Thanks for the information. What ETA for the next release? ... View more

Well I got answer from support team. DB connect v1 is not supported on Splunk 6.4 and will be depricated soon. So this is time to migrate to DBx2 asap. ... View more

In our case it is not the issue, since the db connect is already the current latest version (1.2.2). ... View more

I am stuck with same issue, unfortunately your solution doesn't work for us. It looks like autorun="false" is overriden if we have search that is populating dropdown choices. I know that search that is populating dropdown should start with autorun, but the others shouldn't. Is there any usefull workaround for this issue? ... View more

DB connect 1.2.2 was just released and it resolves this issue with DBX 1.x. Good job guys! 🙂 ... View more

Will there be update for DB connect 1.x resolving this issue? ... View more

I solved this issue by running scheduled search like this: index=test | head 1 | map search="| dbquery \"test\" \"SELECT Format(orderDate, 'yyyy-mm-dd hh:nn:ss') as orderDateDisplay, memberID, orderID, orderStatus FROM [order] WHERE orderID > $orderID$ \" limit=10000" | collect index=test sourcetype=orders addtime=false ... View more

Hi, I came around same issues when i am trying to specify database input. I've tried with adding | limit = 1000 at the end of query, but it doesnt work. Do you maybe have configuraton stanza for your input that is working? ... View more

I know it is a long shot, that can be far away from solving your problem, but... Did you generated python project files? Before building django application you have to run: ./splunkdj createapp your_app_name More info on this: http://dev.splunk.com/view/webframework-djangobindings/SP-CAAAEMS ... View more

I had same problem. Solution was to repair .net 4.0 installation on server where application was installed. ... View more

Yes, I got it, it works now. ... View more

Nope, it is ok. When I make alert(hostname) it alerts the value. I've given it second (or 10th :P) look after posting and if I remove dropdown object the damn THING STARTS WORKING :). So I will only have to implement how the dropdown changes token, but I think that won't be a big deal. So the case is more or less closed 🙂 ... View more

I've tryed using this javascript var split = location.search.replace('?', '').split('='); if(split.length > 1) { var hostname = split[1]; var tokens = splunkjs.mvc.Components.getInstance("default"); tokens.set('host', hostname); } But unfortunatly the line in which I set "host" token throws exception TypeError: Cannot read property 'text' of null The wierd thing is, if I rename this token to something else exception doesn't happen. On the same dashboard I have dropdown that should be used if host is not passed by URL or if user wants to check data from some other host. And another thing - despite that the exception happens - token still somehow works in only one searchmanager (it uses search macro and than the results are taken into few postprocessmanagers). There are still 4 additional searchmanagers but it doesnt affect them. ... View more

After few weeks of playing with django/web framework it seems that it is more like half-product. It is fast but it really lacks of few features (export, easy token passing between views) that it should realy have. Hopefully guys at Splunk will improve this, I dont want to code all the dashboards again if they decide to scrap it 🙂 ... View more

I dont think I understand you correctly, but you have to include $time1$ in search manager. I added variable $time2$ as latest date of event. Search manager code should be something like this: {% searchmanager id="bubbleSearch" search="source=\"mysource.log\" earliest=$time1$ latest=$time2$ | stats count by sourcetype"|token_safe enable_lookups="false" app="search" %} ... View more

I haven't used it in production but it works in Data prewiev wizard. Did you try with it? Maybe try playing with MAX_TIMESTAMP_LOOKAHEAD setting (set it to 17)? ... View more

Unfortunately I cant paste you whole file, but here is my implementation - step by step: Timerange picker in {% block content %} {% timerange id="timerange1" preset="Last 7 days" earliest_time="$earlyval$"|token_safe latest_time="$lateval$"|token_safe %} Bubblechart in {% block content %} {% bubblechart id="map_clients" managerid="search_incidents_client" valueField="count" labelField="ClientName" categoryField="ClientName" %} Search manager in {% block managers %} {% searchmanager id="search_incidents_client" search="index=autosupport (sourcetype=critical OR sourcetype=error OR sourcetype=warning) earliest=$earlyval$ latest=$lateval$ | sort -_time | fields + ClientName | stats count by ClientName"|token_safe enable_lookups="true" app="ourspaceautosupport" %} And thats pretty much about it! 🙂 ... View more

Ofcourse, this is the timeformat you should use for extraction: %Y-%j-%H:%M:%S ... View more