worked for me - but - surely this is something that should not happen- there are no warnings in Splunk it just bang - Splunk is down in production   ... View more

This works for the raw data ... meaning so long as you aren't doing sourcetype renaming at search time. Tstats only looks at the raw data so it cannot see anything that happens search time. Sourcetype | tstats count where index=* OR index=_* by index, sourcetype | fields - count | sort index Source | tstats count where index=* OR index=_* by index, source | fields - count | sort index ... View more

Hi Woodcock, I'm having the same problem that HELGE mentioned. I have created my own KV_MODE as you gave in the solution but I still get the same error. Can you confirm that even if I have created my own KV_MODE IT IS NOT POSSIBLE to skip the equal symbol (=)? (Splunk keeps creating different fields whenever it finds an = inside the value). ... View more

Ran into this yesterday and this is exactly what I needed. Thank you.  ... View more

@bsanjeevaI'm afraid I don't know if/how this can be configured via Splunk's UI. ... View more

Thank you very much for this tip. It doesn't work for me on 8.2.0 in type="multiselect" 😭   ... View more

Hi @helge , the fix is currently planned for Splunk Enterprise v8.3.0, which is tracking release around .conf time.  ... View more

The simpleXML submit button is horribly broken and for complex usecases, cannot be made to work.  Try this dahsboard's no-JavaScript approach instead:   <form theme="dark"> <label>PoC demonstrating a fully-functioning no-JS SUBMIT "button" (actually "checkbox").</label> <description>https://community.splunk.com/t5/Dashboards-Visualizations/SimpleXML-Inherent-brokenness-regarding-autorun-and-Submit/m-p/407351 For intricate technical reasons that Splunk considers "working as intended", the "real" SUBMIT button is fundamentally broken and CANNOT BE MADE TO WORK for many usecases (i.e. when you must use "true" for "searchWhenChanged"). Fortunately, the method demonstrated herein does everything that anyone could desire with only 1 downside which is this: there is no way to make the dashboard autorun on first load (not even if you click the CHECKBOX with a URI in the URL). Notice that even though some of the controls interact with one-another, the actual search does not run until the SUBMIT box is checked. Here are the pieces that are required. 1: DO NOT CHANGE ANYTHING ABOUT THE "SUBMIT" checkbox other than cosmetic things (e.g. html). 2: Ensure that EVERY OTHER CONTROL has a "&lt;change&gt;...&lt;/change&gt;" section that unsets BOTH these tokens: {"SUBMIT_CHECKBOX", "form.SUBMIT_CHECKBOX"}. 3: Ensure that 1 search in every chain of searches uses the do-nothing "$SUBMIT_CHECKBOX$" token somewhere (i.e. if all searches are driven by a base search, this only has to be done in the base search, not the post-process searches). This token will always be either unset or blank so it does not matter where you put it. 4: Neither the individual "searchWhenChanged" values of the controls NOR the global "Autorun dashboard" value makes any difference. For support contact woodcock@splunxter.com.</description> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="INDEX" searchWhenChanged="true"> <label>Select Index value(s)</label> <fieldForLabel>label</fieldForLabel> <fieldForValue>value</fieldForValue> <default>*</default> <search> <query>|tstats count dc(host) WHERE index=* AND $SOURCETYPE$ BY index | rename index AS value | eval label = value | append [|makeresults | eval label = "All", value="*"] | table label value</query> <earliest>$timepicker.earliest$</earliest> <latest>$timepicker.latest$</latest> </search> <delimiter> OR index=</delimiter> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <prefix>(index=</prefix> <change> <eval token="form.INDEX">case(mvcount($form.INDEX$) == 2 AND mvindex($form.INDEX$, 0) == "*", mvindex($form.INDEX$, 1), mvfind($form.INDEX$, "^[*]") == mvcount($form.INDEX$) - 1, "*", true(), $form.INDEX$)</eval> <unset token="SUBMIT_CHECKBOX"></unset> <unset token="form.SUBMIT_CHECKBOX"></unset> </change> <suffix>)</suffix> </input> <input type="multiselect" token="SOURCETYPE" searchWhenChanged="true"> <label>Select sourcetype value(s)</label> <fieldForLabel>label</fieldForLabel> <fieldForValue>value</fieldForValue> <default>*</default> <search> <query>|tstats count dc(host) WHERE $INDEX$ AND sourcetype=* BY sourcetype | rename sourcetype AS value | eval label = value | append [|makeresults | eval label = "All", value="*"] | table label value</query> <earliest>$timepicker.earliest$</earliest> <latest>$timepicker.latest$</latest> </search> <delimiter> OR sourcetype=</delimiter> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <prefix>(sourcetype=</prefix> <change> <eval token="form.SOURCETYPE">case(mvcount($form.SOURCETYPE$) == 2 AND mvindex($form.SOURCETYPE$, 0) == "*", mvindex($form.SOURCETYPE$, 1), mvfind($form.SOURCETYPE$, "^[*]") == mvcount($form.SOURCETYPE$) - 1, "*", true(), $form.SOURCETYPE$)</eval> <unset token="SUBMIT_CHECKBOX"></unset> <unset token="form.SUBMIT_CHECKBOX"></unset> </change> <suffix>)</suffix> </input> <input type="text" token="COUNT"> <label>Name for "count" field</label> <default>count</default> <change> <unset token="SUBMIT_CHECKBOX"></unset> <unset token="form.SUBMIT_CHECKBOX"></unset> </change> </input> <input type="time" token="timepicker" searchWhenChanged="true"> <label>Timepicker</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> <change> <unset token="SUBMIT_CHECKBOX"></unset> <unset token="form.SUBMIT_CHECKBOX"></unset> </change> </input> <input id="submit_checkbox" type="checkbox" token="SUBMIT_CHECKBOX"> <label></label> <delimiter> </delimiter> <choice value="">SUBMIT</choice> </input> <html depends="$hide$"> <style> #submit_checkbox{ width:80px !important; } #submit_checkbox div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{ width:80px !important; } #submit_checkbox button{ padding: 6px 15px !important; border-radius: 3px !important; font-weight: 500 !important; background-color: #5cc05c !important; border: transparent !important; color: #fff !important } #submit_checkbox button:hover{ background-color: #40a540 !important; border-color: transparent !important; } </style> </html> </fieldset> <row> <panel> <table> <title>Searches ONLY on checking the SUBMIT box (which resets itself)</title> <search> <query>|tstats count AS $COUNT|s$ dc(host) WHERE $INDEX$ AND $SOURCETYPE$ BY index sourcetype $SUBMIT_CHECKBOX$</query> <earliest>$timepicker.earliest$</earliest> <latest>$timepicker.latest$</latest> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   ... View more

I tried - unsuccessfully - upgrading Splunk 8.1.5 to 8.2.1 and, when that consistently failed with the errors the OP mentioned, also the upgrade to 8.2.0. Same result. I then proceeded by uninstalling the existing version, followed by a clean install of 8.2.1, which succeeded. Afterwards, I compared the versions of libeay32.dll and ssleay32.dll that were present in 8.1.5 prior to the upgrade with the versions that came with 8.2.1. Interestingly, the newer Splunk version has an older version of the OpenSSL libraries: Splunk 8.1.5: 1.0.2.25 Splunk 8.2.1: 1.0.2.24 I suspect this to be the problem. Machine this happened on: OS: Windows Server 2016 Splunk web SSL access : enabled ... View more

I was having the same issues, I fixed this by running the chmods as root in WSL on my windows machine -   find APPNAME_HERE -type d -exec chmod 700 {} \; find APPNAME_HERE -type f -exec chmod 644 {} \; ... View more

Hello @niketn  is there a possibility to add a total column but not using addtotals command As I would like to use Data overlay: heatMap And with addtotals it is not very usable (Total column is most red) Or I am not understanding heatmap overlay correctly ... View more

@hhunsinger_spluWe have several apps in Splunkbase where the icon's background color is white (example). How can we have it changed to transparent? The icon's PNG file has transparent corners and we do not specify a color in default.xml. ... View more

For finding the corrupt event, you said you "narrowed this down using timechart and a span of 1 second." Could you elaborate? I'm seeing something similar, and I'm not sure I have a corrupt event or not... but not sure how to reveal it. ... View more

@helge I am glad the solution worked. If you have multiple fields for drilldown you will have to apply CSS accordingly. Let me know if you still need more help! ... View more

Hi helge, Thank you for this quick answer. ... View more

Ah yes, The Field Who Must Not Be Named... ... View more

@helge, if the workaround has helped you resolve your issue, can you Accept the Answer? ... View more

The answers posted here work, but not if you have Splunk_TA_windows installed. For us, we had a full CPU taken up by splunk-netmon.exe on our Exchange server, that wouldn't get disabled if you set "interval = -1" or "disabled = 1" in etc/system/local/inputs.conf. So I ran "./splunk cmd btool inputs list --debug | select-string netmon" and saw that I actually had to modify C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf, and set the two stanzas there to "disabled = 1". That did the trick! ... View more

Splunk even adds a little symbol to the link to indicate that it opens in a new tab. ... View more

I thought there was a limit of 10,000 but that does not appear to be the case in 6.4. In general, I limit mine to 2500. I am usually chaining multiple input elements from a larger data set defined in a lookup, so the early selected values help filter the subsequent values. I just did a simple test that included 23,000+ units on a dashboard with nothing else than that single input, and I would say that it had a noticeable impact on my system (primary standalone server with plenty of resources). That input set (the SID) ate up a few megabytes and made my input element nearly unresponsive. ... View more