Currently there's no way to reset or revert a token (or in some cases multiple tokens) to previous value or maybe a default value. Let say you have a dashboard filter1=* filter2=* filter3=* as users engage in your dashboard, filter1, filter2, and filter3 may change to different values that are not . Normally people associate a "reset" form with a button such as a "reset button". It would be fantastic SPLUNK adds button where we can change the onclick listener to set the values of other token when needed. In this example, if we added a "reset" button, when users click on it, we could set filter1= filter2=* filter3=* The other options i've seen 1) requires providing a link to same dashboard with various tokens predefined. IMO this is a silly method because it requires your user to reload the whole dashboard JUST to reset it. In most cases, its quicker for them to just hit the refresh button but that kinda defeats the purpose of clearing out a token 2) using an input field to do what is mentioned here. Its a working solution but rather ugly UI. In this case, we're expecting our user to type in something to clear out a filter instead of the universal "click on reset button". ... View more

In the Splunk dashboard, I would like to add a logic that displays report1, report2, or generate an error based on the time range that a user has selected. If the user has selected a time range (range min and max) that is less than the specified date, then show report1. If time range (range min and max) are both more than the specified date, then show report2, otherwise show an error message. In the dashboard, here's my code: <fieldset submitButton="false"> <input type="time" token="maintime" searchWhenChanged="true"> <label>Select Date/Time</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> </fieldset> <search id="Report_SelectedTimePeriod"> <!-- logic to determine whether to query and filter by old method (1),new method (2), or error (3) --> <query>|gentimes start=-1 | addinfo | convert ctime(*) | eval reportDate_min=strptime(info_min_time,"%m/%d/%Y %H:%M:%S")| eval reportDate_max=strptime(info_max_time,"%m/%d/%Y %H:%M:%S")| eval comparedate=strptime("05/17/2016 12:00:00","%m/%d/%Y %H:%M:%S")|eval reportType=case(comparedate>reportDate_min AND comparedate>reportDate_max, 1, reportDate_min>comparedate AND reportDate_max>comparedate, 2, 1=1,3)|table reportType</query> <done> <condition match=" 'result.reportType' == 1"> <set token="reporttype">Old Report --$result.reportType$</set> </condition> <condition match=" 'result.reportType' == 2"> <set token="reporttype">New Report</set> </condition> <condition> <set token="show_html">Please ensure both, (the start and end Date) is More OR Less than 05/17/2016 12:00:00 --$job.resultCount$ </set> </condition> </done> </search> <row> <panel> <title>$reporttype_html$</title> <single> <title>$reporttype_html$</title> <search base="Report_SelectedTimePeriod"> <earliest>$maintime.earliest$</earliest> <latest>$maintime.latest$</latest> </search> <option name="drilldown">none</option> <option name="beforeLabel">Report Date:</option> <option name="linkView">search</option> <option name="afterLabel">.</option> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="numberPrecision">0</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> ... View more

Splunk export has a limitation of 10000 rows. How do i get 5 top pages (either by visit or pageviews) per day? Currently I'm using a data model. For example sake, lets say i there's more than 10000 visited pages for any given day. If i ran the query below with a pipe of |head 5 and ran the search for a full year, it wouldn't give me top 5 pages per day for a full year. Instead it would give me top 5 rows from all pages and days. |pivot MainSites HomePages dc(User) AS "DistinctUser" dc(VisitSession) AS "DistinctVisits" sum(wtPageView) AS "TotalPageViews" sum(Click) AS "TotalClicks" SPLITROW TimePeriod_Daily SPLITROW eventURL | sort - "TotalPageViews" ... View more