The actual CSS you need to use in application.css in $SPLUNK_HOME/etc/apps/APPNAME/appserver/static/ would be something like; .panel_row3_col1 .layoutCellInner{ background-color: #000000; } When using groups Splunk will split a div in half without adding a class, you can use jQuery to add a class name to the group which you can then apply CSS against but I suspect you probably want to colour the whole panel ... View more

Thats a network issue and not a Splunk issue, no connection could be made suggests a firewall, URL issue. Double check you've provided the correct settings for your email server ... View more

Not quite, if you ever say things like, "certain number" or "my query" then it should set alarm bells ringing, those should be a number or a query. Without the detail there is nothing anyone can do but ask you a question instead of offering an answer, which defeats the point of you asking something to begin with 🙂 ... View more

I think the from field cannot contain spaces, its meant to be an email address. Have you looked in splunkd.log for any errors? Also you will need to restart for this conf to take effect ... View more

What is this mysterious "certain number" of events? You really need to think how others will read or understand your questions or comments before posting them, they need to actually advance our understanding of the problem in order to help 😉 Have a read of the transaction docs, there are a number of limits which the command can hit while running, you may just need to override them with more suitable values. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transaction ... View more

Just to echo this, Nick is awesome. Basically the Mr Miyagi of Splunk XML/JS ... View more

Sorry, what I meant was if you remove the whole stanza you created to pull out app/environment does it improve the search time? It could be another search time extraction thats going wonky and taking up all the time ... View more

It basically says its all on search time extractions, but this could mean any of your search time extractions. Thats why I wonder if its worth trying again if you remove that one regex. How much data is it indexing per day? are all searches run on this machine? If its all fairly low then yeah, that should be a fine spec 🙂 ... View more

If you disable that one search time regex you created, does the search time improve? ... View more

Have you looked at the search inspector to see where the time delay is introduced? Its possible its just highlighted an under-spec'ed machine. If its a field you are likely to search on in almost every search then yes, its worth adding it. There are trade offs in the form of increased bucket sizes plus the increased time to search indexed fields but in this case it should help. However... if it struggled that badly to apply the regex at search time then you need to consider how it would cope when applying this at index time, hence I come back to my above point about the spec of the machine 🙂 Also, perhaps try using this regex instead; /path/to/apps/(?<app>[^/]+)/(?<env>[^/]+) ... View more

Just to be clear, on a free license you only have a limit of 3 violations and thats for a 30 day "rolling" window, you have to have 30 days of no violations for all of them to clear. ... View more

The code you've posted at the top is written as if it is contained within a HTML page and not a JS file. This is moving more into the boundaries of a site like stackoverflow or something similar for javascript troubles. If this relates to the other post about making modules visible or not then make sure you've understood what has been pasted. ... View more

On the first page of the docs is the Splunk for Exchange docs; http://docs.splunk.com/Documentation/MSExchange/latest/DeployMSX/AboutSplunkforMicrosoftExchange The summary page of the app also has some blurb; http://splunk-base.splunk.com/apps/28976/splunk-app-for-microsoft-exchange Otherwise, a great selling point would be that Microsoft use it to monitor their own Exchange environment. The docs should help with everything else EDIT: Oh, and its free, so if you're already using Splunk it wouldn't hurt to run your own small scale test deployment ... View more

First step, always read the documentation; http://docs.splunk.com/Documentation/Splunk/5.0.1/Installation/SystemRequirements#Supported_OSes and http://docs.splunk.com/Documentation/Splunk/5.0/ReleaseNotes/Deprecatedfeatures Otherwise, others may post their experiences or you might be safer contacting support ... View more

Yes, so far I've found that you can still generate PDFs of advanced xml dashboards if you use the schedule PDF button and view it first, this will use the PDF server instead of the PDF generator but yes, I agree that its pretty poor. Have a look here, http://splunk-base.splunk.com/answers/67071/new-pdf-generation-limitations and feel free to add your thoughts, agree etc. I'm hoping that for the next version they will be adding the ability to format it better or use the formatting in the dashboard. ... View more

I don't know the solution but I added the app to your tags so the developer may see it if they are subscribed to it, your best bet is waiting. Don't keep posting the same question.. ... View more

That sounds like you have a space somewhere you shouldn't, could you edit your question with the updated xml? ... View more

I think the fields you can use are $search.timeRange.earliest$ or $search.timeRange.latest$, these will pull the timeranges out for you to pass through. ... View more

Its not wasted, but there is an extensive and well maintained set of documents which are designed to answer as many questions as possible, along with a vast array of past questions on Splunkbase. Good questions showing a bit of research are great, questions about a docs subject generally aren't 🙂 ... View more

Try downloading it and looking at the tutorials 🙂 You'd be surprised how easy it can be. It may look more complicated than Simple XML but really it actually makes a great deal more sense once you've sat and looked at it for a while ... View more

Fields, they're called fields! So what you really want to do is pass values over to another dashboard, I recommend using sideview utils and its wonderful urlloader and drilldown. Download it and there are some great tutorials build into the app to explain how it all works. ... View more

Could you paste some example XML. Just at a wild stab, it sounds to me like the drilldown may be inheriting a different time range to the one that you want it to use, without the search string or XML its hard to tell.. ... View more

We'd need more detail than this, do you have a search already? where will the time be coming from? will this be in a dashboard/form? ... View more

Have a read of; http://splunk-base.splunk.com/answers/54481/can-i-hide-and-show-the-modules and http://splunk-base.splunk.com/answers/67918/sideview-utils-can-i-hide-a-module-on-page-load ... View more