Looks like you can create your variables using eval and use them within the query with dollar signs surrounding.. similar to this query index=_internal | stats dc(source) dc(sourcetype) | rename dc(source) AS dcs dc(sourcetype) AS dct | dboutput database=mysql type=sql "INSERT INTO t1 (a, b) VALUES ($dct$, $dcs$)" within the documentation http://docs.splunk.com/Documentation/DBX/1.1.1/DeployDBX/Commands ... View more

Did you end up trying this out? We are looking to Import our SCOM 2012 into our Splunk. I've found a couple ways that this can be accomplished by myself though.. By using http://capacitas.wordpress.com/2012/12/05/retrieving-data-from-the-scom-database/ to extract the data. And by using ACS to create our own logs. http://social.technet.microsoft.com/Forums/systemcenter/en-US/77c20684-8c7b-434a-8354-8340660f98e1/scom-2012-all-event-log-collection?forum=operationsmanagergeneral ... View more

Writing to a Solid State Drive constantly can have some negative affects too, it greatly reduces the life of them by wearing them out. ... View more

Was this determined a bug? Were you able to replicate? ... View more

I also think that it should show the name of the label on hover, as that one label that is super long, you will not know what it says unless you hover over the bar. ... View more

It's actually in the indexes.conf documentation: maxHotSpanSecs http://docs.splunk.com/Documentation/Splunk/6.0.1/admin/Indexesconf ... View more

however it will not be rolled into frozen until it has completed it's journey into cold, which would have to be set to 18 days as well, not to mention the hot/warm time. So the data will remain for 36 days in this scenario with the option of restoring the frozen 18 days of data at any given point ... View more

The information in this post may assist you, Basically you can setup how long something should be in a specified bucket, You can say that something can stay in cold for 18 months and then it will automatically be deleted (if no frozen script is specified), However the data will be as old as the Hot/warm time as well, before starting it's journey into cold. http://answers.splunk.com/answers/114896/splunk-index-retention-based-on-retention-period-only-not-size?page=1&focusedAnswerId=114897#114897 ... View more

What version of browser are you using?.. I would agree on the documentation. ... View more

did you verify your path to the splunk.ui.charting.js was correct and that it is including it on load time? The javascript files should be within the sdk : http://dev.splunk.com/goto/sdk-javascript ... View more

Here is some documentation on the subject: http://dev.splunk.com/view/javascript-sdk/SP-CAAAECM ... View more

Gotcha, thanks.. I've only used the django framework, Is there a reason you choose the html dashboards over django? ... View more

What file do you place that in? ... View more

what version of splunk do you have? ... View more

Put the javascript file in Splunk/etc/apps/MyAppName/django/MyAppName/static/MyAppName Add this to html file in Splunk/etc/apps/MyAppName/django/MyAppName/templates ... View more

Would the fact that the data it is tied to(index) is on a master instance have any affect? ... View more

All set to App .. more specifically: This app only (system) ... View more

You may find this post helpful as well (I believe dwaddle has something similar within his answer) http://answers.splunk.com/answers/55271/report-hourly-max-count-events-per-day-over-a-month ... View more

There's a max, min stats functions that may help you: (your search) | stats max(count) AS max min(count) AS min | table min max This one should work pretty well as I have tested it and verified : index=web GET OR POST | bucket _time span=1h |stats count by _time | eventstats max(count) AS max_count min(count) AS min_count by _time | timechart max(max_count),min(min_count) and a more simplified version: index=web GET OR POST | bucket _time span=1h |stats count by _time | timechart max(count),min(count) since the max and min in a given hour is exactly the same ... View more

The lookup file remained in the specific app lookup folder even after changing it to global. Could this be the issue? ... View more

They were all set global, I have tried this on multiple splunk instances. ... View more