Edit lines 148 and 154 in Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\controllers\module.py and remove the matching pyo file. And restart Splunk. Here are the edits starting at 143 if msg == 'nodata': if entity_name == 'events': submsg = _('No matching events found.') else: change this --> # submsg = _('No results found.') to this --> submsg = _('Nothing to report') # the inspect line belo was originally _('Inspect ...') output += '%s <span class="resultStatusHelp"><a href="#" onclick=%s class="resultStatusHelpLink">%s</a></span>' % ( submsg, su.quoteattr("Splunk.window.openJobInspector('%s');return false;" % sid.replace("'", "")), Change this line # _('Inspect...') To this _('.') ) The last edit leqaves a clickable dot (we call it the "Magic Dot".) We know it's there but the customer does not. The first edit simply gives a friendlier response when there are no results. ... View more

We have numerous customized times.conf based on teh requirement of the dashboard. None have "All time". That is not an entry in any .conf that I can find. ... View more

Because I have over 50 dashboards with over 500 views, many with TimeRangePickers, it will take a lot of work to do that. Future dashboards can get that edit. The bigger problem for me is that this is a DoD site. that means that I will have to submit to committee an ECP for each view that needs to be edited, and then wait a month while the commieett works its way thorugh it. I'll be retired before then. ... View more

It just defaulted to "over all time", no improvement there! ... View more

in that case put this in your props.conf and you'll be good to go. [iis-2] rename=iis ... View more

Never mind. I figured it out. I created a lookup table called citylist.csv and put in caty, state, latitude and longitude columns. Then ran this search and it knew what to do. | inputlookup citylist.csv | geonormalize city resolve_hostnames=true ... View more

Unless your iis logs are all different you should need only one transforms entry. I've been indexing iis for a couple of years with just this entry in my transforms.conf ... View more

Put this in you retc\system\local\transforms.conf [iis_fields] DELIMS=" " FIELDS="date","time","s-sitename","s-ip","cs-method","cs-uri-stem","cs-uri-query","s-port","cs-username","c-ip","cs-version","cs(User-Agent)","cs(Cookie)","cs(Referer)","cs-host","sc-status","sc-substatus","sc-win32-status","sc-bytes","cs-bytes","time-taken" ... View more

That's what I thought. But I looked for duplicates and found none. ... View more

Thanks. It was indeed permissions on the shared drive. ... View more

Doh! I shold have known that. It's been a long year. ... View more

Thanks! I have been playing with Sideview and like what I see. First thing in the morning I'll work withthis. ... View more

George, I'm facing the same issue with a looming suspense. Please contact me at kmattern@araneasolutions.com so we can directly share info. We have been seeking other DoD users. Ken ... View more

Actually we're looking to put as much output into outputlookup tables CSV) as we possibly can. Then we'll write our own asp or java scripts to generate output from those lookups so we can embed specific tables into our portal pages and bypass the Splunk interface whenever possible. Then we'll schedule the searches to run and gather the results. I don't think we have begun to make a dent in the customization we need to do. Mostly because of security concerns. ... View more

We don't let anyone but admins create scheduled searches. In fact we have locked Splunk down where they can't even get a search bar. We have almost 40 apps running and have removed anything that a user can click on, such as "view results" as well as all menu options that we have not created, including manager, jobs, logout, etc. We’ve also removed the Save and Create buttons from all forms. In fact we have our own logout link, dashboard banners, login banner etc. We have even edited "No results found" to "Nothing to report". Of course we are doing this for our DoD customer and have to insure that the Navy doesn't see Army dashboards and that Army users can see only dashboards relating to their assigned weapon system. Next on our list is implementing SSO. As a result we have done a lot of customization, even down to the Python level, and will do more. I have written a Windows program that I use all the time to search various parts of Splunk, including my own apps, for specific keywords by file type. Very handy program, I can’t live without it. ... View more

Thanks, that worked. I had to run a lot of simple searches to verify it but it is the best solution yet. ... View more