That may require switching your dashboard to a non - simple xml dashboard: http://docs.splunk.com/Documentation/Splunk/6.0.1/Viz/ExportHTML And then modifying the HTML to customize and add a logo. ... View more

Looks like that is set by bootstrap.min.css, not a custom file anymore located at $SPLUNK_HOME\share\splunk\search_mrsparkle\exposed\css it's the .navbar .navbar-inner classes Additionally if you are going to change that file, i would recommend doing something like this: http://stackoverflow.com/questions/147500/is-it-possible-to-include-one-css-file-in-another So that if that css is overwritten, you can simply add back the import of your other css file instead of the whole thing. ... View more

This is the only way I found to disable realtime searches. The real_time_menu was not in the documentation that I could see (but did see it in splunk answers) http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/Restrictrealtimesearch I also found someone else who was trying to do this as well: http://answers.splunk.com/answers/88356/remove-real-time-from-dashboard-panel ... View more

AppBar styling is more restrictive For consistency between apps, Splunk 6.0 now constrains AppBar customization to color and logo. To set color, use the color option to the nav element in default.xml. For example: To set a logo, package appLogo.png within $SPLUNK_HOME/etc/apps/ /static Here are the specifications to use for appLogo.png: Specification Description Background Transparent Width variable Height 40px (80px @2x) Margins ~10px top and bottom (20px @2x) The 40px width should a 10px space at the top and bottom, so the logo should be 20px tall. However, there is some leeway to go into the margin area, particularly if the logo has any bits that project up or down or it is particularly complex, square or round. and Search page restyling no longer supported Splunk 6.0 new search page cannot be customized as it does not load any custom javaScript or CSS. Copied from : http://docs.splunk.com/Documentation/Splunk/6.0.1/AdvancedDev/Migration ... View more

Is this what you are looking for? http://answers.splunk.com/answers/1104/lookups-with-a-python-script ... View more

I need this functionality too! You would think they would have this feature be within the django/web framework as it should have all the features and more of the simple xml. ... View more

Yeah and it's new to DB Connect 1.1.1 I would think they would want to fix this sometime soon or update their documentation. ... View more

Yep http://answers.splunk.com/answers/109879/case-sensitive-columns-from-sql One workaround would be to change all your fields to lower case, but I'm not sure these should be case sensitive to begin with (or should at least match the case of the fields returned) ... View more

This infomration you may want to keep in mind as well AppBar styling is more restrictive For consistency between apps, Splunk 6.0 now constrains AppBar customization to color and logo. To set color, use the color option to the nav element in default.xml. For example: Search page restyling no longer supported Splunk 6.0 new search page cannot be customized as it does not load any custom javaScript or CSS. ... View more

That appears to be the right folder, however it seems that changing the css within here is working for me: $SPLUNK_HOME\share\splunk\search_mrsparkle\exposed\css bootstrap.min.css seems to be the one that affects it. ... View more

Did you clear your cache and then reload your page? Or do a hard refresh by holding down shift or ctrl while refreshing? Apparently you cannot customize as much as you used to in splunk 6: http://answers.splunk.com/answers/104685/applicationcss-gets-ignored-in-60 ... View more

Here's a similar thread: http://answers.splunk.com/answers/60608/injest-json-document-returned-from-an-monitoring-endpoint ... View more

You would have to create new versions of the reports and dashboards using the SDK's Here: http://dev.splunk.com/view/sdks/SP-CAAADP7. Otherwise you could give them a link to the report/dashboard within, however it may require them to login. ... View more

with slightly different regex ... View more

have you checked the splunkd.log for any errors? ... View more

This would have to do with the sourcetype = helpspot_errors , that tells splunk of how you want it indexed. Is the sourcetype format dbmon:mkv ? If not you could just set the sourcetype=dbmon:mkv ... View more

Is there anything but integers in the Error_ID field? if you run select error_ID from hs_errors where Error_ID = 'HS-82493' does it come back with results? ... View more

The only way I can think of to use variables in a query is to use tokens within the query. What kind of dashboard are you using this with? (simplexml advancedxml, javascript, django) etc. ... View more

I would recommend making the SQL user have read only permissions ... View more

If you were to use a dbquery command in conjunction with another search, it would be like running the dbquery command many times for each result in the search. Is this what functionality you want? ... View more

what if you leave off the index=_internal ? ... View more