Hi bfnpmsz, I'm not sure if this will work at all, because using $earliest$ is returning epoch - so it would need some conversion first. You can have a look at this run everywhere dashboard which uses a simple panel on top to display the search time range: <form> <label>Display search time ranges in dashboard</label> <description></description> <fieldset submitButton="false"> <input type="time" token="time"> <label>Select time range:</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <single> <search> <query>|gentimes start=-1 | addinfo | convert ctime(*) | eval reportDate=info_min_time." to ".info_max_time | table reportDate</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="drilldown">none</option> <option name="beforeLabel">Report Date:</option> <option name="linkView">search</option> <option name="afterLabel">.</option> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="numberPrecision">0</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> <row> <panel> <chart> <title>Index _internal sourcetype count:</title> <search> <query>index=_internal | stats count by sourcetype</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> </form> Hope this helps ... cheers, MuS ... View more

Hi glentes, Yes it is, I'm running this app on 6.3 and there is so far no problem. cheers, MuS ... View more

Hi xvxt006, based on the provided example you can use this regex: base search here | rex max_match=0 "^,(?<myField>[^|]*)" | table myField This will get everything between all lines starting with , until the next | Update: based on the comments below, this is the correct answer Okay, try this regex it will use shippingResponse= or , which is not followed by a ] as left boundary and the next | as right (?:shippingResponse=|,)(?!\])(?<myField>[^\|]+) Works on regex101.com with your provided examples and returns the following matches: MATCH 1 myField [94-100] `12R071` MATCH 2 myField [159-165] `12R095` MATCH 3 myField [224-230] `12R090` MATCH 4 myField [289-295] `12R078` Hope this helps ... cheers, MuS ... View more

Hi fabiocaldas, introduced with 6.3, you can create a tour for apps. This is done in ui-tour.conf http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Ui-tourconf . If a user has done the tour, like the one in the search app, a file /opt/splunk/etc/users/admin/search/local/ui-tour.conf for the user will be created and within this file the option viewed=1 will be set: [search-tour] viewed = 1 Since this is a .conf file you can search for it using the | rest command from the ui: | rest /services/configs/conf-ui-tour | search viewed="1" | table eai:appName title eai:userName This will give you a table of the App name, the tour name and which user has done the tour. Hope this helps ... cheers, MuS ... View more

Hi TheJagoff, you need to chown the /Application/Splunk directory to the non-root user after you stopped splunk. Try this in a terminal as the non-root user: sudo chown -R non-root-user /Application/Splunk /Application/Splunk/bin/splunk start You also need to modify the /Application/Splunk/etc/splunk-launch.conf file to set the userid which runs splunk. Hope this helps ... cheers, MuS ... View more

Hi aramakrishnan, you can try this regex: your base search here | rex field=_raw "\[(?<ID>[^\]]*)" | do further splunk fu with ID Hope this helps ... cheers, MuS ... View more

Hi phadnett [Splunk], find the answer provided by @bpaul [Splunk] here http://answers.splunk.com/answers/287056/if-my-coldtofrozendir-is-full-or-unavailable-do-i.html cheers, MuS ... View more

Hi raby1996, The important part is to pass on any needed field for the second stats by adding it to the first stats . Try something like this: your base search here | stats .... by bundle, Build .... | stats ... by Build Hope this helps ... cheers, MuS ... View more