Yes, you can change the chart type for a previously saved search via the UI. Open up the saved search you previously created. You can do this by selecting it from the Searches and Reports dropdown from the search interface, or from Splunk Manager (Searches and Reports) and clicking "Run" Your search should open in the report builder. Click the "Edit Report" button. Change your chart type, or any other properties you wish and click the "Apply" button Click "Save" -> "Save report" Essentially the above does the same thing described by the zscgeek on the back-end (edits the viewstate), but via the UI. ... View more

Hi Stuart, You make some good suggestions. We've heard some of these from other customers as well and they are certainly on our long term roadmap. I'd love to better learn about your use cases to help prioritize -- I will email you offline to set up a time. As far as the bugs you encountered (such as sizing/rendering issues), please do submit them via support@splunk.com if you haven't already so we can take care of them asap. I recognize that Splunk is not a fully featured reporting tool, nor was it intended to be. Reporting is just one of many things we do, and while some customers are perfectly happy with our current, relatively simple implementation, we do have customers that demand more. Several, as the previous commenter suggested, have integrated with other reporting packages/UIs (such as Google charts) either via scripts or our REST API with great success. Thanks, Gaurav Gupta (Dir. of Product Mgmt at Splunk) ... View more

T Furnish, I understand your frustration here -- we really should have caught this earlier, and perhaps we were too conservative with our limits. There is no reason your dashboard shouldn't load without errors. The short term solution will be to increase the default max_searches_per_cpu and base_max_searches to 4. Since it involves making a significant change in the way splunk uses cpu resources, this will happen in the next minor release, 4.1, coming soon. ... View more