This sounds like a good idea for an enhancement request. Instead of thinking of a sql table being a list of events ordered by time, think of a sql table with fields that have a timestamp with objects that are modified, that then could be turned into events by simply making the rising column the modified date and not having to worry about what order splunk is getting them in. Thus making event logs from any ordinary Application. ... View more

so '?' is the last_record from the previous run and not the biggest number/value from the previous run? Looks like a bug to me. ... View more

you install a lightweight forwarder on any remote server and it can be used to feed splunk. Of course the machine you are on has to have some way of negotiating with the remote machine, but that would be a networking discussion. ... View more

I would like to do this same thing but with "splunkjs/mvc/simplexml/element/table" so that I can have the open in search feature and Loading image. I attempted to simply change it to "splunkjs/mvc/simplexml/element/table" and it did not work, said there was no extend method. Do you know how I can achieve this? ... View more

Here would be my expected behavior: The realtime search runs while the dashboard is open. The cache is kept for it's duration. What happens when you leave? The realtime search only runs until the cache runs out of time. I think of selecting a realtime search in a dashboard.. being connected to that dashboard, same with the cache.. so if none of that dashboard is open, then the realtime search should not be running, and the cache should not be updating. ... View more

The auto_cancel works great! I have 7 different tokens that can be set by the user and setting it to realtime and setting those tokens at once could make splunk fill up with realtime searches that would run forever really fast. Thanks for your assistance. ... View more

I found Jquery.TipTip at $SPLUNK_HOME\share\splunk\search_mrsparkle\exposed\js\contrib.. is this something I can use in my web framework project, or would it be too dangerous(be replaced) in the future? I would like to keep a splunk look and feel. ... View more

I did mine a little different than the example.. where it says .addClass('icon') i did .addClass('icon').addClass(icon) Then i wrote the css as follows(example): td.icon.alert-circle { color: red; } td.icon.check-circle { color: #006400; } etc. The other method was not working properly as it was inheriting it's color from it's master for some reason and they were staying blue, i find this more clean as well. ... View more

yep, thanks! it worked ... View more

Underscore does not seem to be loading even though i have it in my deps var deps = [ "splunkjs/ready!", "splunkjs/mvc/searchmanager", "splunkjs/mvc/simplexml/element/table", "splunkjs/mvc/tableview", "underscore" ]; require(deps, function (mvc) { .. my code }); It is possible that i18n is taking over for _. functions. I am not including i18n.. how do i change the order at which they load for my dashboard? ... View more

Yeah I just found something that says I need that. I do have it in there. I will verify that it is being loaded. ... View more

Actually The name "Splunk" is a reference to exploring caves, as in spelunking. Per http://en.wikipedia.org/wiki/Splunk. ... View more

nope, those looks good, here is a reference : http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Commontimeformatvariables ... View more

It has to be through javascript ... View more

Ok so i tested what you said above. set the cache=120, set realtime to 30 seconds.. they ran all night.. So i changed the cache=False.. and set the realtime to 30 seconds.. same exact parameters.. and they are still running... ... View more

Also, here is many ways through javascript to have multiple lines for one: http://stackoverflow.com/questions/805107/creating-multiline-strings-in-javascript ... View more

Since there is a lot of repetition there you could split out a huge section of it into 2 javascript functions. that simply return the portion of text that is repeated with a variable for Period. ... View more

Looks like the label event click will be added in the next release. ... View more

I would like.. Events, and a lot more events on everything.. Charts, single, maps. To change the look of icons on a map based on a value in a search. To tap into the power of the google maps api. To be able to modify the on-hover popup html when hovering over charts. An on label click and an on label hover events in charts. An on click and on hover event in a single view. The ability to call the view results dialog from anywhere to open a search for anything. Of course anything and everything is possible with customized javascript and third party libraries. ... View more

This feature would be very nice to have. If we could tap into the power of the Google API, that would be great. ... View more