Did you verify on the Report Acceleration Summaries page that this new search was using the same summary as the original? If this was the case but you added more arguments to the base search (more filters from the drop down or whatever) then maybe it's not accelerating because it needs to rebuild the summary to include the events that would be returned by those new filters. ... View more

Those two searches are too different to both use the same acceleration summary. If both searches started with index=cerner Application=powerchart OR Application=snsurginet OR Application=firstnet OR Application=phamedmgr OR Application=saanesthesia but were transformed in different ways, they could both use the same summary because they're essentially working off of the exact same dataset. I know the second search is essentially returning a subset of the information returned by the first one, but the current implementation of report acceleration will see them as working with two distinctly different datsets. The docs around this aspect of report acceleration could probably be a bit clearer--as the primary doc writer on this topic I'll see what I can do. ... View more

My understanding is that searches that draw from the same pool of data before applying transformations will use the same summary. What that means is, as long as the part of the search before the first pipe remains the same as your accelerated search, you can change what follows and still have it be used by the summary. By that logic, neither of the two searches you provide above would qualify to use the summary created for the accelerated search. But this search might: sourcetype="cisco_ips_syslog" | timechart span=1d count by dest_ip Of course the best way to find out is to do as martin_mueller suggests in the preceding answer. Run the searches, accelerate them, and see if they get their own summary or are added to the existing summary. ... View more

Unfortunately, frozen data is frozen--Splunk cannot include it in report acceleration summaries, because report acceleration summaries are tied to the indexed data at the index bucket level (they live in your primary index, in other words). So you have two choices. If you want to use report acceleration over a year's span, you'll need to extend your retention policy from 90 days to a year. But if you can't do that, you might try summary indexing instead. This process summarizes your data in a separate summary index that can have a different retention policy than your primary index, or no retention policy at all. http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing ... View more

Ah, that makes more sense. You've created 10 dashboards and you want to control the order in which they display in the Views menu. What you want to do is set up the navigation XML for your views (or edit it if it already exists). The instructions are in this topic: http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/BuildNavigation You can change the order in which your 10 dashboards are listed, create nested groups (categorizing your dashboards into like groups, essentially), change the title of the menu from "Dashboards & Views" to just "Dashboards" or something more descriptive, and more. ... View more

It depends on how you've designed the dashboard. If you've created it via Splunk Web (the UI) then rearranging the order of the "views" (i'm assuming you mean panels) is easy: you can just turn on the Dashboard Editor by clicking Edit at the top right of the panel and dragging & dropping the panels into the positions you want them to be in. Go here for more info: http://docs.splunk.com/Documentation/Splunk/5.0/Viz/CreateandeditdashboardsviatheUI#Create_and_edit_dashboards_with_the_Dashboard_Editor You can also use the drag and drop method if you've used simple XML to code the dashboard. If you created the dashboard in advanced XML you'll need to go into the advanced XML and move the code for the panels around into the correct configuration of rows and columns. This is a bit trickier. You can find help here: http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/AdvancedDashboard#Lay_out_your_panels ... View more

Try this search instead: index=savvis-varnish host="dell1000a-12" source="/flocal/logs/lawyers.findlaw.com/search-mapping.log" PAMapped!=* earliest=-1mon@mon The != operator can be better for this sort of thing. ... View more

Ok, a few things could be going on. But let's get one thing straight--any user should be able to delete a knowledge object (such as a dashboard, saved search, or tag) that they have created but have not shared. Things get tricky when you share your knowledge objects with others or need to share or delete knowledge objects that others have created. First, you can only delete knowledge objects that have been shared or that others have created if your role has write permissions for the app to which they belong. So for example, to delete a dashboard that you didn't create or share that belongs to the Search app you'd need write permissions for that app. If you have the Admin role you should be able to delete objects in the search app, but if you have another role that has "equivalent capabilities" to the Admin role you won't be able to delete Search app objects that you didn't create or share unless your role has been granted write permission for the Search app. To do this, you or your admin need to navigate to Manager > Apps and click Permissions for the app to go to its Permissions page. On this page you or your admin can determine which roles have read or write access to the knowledge objects that the app contains. When your role has write permissions you can delete these knowledge objects. Write permissions also dictate which roles can set permissions for knowledge objects such as dashboards--if you don't have this ability that's a good indicator that you don't have write permission at the app level for your role. Second, you cannot delete default knowledge objects that were delivered with Splunk (or with the App) via Manager. If the knowledge object definition resides in the app's default directory, it can't be removed via Manager. It can only be disabled (by clicking Disable). Only objects that exist in an app's "local" directory are eligible for deletion. Hopefully this helps you out. For more information about knowledge object management see "Curate Splunk knowledge with Manager" in the Knowledge Manager Manual. ... View more

The title of the dashboard will change on the dashboard, and it will change in the navigation (for example, what appears in the Dashboards & Views dropdown at the top of the Search view). But it won't change the name on the Views page in Manager. If you really want to change the title in Manager one option would be to clone the dashboard via the Views page in Manager, give the new, identical dashboard the correct title, and then delete the old dashboard. ... View more

You can rename dashboards through one of two methods; both are available via Splunk Web. Both methods require that you have write permissions for the dashboard. At The Dashboard Level Change the Edit toggle on the right-hand side of the dashboard from Off to On (just click On). Click Edit XML. You'll see a view of the XML behind the dashboard. If your dashboard is built with simple XML you'll see a <dashboard> tag. If it uses advanced XML it'll begin with <view template="dashboard.html"> . Either way this should be followed by a title bounded by two <label> tags. Edit the title to your preference and click Save. In Manager Navigate to Manager > User Interface > Views. You should see a list of your dashboards (note they're sorted by app context; be sure you're looking at the dashboards for the app you're working with). Click the name for the dashboard in question. This will take you to a view of the XML behind the dashboard, as with the previous method, which you can edit and save in exactly the same way as described above. ... View more

Talbot7: The ability to manage sharing permissions for knowledge objects (such as saved searches, alerts, dashboards, tags, event types, and so on) is controlled at the app level. There are no capabilities involved. As an Admin, click the Apps menu in the Splunk bar and click Manage Apps. Find the app that you want to adjust permissions for and open its Permissions settings. This opens the Permissions dialog for the app, where you determine which roles have read and write permissions for the knowledge objects contained within that app. Give your User role Write permissions for the app if you want them to be able to share knowledge objects such as saved searches. Warning: Roles that have write permissions to an app can also delete knowledge objects belonging to that app. For future reference I've added documentation about this functionality here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Manageknowledgeobjectpermissions#Enable_a_role_other_than_Admin_and_Power_to_set_permissions_and_share_objects ... View more

Two things that you might try: make sure that the "test" role is inheriting the "user" role, not just copying its capabilities. And make sure that the "test" role and "test" user default to the app in question in their definitions. ... View more

Hm, I was able to get the process to work on my end. Created a role "test" that inherited its properties from "user," (and which defaulted to the Search app) then added the edit_users capability to it. Added a local.meta file with read : [ admin, test ] for [manager/accesscontrols] . Saved all my changes and checked--the user "test" could add users. Curious. ... View more

The bubbles are the same color because you've set this up as a single series bubble chart. To get different colors, you'd need to configure the chart to handle multiple series. This would utilize a four-column table, where the first column would be the series (in your case, most likely the "category" field), and then the other three would be the x, y, and z axes respectively. I'll look into the zero value issue. Have you considered going with a stacked column chart instead? It seems like that would do a better job of expressing what you're trying to express here. ... View more

To edit or delete a saved search, you need to use Splunk Manager, as Becky states above. Saved searches are a type of knowledge object (along with other kinds of user-created metadata like event types, tags, lookups, transactions, workflow actions, and so on). All knowledge objects can be edited and managed via Manager. Go to the Manager link at the upper right-hand side of the Splunk page and click it if you're unfamiliar with it. Then click on the Searches and Reports link to see a list of all of the saved searches that you have either created or have been given permission to view and/or edit. Click on the name of the search you created; you should be taken to a details page, and if you have the correct permissions, you should be able to edit it there and save your changes. Permissions are important, especially when it comes to deleting saved searches and other knowledge objects (as well as editing them). Here are the rules that control whether or not you can delete a saved search in Manager: You cannot delete default knowledge objects that were delivered with Splunk (or with the app) via Manager. If the knowledge object definition resides in the app's default directory, it can't be removed via Manager. It can only be disabled (by clicking Disable). Only objects that exist in an app's "local" directory are eligible for deletion. You can delete knowledge objects that you have created, and which haven't been shared. Once a knowledge object you've created is shared with other users, your ability to delete it is revoked, unless you have write permissions for the app to which they belong (see the next point). To delete all other knowledge objects, you need to have write permissions for the application to which they belong. This applies to knowledge objects that are shared globally as well as those that are only shared within an app--all knowledge objects belong to a specific app, no matter how they are shared. App-level write permissions are usually only granted to users with admin-equivalent roles. For more information about disabling or deleting knowledge objects (such as saved searches) see: http://www.splunk.com/base/Documentation/latest/Knowledge/CurateSplunkknowledgewithManager#Disable_or_delete_knowledge_objects I'm the tech writer in charge of this sort of thing. I'll review the docs and try to make it easier to find the material that I've linked to above. ... View more

Hi Paolo! What you've stumbled onto are some docs in progress that are intended to replace the existing charting reference docs in the Developer's Manual. I'm working on them now and hope to have them complete soon. I wouldn't depend on them as a reference just yet as they will likely change a fair amount before they are put into their proper home. I do not know of an existing example of an annotation chart overlay configuration to show you. I'll see if I can get one of our engineers to provide something. ... View more

I think a "dependency finder" app or add-on would be great, if you couldn't somehow work the functionality directly into Manager. ... View more

Seems like as good an approach as any to manage dependencies as they develop at this point. See my answer for the official word on tracking down dependencies if you haven't been keeping track of them already. ... View more