Hello, I have a table module that passes data to an html module. I was wondering if when the user clicks the data, the field value can be automatically copied to the users clipboard and another URL opened? I don't want to pass any values to the other URL. search TESTSEARCH | table TEST_URL 10 $row.fields.TEST_URL$]]> ... View more

Hello, The saved search creates a table with multiple rows. testrow7 is populated from a lookup and is just URLs to another site. I just want to make a hyperlink for those URLS and have it redirect to another tab or browser. Is that possible? <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="test1" autoRun="True"> <param name="useHistory">True</param> <param name="savedSearch">testsearch</param> <module name="JobProgressIndicator" /> <module name="Export"> <param name="exportType">results</param> </module> <module name="Paginator"> <param name="count">3</param> <param name="entityName">results</param> <module name="Table" layoutPanel="panel_row1_col1"> <param name="count">100</param> </module> </module> </module> ... View more

Hello, Problem #1 viewredirectorlink ViewRedirectorLink only shows up when i click on something in the chart Problem #2: onclick What's the best approach to have the drilldown convert the macro to raw search and have the drilldown chart click value still be implemented - 'Time' and 'Field' drill-down Content would would be ideal. The current set up below does convert the macro to raw search. However, if a user clicks on the bar in the chart, it redirects with the count value. This is not helpful and often times yields 0 results if the count has increased. <module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" group="test1" autoRun="True"> <param name="useHistory">auto</param> <param name="savedSearch">savedSEARCHwithMACRO1</param> <module name="HiddenChartFormatter"> <param name="charting.legend">legend</param> <param name="charting.legend.labelStyle.maximumWidth">500</param> <param name="charting.legend.labelStyle.minimumWidth">500</param> <param name="charting.chart.stackMode">stacked</param> <param name="charting.legend.placement">right</param> <param name="charting.chart">column</param> <param name="charting.legend.labelStyle.defaultTextFormat">{font:Arial,size:09}</param> <param name="charting.fieldColors">{"NothingToReport":0x00FF00}</param> <module name="JobProgressIndicator"/> <module name="FlashChart"> <param name="height">250px</param> <module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="True"> <param name="search"><![CDATA[`MACRO1`]]></param> <param name="earliest">-2h</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirectorLink"> <param name="popup">True</param> <param name="viewTarget">flashtimeline</param> <param name="label">All Results</param> </module> </module> </module> </module> </module> </module> I have also used the sideview html modules but i'm not sure how or if it could convert the macro to raw search. ... View more

I have a dashboard that has a large number of panels, 18 to be exact. When there is an outage and one of the panels starts counting a large number of events , the rest of the panels are blank on the next refresh. I didn't have the problem until splunk 6. Is it a bug? I'm using flash charts in the panels and columns set to 35 bins over 2 hours the only solution i have found, is to comment out the panels with a large number of events, then the dashboard starts working again which defeats the purpose of the dashboard. ... View more

What's the easiest way to create a key for a list of octets that need to be renamed? Example: I have a rex query that pulls the 3rd, 4th OCTET, and Port For example - 192.168.2.9:23 the rex would extract 2.9:23 to 3 seperate fields rex would extract 3 fields respectively to this fieldA=2 fieldB=9 fieldC=23 To set up a key, I would prefer to use a macro so different users can modify values To keep it simple, the key would look something like this and would rename the octets extracted from the rex above and ultimately a new field would be created, that concatenates multiple values. 2=branchoffice 9=adminhost 23=telnet new field would look like this: branchoffice->adminhost->telnet ... View more