Hi, i think your dashboard is not loading, because there is some kind of error in your js. After you opened the dashboard with the js, did you take a look in the browsers console? Is there an Error? (Most Browser have a shortcut on F12 to open the console) To get and set the values of a token in js you can use this: var unsubmittedTokens = mvx.Components.getInstance('default'); // get the value of a token called remark unsubmittedTokens.get("remark"); // set the value of a token called remark to "value" unsubmittedTokens.set("remark", "value");<code> To make this work, you must import the mvc lib. Change this part of your code: var deps = [ "splunkjs/ready!", "splunkjs/mvc/searchmanager" ]; var db_boo = true; var qt_boo = true; require(deps, function(mvc) { ... To this: var deps = [ "splunkjs/mvc", "splunkjs/mvc/utils", "splunkjs/ready!", "splunkjs/mvc/searchmanager" ]; var db_boo = true; var qt_boo = true; require(deps, function(mvc, utils) { ... Hope this helps, Greetings Tom ... View more

Hi, try splunk list deploy-clients Greetings Tom ... View more

Hi, i would try something like this: tags.transactionName = "Send Email Alert" auditType="TxSucceeded" | eval shortForm='detail.formId'." " | eval shortForm = substr(shortForm, 1, 6) | sort 0 detail.messageId | stats dc(detail.messageId) first(shortForm) as shortForm by "detail.messageId" | chart count by shortForm | eval pieSlice=shortForm + " " + count | fields pieSlice, count to adjust your search. But verify your results. In general if you use something like this in your search: ...| sort 0 detail.messageId | dedup detail.messageId |... . Try to think about what the search execute here. You first sort a huge list of events, just to throw out the most events with the dedup in the next step. It would ofcourse be faster if you first throw out the most events and after that, sort the now smaller list of events. Greetings Tom ... View more

Hi, do you use a report or an inline search on your dashboard? If you use a report, is the report scheduled? Because scheduled reports will show the same results until they are triggered again by the scheduler. If so, change your report to an inline search or edit the interval of the scheduled report. Greetings Tom ... View more

Hi, this should be caused by a label that is more than one time in the set of labels available to your dropwown. So you can check the options of the dropdown. Which field of your dynamic search is marked as field for the labels, and which one is marked for the values. Maybe you interchanged them? Also, i run in in this problem often, because for a first run on the dashboard i just add some static labels and values to the inputs for test purpose. Later i implement the dynamic search, but sometimes the labels of your static options are equal to results of your dynamic search. Did you check that you have none or at least unique static labels in your dropdowns? @richgalloway: the error is "duplicate labels causing conflict" Greetings Tom ... View more

Hi, this is from the limits.conf: [restapi] maxresultrows = <integer> * Maximum result rows to be returned by /events or /results getters from REST API. * Defaults to 50000. As you can see, there is a limit configured. You have two options now: 1) Enhance the limit to a value that is suitable for you. 2) I think the better option is to repeat your call with a different offset. You split up your requests on this way. Take a look into the answer of this post: http://answers.splunk.com/answers/25411/upper-limit-for-rest-api-limits-conf-maxresultrows.html Greetings, Tom ... View more

Hi, the splunk app for windows (now called splunk app for windows infrastructure) or the splunk app for unix contains so called technical addons. You can deploy these on your 100 forwarders, for example with the deployment server, and use them on the forwarders. The rest of the app must be installed on the search heads. you can also use other apps with the universal forwarders, but most of the time you only need the inputs on the universalforwarder, the rest is done by the indexer or the search head. Here is a nice overview of where you have to install the components of the splunk app for windows infrastructure: http://docs.splunk.com/Documentation/MSApp/latest/MSInfra/HowtodeploytheSplunkAppforWindowsInfrastructure Greetings Tom ... View more