I upgraded to 4.2 last week. Ever since the upgrade, my dashboard has been messed up a bit. Particularly, there is no longer a carriage return or where there once was. For example, I had a "SingleValue" button and, below it, a "View Results" link. But ever since 4.2, the "View Results" link now appears to the right of the SingleValue button. Similarly, where I once had several SingleValue buttons stacked on top of one another, they're now staggered next to each other. Did something change that I missed? Here's a snippet of my code, pretty straightforward: <module name="HiddenSavedSearch" layoutPanel="panel_row3_col2_grp1" autoRun="True"> <param name="savedSearch">Check Echk</param> <param name="useHistory">Auto</param> <module name="HiddenPostProcess"> <param name="search">search host="xyz" status=Failed | stats count | eval yesno=if(count==0, "Active", "Backup") | rangemap field=count severe=1-2 default=low </param> <module name="SingleValue"> <param name="field">yesno</param> <param name="classField">range</param> <param name="beforeLabel">Ethernet:</param> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> <param name="label">View results</param> </module> </module> Any suggestions has to how I can get that "ViewResults" to appear below the SingleValue once again would be appreciated. Thanks! ... View more

Quick question: how can I view a user's search history? ... View more

I have a dashboard that produces the results of various HiddenSavedSearches. They all work well except for one, which is showing the following error: Configuration error - HiddenSavedSearch is being run as a schedule and is configured to listen to the time picker. Scheduled results will not be shown. I'm confused. The HiddenSavedSearch is run on a schedule, just like all the other saved searches. I don't believe I am using the time picker here. Here is the code that is producing the error: <module name="HiddenSavedSearch" layoutPanel="panel_row8_col3" autoRun="True"> <param name="savedSearch">Check Printers</param> <param name="useHistory">Auto</param> <module name="StaticContentSample" layoutPanel="panel_row8_col3"> <param name="text">Printer status:</param> </module> <module name="HiddenPostProcess" layoutPanel="panel_row8_col3_grp1"> <param name="search">search host="xyz" pr_status=DOWN OR pr_status=CONNECT | stats count | rangemap field=count severe=1-100 default=low</param> <module name="SingleValue"> <param name="field">count</param> <param name="classField">range</param> <param name="beforeLabel">Printers down: </param> </module> </module> </module> Any idea why I'd be getting this error? Thanks! ... View more

We have a rather small Splunk license but this has suited us for quite a while. Now we're experimenting with the *NIX app on Linux and quickly discovered that it chews up our license fast. I know the *NIX app can be tweaked; some features enabled/disabled, polling intervals changed, etc... Does anyone have any recommendations for this? Are there features of the *NIX app you simply do not need/use? Are the default polling intervals too short? I realize everyone's needs are different, I'm just trying to get an idea of what people are doing. Thanks! ... View more

I'm am using a LinkSwitcher to switch between HiddenSavedSearches from a fixed time and HiddenSearches of a time selected via a TimeRangePicker. I have a bunch of searches I'd like nested under each of these. And when the user goes to the dashboard, he/she will have a choice: "Past 24 Hours" | "Pick a Time" Unfortunately, whenever I add a search to a group, it creates a new link. Here's what I mean: <module name="LinkSwitcher" layoutPanel="panel_row2_col1"> <param name="mode">independent</param> <param name="label" /> <module name="HiddenSavedSearch" group="Last 24 hours" autoRun="True"> <param name="savedSearch">Check Errpt</param> <param name="useHistory">Auto</param> <module name="HiddenPostProcess"> <param name="search">search host="xyz"</param> <module name="StaticContentSample" layoutPanel="panel_row2_col1"> <param name="text">Errpt</param> </module> <module name="EventsViewer"> </module> </module> </module> <module name="HiddenSavedSearch" group="Last 24 hours" autoRun="True"> <param name="savedSearch">Check Paging</param> <param name="useHistory">Auto</param> <module name="HiddenPostProcess" layoutPanel="panel_row4_col1"> <param name="search">search host="xyz" | timechart avg(percent_used) by page_dev</param> <module name="HiddenChartFormatter"> <param name="chartTitle">Paging</param> <param name="chart">Line</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">Paging Percent</param> <module name="FlashChart" /> </module> </module> </module> <module name="HiddenSavedSearch" group="Last 24 hours" autoRun="True"> <param name="savedSearch">Check Paging</param> <param name="useHistory">Auto</param> <module name="HiddenPostProcess" layoutPanel="panel_row4_col2"> <param name="search">search host="xyz" | timechart avg(percent_used) by page_dev</param> <module name="HiddenChartFormatter"> <param name="chartTitle">Paging</param> <param name="chart">Line</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">Paging Percent</param> <module name="FlashChart" /> </module> </module> </module> <module name="StaticContentSample" group="Pick A Time"> <module name="TimeRangePicker"> <param name="searchWhenChanged">True</param> <param name="selected">All time</param> <module name="HiddenSearch" group="Pick A Time" autoRun="True"> <param name="search">| search host=xyz sourcetype="errpt"</param> <module name="EventsViewer" layoutPanel="panel_row3_col1"> </module> </module> <module name="HiddenSearch" group="Paging" autoRun="True" layoutPanel="panel_row4_col1" > <param name="search">host="xyz" sourcetype="paging" | fields percent_used, page_dev | timechart avg(percent_used) by page_dev</param> <module name="HiddenChartFormatter"> <param name="chart">Line</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">Paging Percent</param> <module name="FlashChart" /> </module> </module> <module name="HiddenSearch" group="Paging" autoRun="True" layoutPanel="panel_row4_col2"> <param name="search">host="xyz" sourcetype="paging" | fields percent_used, page_dev | timechart avg(percent_used) by page_dev</param> <module name="HiddenChartFormatter"> <param name="chart">Line</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">Paging Percent</param> <module name="FlashChart" /> </module> </module> </module> </module> etc... That code produces the following links: "Past 24 Hours" | "Past 24 Hours" | "Past 24 Hours" | "Pick a Time" Each of those "Past 24 Hours" takes you to a different HiddenSavedSearch. That's not what I want. I'd like the user to click "Past 24 Hours" and have all the searches kick off and be visible. I have a dashboard doing this that works fine, but not in the context of a Switcher. Can anyone tell me what I'm doing wrong? Thanks! ... View more