Hi, I have a scheduled report that is using loadjob and saved search stanza. It runs perfectly fine when running in a search, but when I schedule that using a scheduled report, it fails. Why and how do I fix that? Thanks in-advance. ... View more

Hi, I have a scheduled report in Splunk that runs nightly. It is accelerated for 7 days and runs back in time for 7 days also. This report provides me comprehensive information about all my assets and respective information. The report has about 10 million statistical records for our assets as we need. When I reference my dashboard panels using this report, they error out complaining about "error fetching data" and it seems like it a huge data set thats why because it is fine with smaller data set. But when I open a report as normal in reports, it loads in less than 5 seconds. I need to know if I add a report in a dashboard as a table, which I do, BUT is it possible to add dropdown filter menus to parse information from that huge report table or even the report by itself? OR how do I get the dashboard panels to load quicker when digging through this large report? Report contents example: Host, Barcode, Company, BusinessUnit, Location, ContactPerson I want filters for Company, BusinessUnit, Location, ContactPerson so I can list Host, Barcode information associated with the selection from this huge data. Thanks in-advance. ... View more

Hi, I have a scheduled report named ABC running every night at 1:00AM. It is owned by user USER for Application XYZ. What is the search syntax to load this in a search application? I used: | loadjob savedsearch="USER:XYZ:ABC" I am getting an error that says, artifacts not found. What I would like is to use the results from this report, run some stats and OUTPUT to another CSV to be used for some of the drop down menus I have in my dashboard. My report is very large and drop down menus are taking longer when I run queries using scheduled report as reference. Thanks, ... View more

Hi, I have multiple dashboards, A, B and C. Is it possible to have a summary dashboard that has a drop down or three radio buttons, so that whenever a user clicks/selects dashboard A, dashboard A loads, dashboard B and dashboard B loads and so on — on a single page? Thanks in-advance. ... View more

Hi, I have a simple scheduled report. This report is scheduled and runs over night every day and gets me data for 1 year. It takes about an hour for this report to run over night so I can use it in the morning. This report has about 22 fields populated. The number of statistics results it populates is about 3 million rows. This report is accelerated for 1 year. The next morning, when I come and look at completed jobs, it is always successful and it opens up perfectly fine. Now, the trouble I am having is I am using this report to create dashboard panels using a report as a reference in a base search. When I try to get for example, simple stats(dc), it throws me the following error: "Error while fetching data" after few seconds and fails to populate my dashboard panels. However, when I run the same report for a smaller time span, e.g. 2 months or 3 months, then the dashboard panels load fine. They do take some time though but they load as I expect them to. Why am I getting an error for a 1 year report when populating dashboard panel vs 2/3 months version of report? Maybe dashboard panel has some kind of rendering restrictions etc...?? It is a simple report, and when I simply pull the report the next morning, it literally takes about 3 seconds for it to show me all 3 million stats it pulled last night for the whole year. But, the problem is when I use it to create dashboard panels and also, even for smaller report for 2/3 months, it takes some time but it loads. Larger span like a 1 year, it fails as stated above. I am just trying to create several panels based off of one report for optimization and performance perspective, and I have been successful in pretty much all my work using this strategy. It is just this one that is giving me a hard time — possibly because it is a larger report? How do I fix this issue? And also, how do I get the panels to populate quick along with it? Thanks in advance for the guidance. ... View more

Hi, I need to know if Splunk allows searching back a "specified" time instead of using only earliest and latest. I have data that I want to search from: Jan 1st, YYYY till March 31st, YYYY Likewise for the next 3 months and so on for the whole year. I know starttime and endtime are deprecated. Splunk Enterprise 6.6.6 and + This is to be done for scheduling a report, so I want to specify the times in the schedule report option. Thanks in advance. ... View more

I have two dashboards. Dashboard A and Dashboard B. I have a table with filed name SERVER in Dashboard A. I want o pass on SERVER value from Dashboard A into the SERVER value text box in Dashboard B. This is for drill down from A to B. I have drill down as "Link to Dashboard". When SERVER value is clicked in Dashboard A, it should take me to Dashboard B with "clicked" SERVER inserted into SERVER value text box in Dashboard B. How do I do this? Thanks ... View more

Hi, I have a CSV named Results2018. It has fields Group, Server, Issue. The field Issue has information about CPU and Memory utilization from different sources. The CPU field is populated in CSV as “CPU bottleneck detected on Server A”, “CPU bottleneck detected on Server B” and so on. Likewise, for Memory utilization as “Memory utilization exceeded on Server A” …. Server B and so on. What I am trying to do it to trim, match and group CPU bottleneck issue value in this field in the CSV and take a total count of that (Not on Server A or B). For example, trim down the field value to only “CPU bottleneck detected” and do a total event count on that. I trying to get the top 10 issues with the highest count here for all the issues in this file. Thanks in -advance for assistance. ... View more