You can use netcat for this purpose: echo "message to log in Splunk" | nc -u -q 0 <HOST> <PORT> Example: echo "message to log in Splunk" | nc -u -q 0 localhost 514 (This works on Linux) On a Mac, you have to use the -w option instead of -q echo "message to log in Splunk" | nc -u -w 0 splunkhost.mydomain.com 514 Maybe the netcat command is different on other *nix systems as well. ... View more

You need to define a CSS class for this. Best way to do this is to create a application.css file in the app of your dashboard. $SPLUNK_HOME/etc/apps/<APP>/appserver/static/application.css Here are some sample CSS rules: .SingleValue .purple { background-color: purple; color: white; } .SingleValue .darkred { background-color: #CC0000; color: #FFFFFF; } These same rules define 2 classes (purple and darkred) that can be used to color the single value element. ... View more

The search you're looking for is: | metadata type=sourcetypes And to get a dropdown, you can use a SearchSelectLister: <module name="SearchSelectLister"> <param name="settingToCreate">sourcetype</param> <param name="search">| metadata type=sourcetypes</param> <param name="label">sourcetype</param> <param name="searchWhenChanged">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">sourcetype</param> <param name="value">sourcetype</param> </list> </param> .... ... View more

Drilldown is a feature that was introduced in Splunk 4.1. Seems like the Cisco Security app uses this features in some views and hence is not compatible with 4.0.x. Your best bet is to upgrade your Splunk installation. ... View more

You'll see events from those indexes without explicitly specifying one or more indexes in the search, that are selected as default indexes for your role(s). You can see/change this under Manager » Access controls » Roles » Some Role » Default indexes ... View more

There is a solution, it's a little complicated though. You would need to create a field that can be sorted on first, since sorting on weekdays would sort in alphabetical order. <your search> | eval wd=lower(Day) | eval sort_field=case(wd=="monday",1,wd=="tuesday",2,wd=="wednesday",3,wd=="thursday",4,wd=="friday",5,wd=="weekend",6) | sort sort_field | fields - sort_field ... View more

This is a bug in Splunk 4.1.4 and 4.1.5 on Windows not being able to load custom modules in some cases (affects Google Maps, AfterGlow, etc). Fortunately there is a workaround: Open the file $SPLUNK_HOME\Python-2.6\Lib\site-packages\splunk\appserver\mrsparkle\lib\apps.py in a text editor and add the following: if not len(newapps): raise Exception() on line 42. Before: try: # find new apps that have to be updated appslist = cached.getEntities('apps/local', search='new=true') newapps = [app for app in appslist if app not in self.apps] except: # localapps endpoint is not available yet if self.loaded and not force: return True else: newapps = os.listdir(apps_path) After: try: # find new apps that have to be updated appslist = cached.getEntities('apps/local', search='new=true') newapps = [app for app in appslist if app not in self.apps] if not len(newapps): raise Exception() except: # localapps endpoint is not available yet if self.loaded and not force: return True else: newapps = os.listdir(apps_path) Be sure to add the same kind of whitespace characters as on the line above. Python is very picky about whitespaces and indentions. After a restart you should be able to view the Google Maps module. Please do not attempt to do this in a production environment without testing it on a test instance first. No warranties! ... View more

Count by week: index=main (date_wday=tuesday date_hour>=16) OR (date_wday=wednesday date_hour<11) | eval week=strftime(_time,"%V") | stats count by week or the sum: index=main (date_wday=tuesday date_hour>=16) OR (date_wday=wednesday date_hour<11) | stats count EDIT: For each weekday: index=main (date_wday=monday date_hour>=16) OR (date_wday=tuesday date_hour>=16 OR date_hour<11) OR (date_wday=wednesday date_hour<11) OR (date_wday=wednesday date_hour>=16 OR date_hour<11) OR (date_wday=thursday date_hour<11) OR (date_wday=thursday date_hour>=16 OR date_hour<11) OR (date_wday=friday date_hour<11) |... ... View more

or use strftime in the eval command: | eval time=strftime(_time, "%H:%M:%S %m-%d-%y") see: http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions http://docs.python.org/library/datetime.html#strftime-strptime-behavior ... View more