Ok, so restart your splunk instance, and then go to New UDP input, and select from the SOURCETYPE dropdown, the testUDP sourcetype, not the source. Hope this helps ... View more

What version of Splunk are you using? ... View more

This doesn't appear to be possible, but you could take a look at this answer; http://answers.splunk.com/answers/925/in-the-titlebar-module-is-it-possible-to-limit-the-list-of-actions-to-only-export-results.html ... View more

I totally agree, in this day and age, no link should be hard coded, all should use a relative path. Browsers are now intelligent enough to detect that all you want to do is use the same root URL but with a different path on the end. ... View more

Hi Jolver14, Looking at your question, this would be an ideal place for you to use Custom Cell highlighting. Although it doesn't set the colour of the whole column, you can configure it to use a rangemap, i.e. if it uses a low amount, show green, medium, show orange, and high show red. See: Splunk dashboard 6.x dashboard examples or code below; /* Cell Highlighting */ /* #highlight td { background-color: #c1ffc3 !important; } */ #highlight td.range-low { color: #C0D9D9; } #highlight td.range-elevated { background-color: #ffc57a !important; font-weight: bold; } #highlight td.range-severe { background-color: #d59392 !important; font-weight: bold; } JS: require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { // Row Coloring Example with custom, client-side range interpretation var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { // Enable this custom cell renderer for both the active_hist_searches and the active_realtime_searches field return _(['active_hist_searches', 'active_realtime_searches']).contains(cell.field); }, render: function($td, cell) { // Add a class to the cell based on the returned value var value = parseFloat(cell.value); // Apply interpretation for number of historical searches if (cell.field === 'active_hist_searches') { if (value > 2) { $td.addClass('range-cell').addClass('range-severe'); } else if (value > 1) { $td.addClass('range-cell').addClass('range-elevated'); } else if (value > 0) { $td.addClass('range-cell').addClass('range-low'); } } // Apply interpretation for number of realtime searches if (cell.field === 'active_realtime_searches') { if (value > 1) { $td.addClass('range-cell').addClass('range-severe'); } } // Update the cell content $td.text(value.toFixed(2)).addClass('numeric'); } }); mvc.Components.get('highlight').getVisualization(function(tableView) { // Add custom cell renderer tableView.table.addCellRenderer(new CustomRangeRenderer()); // tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row // tableView.$el.find('td.range-cell').each(function() { // $(this).addClass(this.className); // }); //}); // Force the table to re-render tableView.table.render(); }); }); This I believe might suit you more, but if you wish to just change the colour of the column I believe you must use HTML/CSS combination for your table, please post the source code for your table and I'll see If i can come up with something. ... View more

Hey SwatiApte, using output input lookup tables simply creates a CSV file which, if you wanted to you could input and then display in a table. What Ppape is saying is if you create the dashboard and the alert, but set the alert to input the CSV and get the latest value from it. ... View more

Can you explain what your search does and how it actually checks for new "NEVER BEFORE SEEN" MAC addresses? ... View more

Hi vtsguerrero, I'm not sure your requirement is possible, but if you use Collect Windows performance data from a remote machine (WMI) data input, indexing is quite quick most of the time and there is normally unnoticeable. On my instance, the latency is around 10 seconds when using indexed realtime searching. ... View more

You say you tried pasting it? Have you tried simply typing it manually? Or tried re-downloading the file? ... View more

Hi Tom, I believe you're right, but is that really optimized? ... View more

I think Tom might have the right answer, so please share if it's correct, also convert it to answer if it is correct. ... View more

Ok, so can you provide examples of the 2 events please and I'll write you a search string ... View more

Can you clarify what you actually need to do? You need to add the 2 values together? If so, why not transaction them, then use rex to create new fields and just add the fields together? ... View more

Hello ferza, I assume from this question that you have this search in a dashboard, as you said you wanted to pass parameters to it, for this, you could use a form element of a multi pick dropdown, and then use the Table command at the end of your search, and use the input from the multi select dropdown ... View more

Yeh we have found this solution now, thanks Cchitten, but I was also wondering how you use subsearches in 6.0.5 ... View more

Hi cchitten, We have 2 different events, listed below; name=com.**************** value=5 name=threshold.max.com*********** value=200 which are transactioned together, but using that we want to use a subsearch in order to get the threshold max out of that transactioned event and set into a field called Max. Also, Its something completely new to me so would be useful if you know how for v6.0.5 ... View more

I'm also interested in the answer to this ... View more

I'm not 100% sure if my answer is what you're looking for, but please see below, if not, leave a comment and i'll get back to you if you're trying to send an alert if a field matches what you expect then use a simple if statement, eval SendAlert=if(eval(match(fieldname, "{Either regex or string}")),1,0) Then your alert settings should be to send an alert if any event has a field SendAlert set to 1. Don't forget to comment if this isn't what you're looking for ... View more

Right, Please see below; To disable time picker: Click edit -> Edit panels -> push the x next to the timepicker To add prompts, which I believe you mean 2 input fields, you can use the form elements and set tokens, i.e. $fromdate$ To add constraints, you could use a number field, and set a maximum number of 15, or alternatively, use a drop-down with -1d, -2d, -3d etc. Hope this is what you're looking for, if not leave a comment and I'll get back to you ... View more

Waydenie, I've posted a reply seen as it's relevant to you. Hope it helps. ... View more

I'm not too sure what you wish to achieve here, transaction groups multiple events into a single event, so I'm assuming you're trying to group all events with a certain QID In any case, there is a command known as "fillnull" used in the format of: fillnull fieldname 0 This would then set your not present fields to visible in all events, and then you can use transaction. Alternatively, If I've misinterpreted the question, you can use the transaction command based on a field. i.e. transaction fieldname Which will group all events that have the same value in fieldname into a single event. if this is not the question you meant, please comment on this answer and I'll see what I can come up with. Thanks ... View more

Hi Victor, When you create your alert, you should use an AND operator in your search string, for example I would use an IF statement to set a field, e.g. SendAlert, to a boolean value of 0 or 1, then from the results trigger an alert if SendAlert is equal to 1. I hope this helps, if not, let me know and I'll come up with something else. ... View more

It would actually be the AND logical operator, as stated in the question, if they both match. ... View more