval usage = round(usage / 1024, 2) | eval capacity = round(capacity / 1024, 2) | rename splunk_server AS Instance mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)" I see almost a terabyte of difference in the values and even if the backend space in the partition gets changed, the query isn't showing the updated values. Thanks ... View more

I'm experiencing same issue;. ... View more

After replication to the indexers, where does the data store in the indexers, what is path /opt/splunk/var/lib/splunk/kvstore/ mean in the indexers ? we have changed SPLUNK_DB=/local/hot/ and there are two KVstore folders one in /local/hot and other in /opt/splunk/var/lib/splunk/kvstore/ ?? Is it safe to delete /opt/splunk/var/lib/splunk/kvstore/ ... View more

After replication to the indexers, where does the data store in the indexers, what is path /opt/splunk/var/lib/splunk/kvstore/ mean in the indexers ? we have changed SPLUNK_DB=/local/hot/ and there are two KVstore folders one in /local/hot and other in /opt/splunk/var/lib/splunk/kvstore/ ?? Is it safe to delete /opt/splunk/var/lib/splunk/kvstore/ ... View more

Hi @arrangineni , Did you get it working, how did the testing go. Even I am planning to use the dbxlookup for a huge correlation. We could work together Thanks Nawaz ... View more

rex field=_raw "\"id\"\=\>\"(?<article_number>\d+)\"" ... View more

Works as well | eval new=case(match(_raw,".*?basic"),"basic",match(_raw,".*?view"),"view") | stats count by new Results new count basic 4 view 3 ... View more

Please try the following, | eval new=case(like(_raw,"%/acc/basic"),"basic",like(_raw,"%/acc/view"),"view") | stats count by new Results new count basic 4 view 3 ... View more