Keeping the JobProgressIndicator module open and close after eventsViewer works for me. 10 results 10 true ... View more

Moot point. Deprecated in Splunk 5.0 ... View more

You can use a CDATA block like so... Errors Errors on Server <![CDATA[href code here ]]> ... View more

Check this document for a simple XML example: http://docs.splunk.com/Documentation/Splunk/4.3.4/Developer/AddASingleButton For advanced XML check out: http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/ModuleReference#SingleValue Example: events range ... View more

Ive used a GenericHeader module just before the module name="HiddenSearch" layoutPanel="panel_row2_col1_grp2" element like so to get around this: module name="GenericHeader" layoutPanel="panel _ row1 _ col1 _ grp2"> param name="label">this is a test 2 /param> /module> ... View more

Updated in ES202 ... View more

search Index=_internal tcpin* fwdType field holds forwarder type. For example: group=tcpin_connections, 204.236.145.235:54219:9997, connectionType=cooked, sourcePort=54219, sourceHost=204.236.145.235, sourceIp=204.236.145.235, destPort=9997, _tcp_Bps=24.84, _tcp_KBps=0.02, _tcp_avg_thruput=0.11, kb=0.75, _tcp_Kprocessed=4.79, _tcp_eps=0.06, build=128297, version=4.3.3, os=Linux, arch=x86_64, hostname=ip-10-166-186-254-archStudent, guid=2BEF811B-5EEB-469B-AD71-52A8FD6ECD00, fwdType=uf, ssl=false, lastIndexer=50.18.74.20:9997, ack=false ... View more

Check out ... http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/ConfigurePositionalTimestampExtraction and ... http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/Configuretimestamprecognition ... View more

Was working on Beta Splunk 5.0 (build 125564) Switched to Splunk 4.3.3 and it worked like a charm. ... View more