alternatively, if you want to keep some numbers, like in TEST1 or V2 , but not those sub-parts that are ONLY numbers, like _2342_ you can just alter the sed script slightly; ...| rex field=your_fieldname mode=sed "s/_\d+/_/g" ... View more

If the different panels on your dashboard are drawing from the same data sources, time range, etc, consider using postprocess. While it will take some work to redo your dashboards (with hundreds of searches), it will help with the time discrepancies on the panels. http://docs.splunk.com/Documentation/Splunk/latest/Developer/PostProcess ... View more

Hi I am new to splunk XML coding, When i use this code it shows the following error XML Syntax Error: Cannot find object mapper for panel type: module Please help. I am using Splunk 6.4.1 Thanks ... View more

hehe, np 😉 ... View more

Thx will give it a shot! ... View more