Getting no results could mean one of your saved searched is not finding any events or the join command is not finding common events. Verify each command in the pipeline is passing fields needed by subsequent commands. ... View more

The answer at http://answers.splunk.com/answers/95177/view-tag-parameters-list appears to address those attributes well. ... View more

The best module documentation I've found comes shipped with the SideviewUtils app. It describes ViewstateAdaptor at http://localhost:8000/en-US/modules#Splunk.Module.ViewstateAdapter as: Injects settingsMap settings contained within a viewstate set into the current module branch Parameters savedSearch (no description available) suppressionList (no description available) viewstateId (no description available) Defined in $SPLUNK_HOME/share/splunk/search_mrsparkle/modules/results/ViewstateAdapter.js This is not a good example (other modules are much more complete), but it tells you where the code is, which is always the most accurate documentation. As for your XML header question, I couldn't see any bolded text. ... View more

You're right. Without a sourcetype, your SQL data would not be broken out into fields. See if you can change the definition of the DB Connect input to add a sourcetype. If that's not possible, you'll have to parse the _raw yourself using rex. ... View more

So you can leave the index and sourcetype keywords out of your search since there are no values to use. You'll need to find other criteria to use to narrow your search. ... View more

To find the index name, go to Manager->Data Inputs->Database Inputs and you'll see the index for all defined database inputs. You'll also see the sourcetype names which you can put into your search query. ... View more

Add ' layoutPanel="panel_row3_col1_grp1" ' to each Button module, changing the 'grp' number for each. ... View more

For the most part, you get out of Splunk what you put into it. That is, if you have a data source that is saving MAC addresses in a Splunk index then you should be able to search for a given host and get the associated MAC address. Without knowing more about your environment, it is difficult to give specifics. ... View more

' ... | stats count(user) by version | ... ' ... View more

According to the Module Reference (http://docs.splunk.com/Documentation/Splunk/6.0.1/AdvancedDev/ModuleReference), TimeRangePicker uses values specified in the times.conf file. My times.conf file has the following definitions: [yesterday] label = Yesterday earliest_time = -1d@d latest_time = @d order = 200 sub_menu = Other [previous_week] label = Previous week header_label = in the previous week earliest_time = -7d@w0 latest_time = @w0 order = 210 sub_menu = Other Perhaps you can add these to your times.conf file. ... View more

Try ' stats count(vcbn) '. Since your search is only returning a single value, there is no grouping and so no use for a by clause. ... View more

I thought that might be the case. The field argument to the rex command tells rex what field to parse. Results are put into fields created by the ' ?<vcbn> ' construct. ... View more

What errors are you getting in the log? ... View more

Could you be more specific about what you are trying to do and how you are unable to do it? Have you read the Alerting manual (http://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts)? ... View more

Great! Please accept the answer. ... View more

' rex field=http_request "POST\s/rest/api/(?<method>.*?)/"' ... View more