Have you tried creating another HiddenSearch module before your ViewRedirector. This should pass your click value down to that hidden search which will output to a new window with the view redirector. For the time part need to play around a little. travis. ... View more

If you haven't tried Splunk 4.2.2 they have updated splunk_regmon.exe and able to monitor the keys I wanted. travis. ... View more

I use ResultsHeader module after a HiddenSearch module in my advance XML dashboards which will display the following: 123 results in the last 60 minutes (from 2:28:00 PM to 3:28:50 PM on Wednesday, April 20, 2011) in your dashboard. Example of the module in my XML: <module name="ResultsHeader"> <param name="entityLabel">results</param> <param name="entityName">results</param> Then make sure to close it out. Another option you could play with is SimpleResultsHeader, specially when working with drilldowns: <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">$time$</param> </module><!-- SimpleResultsTable--> Link with more info: http://www.splunk.com/base/Documentation/4.2.1/Developer/ModuleReference#ResultsHeader Hope this helps Travis. ... View more

Not sure if there is a Splunk standard, but it does make it nice to come up with a standard naming convention to organize your searches. For example I begin some of my search names with audit (ex: audit_fails, audit_successful). Then under my app I go into manager - user interface - navigation menus - default and added the following under So any time I create a search with the word audit it automaticly gets placed in the searches menu . I have another for my Database searches that I start with db_ (ex db_group1, db_group2) so it can get organized in a menu just for them so I am not scrolling through my other search to find them. Some good reading would be: http://www.splunk.com/base/Documentation/4.2/Developer/Step6BuildNavigation This one talks about the helpfulness of naming conventions: http://www.splunk.com/base/Documentation/4.2/Knowledge/Developnamingconventionsforknowledgeobjecttitles Hope this helps Travis. ... View more

So you just want to setup a search to run every 5 minutes and report on the previous 5 minutes to alert of any failures greater than 5. How about this: (your search for fails) earliest=-5min | stats count by user,host,_time | search count>4 ... View more

Maybe something like this for a search: (your search for fails) | bucket _time span=5m | stats count by user,host,_time | search count>4 After that save the search and set it up as an alert. Hope this helps Travis. ... View more

Looks like you are using the Simple Dashboards and I am referencing Advanced Dashboards. Never tried to use the SearchBar module in a Simple Dashboard and I would recommend switching to an Adv. Dashboard since you can customize it more. Good starting point is http://www.splunk.com/base/Documentation/latest/Developer/AdvancedDashboard from there you should see other articles about Adv. Dashboards. Also splunkbase has example UI dashboards you can look at: http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+UI+examples+app+for+4.1%2B Hope this helps. Travis. ... View more

I currently have dashboards setup with a search bar at the top and charts/tables under it. <module name="SearchBar" layoutPanel="mainSearchControls"> <param name="label">true</param> <param name="useAssistant">true</param> <param name="useTypeahead">true</param> <module name="TimeRangePicker"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module><!-- /ViewRedirector --> </module><!-- /TimeRangePicker --> </module><!-- /SearchBar --> Then after this you will just create your other modules that you want on the page. Next question is where do you want your results to show after you run this search? With the above setup it will redirect your current page to display the results. Not sure if you need the results to appear on that dashboard or open a new page. You will just need to play with the ViewRedirector part. If you want it to open a page and leave the current alone just add: <param name="popup">True</param> After <param name="viewTarget">flashtimeline</param> Hope this helps. Travis. ... View more

Question what permissions does your saved search have and what app is that saved search associated with? Travis. ... View more

After some more work I found that in sysmon.conf you can set active_filter = "Run", "RunOnce", "rest of your filters" and you will not need the User & Machine key entries in regmon-filters.conf like I had above. With this setup I am able to get a baseline, but it will not see any changes that I make to the registry. Still looking into it. ... View more

Ok I take that back on which filter gets used. From Splunk Web - manager - data inputs - registry monitoring the first one listed seems to be the one that gets used. ... View more

Had the same problem when trying to setup regmon filters like yours. Found that I had to add the following to the &SPLUNK_HOME\etc\apps\search\local\regmon-filters.conf ( or wherever you have your regmon-filters.conf located with the above info). [User keys] disable = 1 proc = \\Device\\.* hive = \\REGISTRY\\USER\\.* type = set|create|delete|rename [Machine keys] disable = 1 proc = \\Device\\.* hive = \\REGISTRY\\USER\\.* type = set|create|delete|rename This kept those 2 filters from running, but my problem now is that I only get my first filter to work. For example your [Run] filter that is defined would be the only results I would see. Whats even worse I labeled my filters all that same [Machine keys] it would give me events for the last one. I am still working on it to see if i am doing something wrong, but my regmon-filters.conf looks very similair to yours and I am trying this with Splunk 4.1.6 on a Vista 32bit machine for testing. Travis. ... View more

Maybe instead of using a TimeRangePicker try using the StaticSelect module. <module name="StaticSelect" layoutPanel="panel_row1_col1"> <param name="settingToCreate">time_setting</param> <param name="label">Choose the Time Range</param> <param name="selected">-1h</param> <param name="searchWhenChanged">True</param> <param name="staticFieldsToDisplay"> <list> <param name="label">-1h</param> <param name="value">-1h </param> </list> <list> <param name="label">-4h </param> <param name="value">-4h </param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">time_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="time"> <param name="value">$target$</param> </param> </param> </param> Then in your hidden search just have earliest=$time$ <module name="HiddenSearch" autoRun="True" layoutPanel="panel_row1_col1"> <param name="search">(your search) earliest=$time$ | timechart count by User</param> Hope this helps. Travis. ... View more

There is never a stupid question, glad you were able to fix it. ... View more

Just curious are you building a simple dashboard? If so did you try and select Data table from the panel style drop down instead of chart to see if you get results on that dashboard? Next question are you able to see other flash charts in Splunk? And what version of Splunk are you using? Travis. ... View more