+1 for requesting this feature. It seems odd that maps don't support this feature while others do. ... View more

There's a less invasive way, that won't get lost in an upgrade: Update web.conf * Setting updateCheckerBaseURL to 0 will stop the SplunkWeb from pinging Splunk.com for new versions of itself. ... View more

{% timerange id="timerange1" preset="Last 30 days" %} {% searchmanager autostart=True id="bubbleSearch" search="InsertSearchHere"|token_safe} and a little javascript: var deps = [ "splunkjs/ready!", "splunkjs/mvc/searchmanager", "splunkjs/mvc/timerangeview" ]; require(deps, function (mvc) { var timerange = splunkjs.mvc.Components.getInstance("timerange1"); var bubbleSearch = splunkjs.mvc.Components.getInstance("bubbleSearch"); bubbleSearch .search.set(timerange.val()); timerange.on("change", function () { //Set timerange for searches. bubbleSearch.search.set(this.val()); }); }); ... View more

Looks like that is set by bootstrap.min.css, not a custom file anymore located at $SPLUNK_HOME\share\splunk\search_mrsparkle\exposed\css it's the .navbar .navbar-inner classes Additionally if you are going to change that file, i would recommend doing something like this: http://stackoverflow.com/questions/147500/is-it-possible-to-include-one-css-file-in-another So that if that css is overwritten, you can simply add back the import of your other css file instead of the whole thing. ... View more

Yes! That's more robust and versatile! ... View more

Link please? ... View more

This issue has been resolved in 1.1.2: Table column names were unexpectedly converted to lower case. (DBX-347) Please refer to this link: http://docs.splunk.com/Documentation/DBX/1.1.2/DeployDBX/Releasenotes#Fixed_problems ... View more

This infomration you may want to keep in mind as well AppBar styling is more restrictive For consistency between apps, Splunk 6.0 now constrains AppBar customization to color and logo. To set color, use the color option to the nav element in default.xml. For example: Search page restyling no longer supported Splunk 6.0 new search page cannot be customized as it does not load any custom javaScript or CSS. ... View more

That worked. I just placed the regex command after the multikv and it omitted the lines I wanted from the search. Thanks! |multikv|regex _raw="^[^(-|\*).*$].*$" Above I remove lines starting with "-" and "*". ... View more

Could you be more specific in how you solved this issue? ... View more

Thank you very much. You deserve a beer! ... View more

@arlakathena rather than down-voting a 4 year old post, I would request you to post a new question with the issue you are facing, along with other required details, so that Community members can assist you better. As you might be aware dbquery is no longer used in db connect. With the latest version you should be using dbxquery instead. ... View more

Looks like the label event click will be added in the next release. ... View more

See this conversation, the file you havo to delete or edit after the first attempt of path is .splunkhome http://answers.splunk.com/answers/117569/attempt-to-setup-splundj-error ... View more

The second search is what I am looking for and it works Thanks, ... View more

Would the fact that the data it is tied to(index) is on a master instance have any affect? ... View more

Simply beautiful ... View more

To answer your question... Yes, it is possible. This is the documentation you require: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes#Route\_specific\_events\_to\_a\_different_index You would have to modify your REGEX statement in your transforms.conf to grab the events you require: [<transforms_A>] REGEX = EventCode:([0-9]{1,3}|1000) DEST_KEY = _MetaData:Index FORMAT = indexA [<transforms_B>] REGEX = EventCode:1(0[0-9]{3}|1000) DEST_KEY = _MetaData:Index FORMAT = indexB You might have to play around with the regex statements provided in example ... View more

I suggest also to add the path to setup the web framework. Taht's not very clear ... View more

Thank you team, Seems like this bug is fixed in version 1.1.3 version now. Very happy to get this just before i make everything live 🙂 ... View more

Can you also put a request to change label text while rendering any chart, See http://answers.splunk.com/answers/189183/bar-chart-x-axis-label-text-change.html Let me know if there is any existing way of doing so ... View more