I'm trying to build a dashboard that has a chart depicting our paging use over the past 24 hours. But instead of showing a chart, it just shows a big blank. I have a similar chart elsewhere on the dashboard that works just fine. Here's my code: <module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" autoRun="True"> <param name="savedSearch">Check Paging</param> <param name="useHistory">Auto</param> <module name="HiddenPostProcess" layoutPanel="panel_row3_col1_grp1"> <param name="search">search host="xyz" | timechart avg(percent_used) by page_dev</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="primaryAxisTitle.text">Paging %</param> <param name="secondaryAxisTitle.text">Paging Device</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">300px</param> </module> </module> </module> I have verified that the Saved Search "Check Paging" is correct/valid, and runs every 5 minutes. I tried it without 'search host="xyz"' but still no chart. I was able to get this chart working in Simple XML, but without the HiddenSavedSearch. Anyone have any idea what I'm doing wrong (preferably before I pull my hair out)? Thanks! ... View more

I'm trying to display a list of SingleValues. Each of my hosts runs a process listing every 12 hours and greps for a specific process. If it finds the process, index it. This runs on about 20 hosts. I would like a dashboard that displays a SingleValue for each host. Splunk runs a search and, if it finds the process listing within the past 12 hours, put in a SingleValue saying "Yes". If it can't find the process listing, say "No". Above or near the SingleValue, I need it to display the host name field. There is an easy way to do this, but it would require me to run the search individually for each host. I'm trying to avoid running 20 searches on one dashboard. Here's what I have so far, but it's not doing what I need it to: FINAL SOLUTION: <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="True"> <param name="search">sourcetype="nmonchk"</param> <param name="earliest">-12h</param> <module name="HiddenPostProcess"> <param name="search">search host="xyz" | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low</param> <module name="SingleValue"> <param name="field">yesno</param> <param name="classField">range</param> <param name="beforeLabel">xyz</param> </module> </module> This just display one SingleValue, and it's reporting "Yes". I understand why it's not working, I just can't figure out how to get it to do what I want. Does anyone have any suggestions? Thanks! ... View more

I have a summary index that collects stdout from a script that we run on all our hosts (SplunkLightForwarder). The search runs every 5 minutes looks like this: sourcetype="datapath-adapter" | head 1 | multikv | sistats list(Select), list(Name), list(State), list(Errors) by Name,host and report=adapter When I go to retrieve the data, it works fine: index=si_hosts report="dpadapter" EXCEPT it only contains information for three out of my twenty-four hosts. I check the orig_host field and, sure enough, only 3 values listed. Why would the summary index choose only three hosts to index? There's nothing particular unique about those hosts, it just seems to random. Is this a known issue by any chance? ... View more

I have a dashboard that has a pull-down menu with a list of our hosts. By selecting a host, one can get a snapshot of that host's status- paging space use, web server hits, vmstat data, SAN disk stats, etc... (Note: because we're on AIX, we cannot run the *nix app, so we get our paging/vmstat data through commands sent to stdout and captured into Splunk). Unfortunately, it takes a while to display all the results on the dashboard. When you have 20 hosts to check, it adds up fast. I was thinking it would be a good idea to use summary indexing to speed things up a bit. I'm just not sure what the best way to structure this should be. Should I create a summary index "si-paging" (and "si-san", "si-webhits", etc...) that will capture all that information across all hosts every few minutes, then call that search when I select a host from the menu? Or should I do it from the other angle and create a summary index for each host, containing its paging/SAN/web server/etc data? I'm thinking the latter would be better; from what I read, you can't add a search parameter when you call a saved search from a summary index. From the docs: "The search against the summary index cannot create or modify fields before the | stats command. That means I wouldn't be able to add a "host = 'xyz'". Do I have that right? Is my logic sound here? Is it best to create a summary index for each host and generate my results in the dashboard that way? Thanks! ... View more