@Ayn for example, i have the following 7 logs, 2011-DEC-17 slotid="Location-Maps-US-Sunnyvale" delta_msec="1487" seq="3" 2011-DEC-17 slotid="Location-Maps-US-MountainView" delta_msec="1445" seq="2" 2011-DEC-17 slotid="Location-Maps-US-SF" delta_msec="1465" seq="2" 2011-DEC-17 slotid="Location-Store-CA-MountainView" delta_msec="1445" seq="2" 2011-DEC-17 slotid="Location-Store-CA-SF" delta_msec="1245" seq="2" 2011-DEC-17 slotid="Location-Msg-CA-MountainView" delta_msec="1445" seq="2" 2011-DEC-17 slotid="Location-Msg-CA-SF" delta_msec="1245" seq="2" i want to calculate a new field(avg_msec) based on the "slotid": we would like to calculate an average for all logs matching "Location-Maps" we would like to calculate an average for all logs matching "Location-Store" we would like to calculate an average for all logs matching "Location-Msg" ... View more

There is a good example app on splunkbase. You will find the link to navigate next view on this app. Please try it. http://splunk-base.splunk.com/apps/22333/splunk-ui-examples-app-for-41 ... View more

In the $SPLUNKHOME/etc/system/default directory , there is a file called times "times.conf" You could create your own customized "times.conf" file and place it in $SPLUNKHOME/etc/system/local directory , or for changes specific to a particular app the $SPLUNKHOME/etc/$APPNAME/local directory Another thread has some good info also : http://splunk-base.splunk.com/answers/6393/custom-timesconf ... View more

Thanks. however, in my case, both views are already there in the same dashboard, i just want to navigate them through the hyperlinks, so when i click one, it brings me to another. It's not drilling down to another views. Any idea how can i do that? ... View more

I understand that there is an option for that which is to change the configuration in the times.conf.However, we don't want to do that. We just want this form to have fewer drop down options. ... View more

Thats totally a design decision you'd have to make based on your users. Generally if I have only three dashboards I'd like my users to access I'll create a simple app and restrict them to that app. The "landing" page on the app would show some "summary charts" and then have text directing the users on how to navigate around or what the values/options/charts all mean. Then instead of a drop down list (because you only have three dashboards) just add the view's to the navigation bar as their own clickable tab. ... View more

Hello, I have a problem with indexes in Splunk Entreprise . the problem is that I added a folder contains several files , the Splunk began indexing but at some point it removes all that has indexed(COUNT EVENT=0) , knowing that I have not found this problem in Splunk light. index characteristic: range=ALL Time The Max Size=500GB index.conf: [indexTest] coldPath = $SPLUNK_DB/ffjj/colddb enableDataIntegrityControl = 0 enableTsidxReduction = 0 homePath = $SPLUNK_DB/indexTest/db maxTotalDataSizeMB = 512000 thawedPath = $SPLUNK_DB/indexTest/thaweddb disabled = 0 input.conf: [monitor:///data/splunk/test] disabled = false index = indexTest sourcetype = LICENCIE ... View more

Hexx just posted something very similar to this based on a similar request. http://splunk-base.splunk.com/answers/28353/how-to-calculate-a-per-second-event-count-for-a-rolling-time-window ... View more