In the new version of side view Utils TabSwitcher was replaced by the Tabs module and the Switcher module. I could not find any example where the searches of each tab are independent and not driven by Tabs.name.$selectedTab$. Can anyone share an example? Thanks, Lp ... View more

I have the following log event but I have not been able to use spath to extract the json key=value pairs if the json portion contains arrays. Event example: 2013-03-12 10:37:10,205 <tvsquery id=58b6bf4d-948b-416b-8d17-cedcbc1059ec>{ "start" : 1, "returned" : 1, "count" : 1, "entities" : [ { "houses" : { "callers" : "IM", "placeid" : 5041447014850446107, "number" : 14, "sourceid" : 5625 }, "entitytype" : "house/street", "title" : [ { "default" : "No Place" } ] } ] }</tvsquery> The following answer solved the problem if the json protion does not contain any array: http://splunk-base.splunk.com/answers/79029/part-1-how-to-extract-a-json-portion-of-an-event-then-use-spath-to-extract-keyvalue-pairs I having a hard time to make it work. Any help please! Thanks, Lp ... View more

I have the panel presented below that is doing the drill down. However, the variable I want to pass to the drill search "$row.LastQuery$" is not being updated. Also, splunk UI modifies the search by adding at the end of my search "|search Date="03/19/2013". The value of Date seems to be the period of the first search. How can I fix the panel so the variable is correctly replaced and the search is not modified ? <module name="HiddenSearch" layoutPanel="panel_row5_col3" autoRun="True"> <param name="search">earliest=-1d@d latest=@d splunk_server=io-splunk-03.example.com index="si_top_n" Sampling_Rate=Daily NOT TotalSearches AND rank|sort + rank|eval Date=strftime(_time, "%m/%d/%Y") |table Date rank LastQuery count percent</param> <param name="groupLabel">Top N - Yesterday</param> <module name="StaticContentSample"> <param name="text"><![CDATA[<H1>Top N Searches - Yesterday</H1>]]></param> </module> <module name="Paginator"> <param name="entityName">results</param> <param name="maxPages">20</param> <param name="count">10</param> <module name="SimpleResultsTable"> <param name="drilldown">row</param> <module name="HiddenSearch"> <param name="search">earliest=-31d@d latest=@d splunk_server=io-splunk-03.example.com index="si_top_n" Sampling_Rate=Daily NOT TotalSearches AND rank AND LastQuery="$row.LastQuery$"|sort + rank|eval Date=strftime(_time, "%m/%d/%Y") |table Date rank LastQuery count percent</param> <module name="ConvertToDrilldownSearch"> <module name="JobProgressIndicator" /> <module name="SimpleResultsHeader"> <param name="headerFormat">Velocity</param> <param name="entityName">events</param> </module> <module name="Paginator"> <param name="entityName">events</param> <param name="maxPages">10</param> <module name="SimpleResultsTable"> <param name="entityName">results</param> <param name="displayRowNumbers">False</param> <param name="drilldown">none</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> Thanks, Lp ... View more

I have the following data set : Date rank LastQuery count percent 03/18/2013 1 THE 51870 2.641512 03/18/2013 2 SEX 12562 0.639728 03/18/2013 3 BIBLE 11629 0.592214 03/18/2013 4 TWILIGHT 10622 0.540932 03/18/2013 5 THE+BIBLE 10136 0.516182 03/18/2013 6 HOUSE 6611 0.336669 I need help to create a drill down by the selected LastQuery using the following query: Example:User clicked on LastQuery=HOUSE. This query should be used by the drill down: splunk_server=io-splunk-03.example.com index="si_top_n" Sampling_Rate=Daily AND rank AND LastQuery=HOUSE|sort + rank|eval Date=strftime(_time, "%m/%d/%Y") |table Date rank LastQuery count percent This is my xml panel. It works fine. I just need to include the drill down. <module name="HiddenSearch" layoutPanel="panel_row5_col1" autoRun="True"> <module name="StaticContentSample"> <param name="text"><![CDATA[<H1>Top N</H1>]]></param> </module> <param name="earliest">-1d@d</param> <param name="groupLabel">Vespa - Combined Top N Distinct Searches - Yesterday</param> <param name="search">splunk_server=io-splunk-03.example.com index="si_top_n" Sampling_Rate=Daily AND rank|sort + rank|eval Date=strftime(_time, "%m/%d/%Y") |table Date rank LastQuery count percent</param> <param name="latest">@d</param> <module name="ViewstateAdapter"> <param name="suppressionList"> <item>displayRowNumbers</item> <item>drilldown</item> <item>count</item> </param> <module name="HiddenFieldPicker"> <param name="strictMode">True</param> <module name="JobProgressIndicator"/> <module name="Paginator"> <param name="entityName">results</param> <param name="count">10</param> <module name="EnablePreview"> <param name="display">False</param> <param name="enable">True</param> <module name="SimpleResultsTable"> <param name="entityName">results</param> <param name="displayRowNumbers">true</param> <param name="count">10</param> <param name="allowTransformedFieldSelect">True</param> <module name="Gimp"/> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> Thanks, Lp ... View more

I have the following log event but I have not been able to use spath to extract the json key=value pairs. 2013-03-12 10:37:10,205 <tvsquery id=58b6bf4d-948b-416b-8d17-cedcbc1059ec>{ "start" : 1, "returned" : 0, "count" : 0 }</tvsquery> Therefore, I tried to extract the json portion with this regex and then use spath: |rex field=_raw " [^>]+)>(? .+?) "|spath input=response But I having a hard time to make it work. How can I extract the json portion of the event and then use spath to extract the key=value pairs? Thanks, Lp ... View more