If you want to use the cluster icons, this should be doable with a simple CSS tweak, combined with a few conditions in the search. You can hide the numbers in the displayed cluster icons by including the following CSS snippet: .GoogleMaps .cluster-icon { color: transparent !important; } You can simply drop this line into the appserver/static/application.css of the app you want to use it. To define the icon-color of a location you'd have to create a synthetic _geo_count value. For example: ... | eval _geo_count=case(status=="bad",500,status=="good",1,1==1,50) The following ranges are used by default to map to the icon color: A _geo_count value of 0 - 10 = blue 11-100 = yellow 101-1000 = red 1001-10000 = pink >10000 = purple You could also customize this range by providing a parameter in the module: <param name="overlay.rangeMap">0,1000,100000,10000000,1000000000</param> ... View more

There's a "hack" that allows you to choose a different summary index as the query-source depending on the selected timerange: <your search> [ stats count | addinfo | eval range=info_max_time - info_min_time | eval search=if(range<=86400, "index=summary1", "index=summary2") ] So this will expand to index=summary1 <your search> if the selected timerange is less than a day and index=summary2 <your search> otherwise. Unfortunately this can't be used to alter the span parameter for the timerange command. ... View more

You could build an alert using the following query: | rest /services/search/jobs | stats count | where count>2000 ... View more

In order to do that you will have to either extend the module and define a custom overlay or implement another Google Maps module. I intend to add customization options in future that will allow to create such visualizations but atm there is nothing like that available out of the box. ... View more

There are a few options on how to do this without creating a custom search command: ... | append [ | stats count | fields - count | eval name="Bob" | eval phone="555-1234" ] or using a csv lookup file ... | outputlookup mydummyresults.csv append=t ... View more

This one should work: ... | bucket _time span=1h | stats min(used_tb) as min_used by volume,_time | timechart span=1h sum(min_used) ... View more

You can put arbitrary links into the navigation using an <a href="<url>"> tag: <nav> <collection label="Some links"> <a href="http://mysplunkserver.local:8000/manager/test/admin/macros/foo?f_ns...">Edit Macro 1</a> <a href="http://mysplunkserver.local:8000/app/test/flashtimeline?q=search%20index=someindex">Run serach XYZ</a> </collection> <a href="http://otherserver.com/">External Link</a> </nav> ... View more

You have to output the results after the loop (ie. once you've modified them). splunk.Intersplunk.outputResults(results) ... View more

You could use the following Javascript code to hide the _raw field from all SimpleResultsTables in an app: if(Splunk.Module.SimpleResultsTable) { var orig = Splunk.Module.SimpleResultsTable.prototype.onResultsRendered; Splunk.Module.SimpleResultsTable.prototype.onResultsRendered = function() { orig.call(this); $('th', this.container).each(function(i, el){ if(/^_raw\s*$/.test($(el).text())) $(el).hide(); }); $('td[field=_raw]', this.container).hide(); } } Simply place this code in $SPLUNK_HOME/etc/apps/search/appserver/static/application.js (Or any other app, where you want to hide the _raw field). ... View more

As an alternative you could script it using splunk's CLI. Eg. on Linux by putting the users into a text file: users.txt: user1 user2 user3 the then run splunk login && cat users.txt | while read user; do splunk edit user $user -role some_role; done This will assign all users in the text file to the role "some_role". ... View more

You can use a scripted alert to do this. Depending what platform you're running on you can use curl within a shell script or use python to do the HTTP Post. http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurescriptedalerts ... View more