While this search works on the licencing server it does not appear to work from a search head. | REST /services/licenser/licenses/ Is it possible to get the total amount you can index from a remote search head? ... View more

I am seeing the same issue with IE 9 None of the links for drilldowns work and they are configured in the same basic format. <table> <title>Top detected logtypes from generic</title> <searchString>sourcetype=generic | stats count by logtype | sort -count | table logtype, count</searchString> <earliestTime>$time_picker.earliest$</earliestTime> <latestTime>$time_picker.latest$</latestTime> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="count">20</option> <option name="table.drilldown">all</option> <drilldown target="Generic Detailed View"> <link> /app/my_app/generic_detailed_view?form.logtype=$row.logtype$ </link> </drilldown> </table> Works fine in Chrome however the client has specifically requested Splunk must work with IE. ... View more

As Nick pointed out to me the search in my original post was not actually the one dying it was an inline one further down that was causing the issue. ... View more

I did initially think it might have been the *s as well. But these did not seem to affect it. I tested this previously and it made no difference to the issue. I will try moving this to a publicly visible Splunk instance so you can see it in action Nick. Maybe later today or early next week. So the first HTML module in the example above correctly displays $cud_company$ then the ResultsValueSetter (without a *) is performed which should set $FyTotal$. The very next HTML module now has no value for $cud_company$. Also all previously set ResultsValueSetter variable are "cleared" as well. ... View more

Thanks for the suggestion Nick I did have multiple offending autoRun="True" Removing them sadly did not resolve the issue. I have emailed you at the support address as I would prefer not to post up the entire dashboard. Thanks ... View more

One other question what purpose/resolution would crcSalt = have if the log is rotated out and a brand new file of the exact name is created. Wouldn't the crcSalt be identical? ... View more

Just experienced the same issue issues with a clients machine. Logrotations have been fine for the last year or so. Upgraded Splunk Universal Forwarder last week and got this message lastnight including the "File growth rate must be higher than indexing or forwarding rate." Other logfiles rotated fine and continued logging to Splunk ... View more

dropEventsOnQueueFull (in outputs.conf) seems to have resolved it even though the manual seems to indicate it does the exact opposite and drops NEW events. http://docs.splunk.com/Documentation/Splunk/latest/admin/outputsconf May I recommend to a Splunk staff member to reword the manual entry for this to be less amiguous. If set to a positive number, wait seconds before throwing out all new events until the output queue has space. change to If set to a positive number, wait seconds before throwing out all new events (already in the queue) until the output queue has space. New events arriving at the indexer will still be placed onto the queue. The way it is currently worded seems to indicate that once the queue is full any new events arriving at the indexer will be dropped. It makes no mention of removing/dropping data from the queue itself. Is there a better solution here? I have also tried setting queues in inputs.conf which has no effect. ... View more

Excellent thanks again Nick. See I knew it would be a simple answer and thanks for clarifying why I had trouble seeing it with firebug. Infact it is actually so simple I am a little embarrassed I didnt just take a stab in the dark and test that. ... View more

I found a solution but it is by no means ideal. I am sure there is a better way with access to the ModuleID from javascript. myCustomModule.conf [module] # The JavaScript name of the module className = Splunk.Module.myCustomModule # The module class to subclass from superClass = Splunk.Module.DispatchingModule description = Another method for giving people access to specific D3 charts who need to use advanced.xml or sideViewUtil [param:UniqueID] required = False default = chart_1 label = This is required when you put more than one of these modules on the same dashboard myCustomModule.html <%page args="module"/> <div id="${module['UniqueID']}" class='with-3d-shadow with-transitions'> <svg> </svg> </div> myCustomModule.js ..... standard of code for module which pulls in parameters... var parentThis = this; // add chart to page nv.addGraph(function() { ...... more code for chart construction..... // add chart to div d3.select('#' + parentThis.UniqueID + ' svg') .datum(chartdata) .transition().duration(500).call(chart); ... View more

Actually it might be possible with this in transforms.conf [ ] REGEX = FORMAT = sourcetype:: DEST_KEY = MetaData:Sourcetype http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Advancedsourcetypeoverrides But I am straying far from my original question now 🙂 ... View more

This is exactly what I came here to post but you beat me to it. The data file example I provided about is only an example. There are actually 6 header rows and I am getting 6 errors. So yes there is nothing really I can do about these errors I just need to live with them. Thanks for the regexp tip though. I dont think I will be able to extract both sets of data into different sourcetypes unless transforms.conf allows me to override a sourcetype setting for a particular event if it matches a particular regexp. ... View more

Is there a better way to do this yet via the web console? We had an issue where someone was on leave and had a Splunk session open which they had configured to refresh every 5 seconds. They have been told not to do this anymore. There was noone on staff over Christmas/New Year who could have performed this ssh command. I would have hoped there should be an easier way? Apart from restarting Splunk that is. ... View more

If they are using the web interface to create these dashboards I am not sure how you can force them to use a 'custom' template as opposed to the default one. You could go down the path of editing the default template but it would probably have to be redone each time an update to Splunk is applied. http://answers.splunk.com/answers/4502/edit-the-default-dashboard-template ... View more

With Splunk 6 the HTML in the AccountBar might be slightly different. So it might be a good idea to get a copy of it by viewing the HTML source of any dashboard then adjust it accordingly for your own HTML module. ... View more

Ok I thought I would give this a try in flash to see how they printed before I dug too deep into d3js charts. I have constructed searches in this example that will work without my data so anyone can try these examples. So I have this advancedXML and it works however see next section where I am having issues. <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html"> <label>MultiChartTypes</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="maxSize">1</param> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> </module> <module name="DashboardTitleBar" layoutPanel="viewHeader"/> <module name="Message" layoutPanel="navigationHeader"> <param name="maxSize">1</param> <param name="filter">splunk.search.job</param> <param name="level">warn</param> <param name="clearOnJobDispatch">True</param> </module> <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True"> <param name="search">| gentimes start=01/01/2013 | eval field1 = random() % 100 | eval field2 = random() % 150 | eval date_month = strftime(starttime, "%b") | dedup date_month | fields date_month field1 field2</param> <param name="latest">+6m</param> <param name="earliest">0</param> <module name="HiddenChartFormatter"> <param name="charting.data0">results</param> <param name="charting.data0.jobID">@data.jobID</param> <param name="charting.data1">view</param> <param name="charting.data1.table">@data0</param> <param name="charting.data1.columns">[0,1]</param> <param name="charting.data2">view</param> <param name="charting.data2.table">@data0</param> <param name="charting.data2.columns">[0,2]</param> <param name="charting.chart">column</param> <param name="charting.chart.data">@data1</param> <param name="charting.chart2">line</param> <param name="charting.chart2.data">@data2</param> <param name="charting.layout.charts">[@chart,@chart2]</param> <module name="FlashChart"> <module name="Gimp"/> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </view> Now however I have a primary base search and I fire off many sub searches(PostProcesses) from this and this is where the chart fails. <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html"> <label>MultiChartTypes</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="maxSize">1</param> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> </module> <module name="DashboardTitleBar" layoutPanel="viewHeader"/> <module name="Message" layoutPanel="navigationHeader"> <param name="maxSize">1</param> <param name="filter">splunk.search.job</param> <param name="level">warn</param> <param name="clearOnJobDispatch">True</param> </module> <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True"> <param name="search">| gentimes start=01/01/2013 | eval field1 = random() % 100 | eval field2 = random() % 150 | eval date_month = strftime(starttime, "%b")</param> <param name="latest">+6m</param> <param name="earliest">0</param> <module name="HiddenPostProcess" autoRun="True"> <param name="search">dedup date_month | fields date_month field1 field2</param> <module name="HiddenChartFormatter"> <param name="charting.data0">results</param> <param name="charting.data0.jobID">@data.jobID</param> <param name="charting.data1">view</param> <param name="charting.data1.table">@data0</param> <param name="charting.data1.columns">[0,1]</param> <param name="charting.data2">view</param> <param name="charting.data2.table">@data0</param> <param name="charting.data2.columns">[0,2]</param> <param name="charting.chart">column</param> <param name="charting.chart.data">@data1</param> <param name="charting.chart2">line</param> <param name="charting.chart2.data">@data2</param> <param name="charting.layout.charts">[@chart,@chart2]</param> <module name="FlashChart"> <module name="Gimp"/> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </view> I am sure its something to do with this line which is using the base search. How do I use the postProcess search results? <param name="charting.data0">results</param> Also are there any more resources for d3js charts apart from this? http://dev.splunk.com/view/SP-CAAAEN6 ... View more

Ahhhh flash only. That will be what the issue is. Thanks for the heads up. I might have to look into d3js charts. ... View more