About Eldad

RicoSuave · ‎07-06-2011

click on manager>apps>click on permissions for whatever the app is>select which roles/users have read and/or write access.

ewoo · ‎07-22-2016

When I go Field Transformations to look for this it isnt there, not even under the All category. I see. It looks like the Field Transformations settings page only supports REGEX/FORMAT-based transforms and not DELIMS/FIELDS-based ones. Do you have REST API access to the search head? If so, you should be able to use the REST API directly to fix up the transform. For example, something like: curl -sku admin:admin_password https://searchhead-hostport/servicesNS/original_owner/search/configs/conf-transforms/REPORT-LoadTest1/acl -d sharing=app -d perms.read=* -d owner=original_owner

sideview · ‎11-18-2010

I think for this you will need a subsearch. It will look something like this: foo [ search destip=216.248.156.24 | dedup srcip | fields srcip ] With a subsearch, splunkd will run the search within the brackets, and then the rows and fields of the subsearch get automatically turned into a boolean expression. The end result is that splunkd will run this search: foo ( srcip=A OR srcip=B OR srcip=C OR srcip=D OR ...... ) which I think is what you want.

sideview · ‎10-27-2010

1) there is significant documentation at splunk.com - eg: http://www.splunk.com/base/Documentation/latest/Developer/FormIntro Quite possibly you've just been looking in the wrong place? eg: setting the property charting.data.search is a very advanced thing to do additional filtering and is not at all how you set the main search. 2) or if you'd rather tinker with living breathing examples you can pull down the UI Exampels app and learn in a more hands on fashion. It sounds like this might be the way to go for you (since you somehow went straight to the advanced charting documentation) To do this: go to the "Launcher" app, within Launcher, go to "Browse more apps", then scroll down until you get to "UI Examples for 4.1". Install that app and once it's installed go to it and start reading through the examples. You'll find a number of examples talking about building different kinds of views in both the simplified XML (ie <form> and <dashboard> ) as well as the advanced XML (ie <view> )

Simeon · ‎10-19-2010

Saved searches will be persisted until your quota settings rotate out the old searches based on the period settings. This is probably the most consistent way to have a search persisted and be able to load it at a future point in time. To load it in the future, you can view it through the jobs viewer in the gui or via the loadjob search command. Note - simple dashboards that leverage scheduled saved searches will utilize the last run search. I believe the setting is called "useHistory". This may be a bit easier to use from an interface standpoint, as a user can just load that dashboard at any point in time to see the last stored result set for a given set of search results.

Posts	6
Solutions	0
Karma Given	0
Karma Received	6
Member Since	‎10-19-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Allow users to add public field extractions

Sharing field extraction, saved search or dashboar...

Expanding on a search result automatically

Form vs. View for Multiple Result Sets

Cached search results

Re: Allow users to add public field extractions

Re: Sharing field extraction, saved search or dash...

Re: Expanding on a search result automatically

Re: Form vs. View for Multiple Result Sets

Re: Cached search results