Is it possible to open search results in another popup window when clicking on a "Single view" value using the Splunk Web Framework? ... View more

Is there a way to integrate a javascript click function for the tspan elements in the svg that is generated by Splunk for Axis Labels. I want to tie a .on('click', function(){}); via javascript to the Axis Labels on the Bar Chart to drill the dashboard down to that value. I am using Splunk Web Framework ... View more

We recently setup DB Connect 1.1.1 and started pulling in data. An issue we've ran into is the indexers are hanging and this did not start happening until installing DB Connect. So I looked into it (via SoS) and saw that the index ratio is at 8.9 (for the index that DB connect input is feeding) the hour that our indexes started hanging. This has to be the reason our indexes are hanging. Is there a way to lower that indexing ratio? ... View more

Since installing DB Connect 1.1.1 our Splunk Instance has had issues restarting. It always Hangs and when we restart splunkd and splunkweb, splunk still does not come back and we have to restart the machine itself. Note: it appears that both services go down and do not come back up. I saw this in the log at the end of the shutdown process 11-13-2013 14:54:02.757 -0600 WARN ProcessRunner - Process with pid 2352 did not exit within a given grace period after being signaled to exit. Will have to forcibly terminate. 11-13-2013 14:54:02.757 -0600 WARN ProcessRunner - Process with pid 2352 did not forcibly terminate, status 0x0 11-13-2013 14:54:02.757 -0600 INFO IndexProcessor - handleSignal signum=0: Disabling streaming searches. 11-13-2013 14:54:02.757 -0600 INFO IndexProcessor - request state change from=SHUTDOWN_COMPLETE to=SHUTDOWN_SIGNALED 11-13-2013 14:54:02.897 -0600 INFO ShutdownHandler - shutting down level "ShutdownLevel_CallbackRunner" 11-13-2013 14:54:02.897 -0600 INFO ShutdownHandler - Shutdown complete in 37.89 seconds 11-13-2013 14:54:02.897 -0600 INFO loader - All pipelines finished. Uninstalling DBX gets rid of this issue, but we'd like to still use it. System Log on the machine states: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Splunkd service. ... View more

I used the following example from the Splunk Documentation to use tokens in my Web Framework Dashboard. {% dropdown id="selIndex" value="$indexName$"|token_safe %} {% searchmanager id="mySearch" search="index=$indexName$"|token_safe %} An issue I ran into was, What if I want to show "All" of an item, even if it is blank. I found that putting in * as a default value was not good as it did not include them if the field did not exist in the data, as this data is dynamic. I have 10+ filters on this dashboard and hardly any results were being returned because of the * filtering out all the blank or null values. My Workaround was to set the token values myself through Javascript and set them to something similar to "indexName=\"" + ..getInstance("sel-index").val() + "\""; and changing the search to be search="$indexName$"|token_safe I would also check to see if the dropdown field was set to a value of blank and set the token to blank otherwise. Has anyone else run into this issue or know a proper way of using the tokens and retrieving all records whether or not they are blank or not? (without using fillnull as it gives a huge performance hit) ... View more