Hi ccsfdave, I'm using the sentiment app on Splunk 6.4.2 and it works. I index twitter feeds and use base search here | sentiment twitter text | more Splunk-Fu here to get the sentiment analysis done on the event field text using the twitter dataset. The result will have a new field called sentiment , but it looks like you got confused by the commands the app includes and the returned fields. The App will include these commands: This app includes: two trained datasets (twitter and imdv) three search commands: sentiment to predict user sentiment language to predict what language an event is written in tokens to make it easier to tokenize terms and phrases for analyzing text heat to measure how emotionally charged a text is Hope this helps ... cheers, MuS ... View more

Hi stoelpin, this sounds like some report rather than a dashboard. To find this saved search you can run this rest search on your search head (if you have only one SH) or on your SH's (if you have multiple) or on your SHC captain (if you have a SHC): | rest /servicesNS/-/-/saved/searches/ | where is_scheduled=1 AND 'action.email'=1 | table eai:acl.app title This will return all saved searches that are scheduled and are setup to send an email. If you still cannot find the saved search, check the scheduler log for the name or SID and also check the splunk logs to find the sender of this email. Hope this helps ... ... View more

Hi peters1901, this is not really a DNS resolution, but it will show you how it can be done using a lookup table containing host name and ip's: ip,host 192.168.56.10,master 192.168.56.11,node1 192.168.56.12,node2 192.168.56.13,node3 Using this dash board you will be able to search in index=_internal for an IP based on the select host name in the drop down: <form> <label>Host name to ip search</label> <fieldset submitButton="true"> <input type="dropdown" token="host" searchWhenChanged="true"> <label>Host</label> <search> <query>index=_internal host=* | dedup host | table host</query> </search> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> </input> </fieldset> <row> <panel> <chart> <search> <query>index=_internal [ search index=_* host=$host$ | lookup ip2hosts host | dedup host | rename ip AS clientip | return clientip ] | timechart span=1d count by clientip</query> <earliest>0</earliest> <latest></latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> </form> Of course you need to adapt it to your needs and don't nail me on performance, since I never tested this in larger environments 😉 Based on the docs about external lookups http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Configureexternallookups#External_lookup_example you can replace the text file based lookup with a script based lookup. Hope this helps to get you started ... cheers, MuS ... View more

Hi jagadeeshm, It might sound strange, but yes you need to add the index to the search head as well. Don't worry about storing data on the search head, because if you setup data forwarding on your search head and tell Splunk just to forward the local event and not to store it you will have no local summary data on the search head. See the docs http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/Forwardsearchheaddata about the best practice to forward logs from search heads to the indexers. The option indexAndForward = false is the one which prevents Splunk from keeping a local copy of your events. Hope this helps ... cheers, MuS ... View more