I have a dashboard panel which creates a tabular/statistical table output. I want to be able to Export the results using the tiny Export button on bottom right. When this panel is populated with direct query, Export button becomes available. But when I use same query in base search and use post processing resulting in tabular /statistical results, same export button becomes disabled. Why? Fix? Work around? Reason? I am on Splunk Enterprise 6.6.6 and 7.x Thanks. ... View more

I have a large report that returns data anywhere between 4GB-6GB in a nice tabular format. Report has everything what I need. This report is actually for hosts vulnerabilities. Each host is affected with several vulnerabilities so my report returns about a million rows. However, if I try to Export it in CSV, it errors out because it is too large. If I try to go to /dispatch//results.csv.gz, I am able to copy it to my local BUT that CSV does no open in Excel because it is too large or something else is not right. WHen I try to use this reports reference in my dashboard panels, they are very slow but return results, just need to wait longer. Is there a way I can make above happen? Is there a way I can speed up the reference in dashboard and have dashboard panels load much quicker? Is there a way I can create an accelerated data model from this report OR accelerated data model wont help since my report is already accelerated? Can I accelerate dashboard panel? ... View more

Hi, I have a dashboard. It has 3 text inputs. Search by IP Text Input 1 Search by NETBIOS Text Input 2 Search by DNS Text Input 3 Submit button I have a statistical table panel below them that is running the query: Base search/Report reference | search IP="$ip$" OR NETBIOS="$netbios$" OR DNS="$dns$" | stats dc(IP) AS Total BY IP, NETBIOS, DNS When I have IP inserted, Submit returns IP, NETBIOS and DNS. When I have different NETBIOS inserted, search returns NETBIOS + IP (both different, one result for IP and one for NETBIOS. Likewise if I have all three different values, I will have three results) What I need: - Once any value is inserted, I want the other two to reset and become blank so search can use only one value at a time. I need to use either of the three values from text box inputs above and have only one result from one of either of three values. For example, if I insert an IP 00.00.00.00 and hit Submit, I get results for IP since other two values are left blank. But when I insert NETBIOS e.g. SAMPLENETBIOS, I want IP text box to become reset/blank and search result should return results for NETBIOS not IP. Likewise for DNS. Or can I have one text box where any one of three values can be inserted to get desired results? How? Thanks in-advance I am on v6.6.5 and + ... View more

Hi, I have a report about hosts and vulnerabilities. It has about 30k hosts with list of vulnerabilities they are affected with and total of vulnerabilities for each host. Query runs fine and report generated is exactly what I need. Problem is when I reference this report in dashboard. I am not getting all results and seeing below error. 'stats' command: limit for values of field 'vulnerability_id' reached. Some values may have been truncated or ignored. How do I increase this limit or solve this issue? I will need the exact configuration file name, location and stanza that needs to be fixed and the value it should have to accommodate larger results. I have only one development server in the sandbox. Production is a clustered environment, so if there is something that needs to be adjusted, how do I do that in both environments? Thanks in-advance. ... View more

I have an index that has vulnerabilities that are affecting hosts. index=vulnerabilities Fields in the index are: host, VulnID, VulnName I have a lookup name Assets. It has field name DNS. This field DNS is to be used as host in index's query. e.g. index=vulnerabilities | stats ......... | lookup Assets DNS AS host ..... I need a query that gives me attached image results with fast performance because I have a lot of affected hosts with a lot of vulnerabilities. I will be using this query to create a scheduled report so I can reference this report in my dashboard to create panels. My query will be looking at a few days back based on my scans: ... View more

Hi, I have a field named OS This field is populating multiple values such as below after running the following SPL: | inputlookup Host.csv | stats dc(host) as Count by OS | fields - Count Result: WINDOWS NT WINDOWS SERVER 2003 WINDOWS SERVER 2008 WINDOWS SERVER 2012 LINUX LINUX 6.7 LINUX 7.0 SOLARIS 9 SOLARIS 10 I want an additional column in results that if: All the Windows above should display Windows All the Linux above, should display Linux and so on in an additional column like below: How? I tried to use eval and case but seems like not getting it or having a long day. Thanks in-advance ... View more