Hello, I am creating a daily report which will contains ~ 10 pages of statistics, charts, exceptions, etc. I have a few questions: Is there a way to control the pagination with the PDF report/server. For example, can I use HTML code to create section/page boundaries? Can we add links/navigation in the PDF report? Can we control the format of tables (e.g. being able to wrap text that is too long to display)? Thanks, Jean ... View more

Hello, I am designing dashboards using the simplified XML, and I would like to specify the column width so that the chart width is smaller. <row> <chart> <title>Yesterday Data</title> <earliestTime>-1d@d</earliestTime> <latestTime>@d</latestTime> <searchString> "searchstring .... | timechart span=1h count by eventtype usenull=f useother=f </searchString> <option name="height">250px</option> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.columnSpacing">1</option> <option name="charting.chart.useAbsoluteSpacing">true</option> <option name="charting.chart.columnStyle.spriteWidth">30</option> <option name="charting.primaryAxisTitle.text"></option> <option name="charting.secondaryAxisTitle.text">Count</option> <option name="charting.legend.placement">top</option> <option name="drilldown">all</option> </chart> </row> There is a description of some properties that can be used in the documentation, but I can figure out how to specify it: http://www.splunk.com/base/Documentation/latest/Developer/AdvChartingConfig-TextblockLayoutspriteSprite#Sprite For example, I tried these options, but is does not work... <option name="charting.chart.columnStyle.spriteWidth">30</option> <option name="charting.chart.columnStyle.spriteWidth">spriteWidth</option> <option name="charting.layoutSprite.maximumWidth">30</option> <option name="charting.chart.sprite.width">30</option> Thanks for all your help! Jean ... View more

I created a search query that returns a set of database alerts which contains a field called alert. The field contains text values such as alert_15s, alert_120s, etc I am building a stacked chart which currently display these alerts in this order: alert_120s alert_15s alert_180s alert_300s alert_600s alert_60s How can I change the order of the fields/legends to be this way: alert_15s alert_60s alert_120s alert_180s alert_300s alert_600s Thanks, Jean ... View more

Hello, We are monitoring application files that are mounted as read-only NFS drives, and sometimes multi-lines messages are processed as multiple events. These are the format of the multi lines messages, when processes as single events. Event #1 [LOG|INFO|2010 December 07, 09:59:43 (208)|TRACK_MD|RMI TCP Connection(61072)-100.200.10.22|100.200.10.21 (host.net.com)] Saving MD: DataInfo.1891568 LAST 12/7/10 10:59:31.000 AM EST FROM: 100.200.10.20 (host.net.com) @ 12/7/10 9:59:43.208 AM EST [END] Event #2 [LOG|ERROR|2010 December 07, 09:59:55 (8)|SQL|RMI TCP Connection(61294)-100.200.10.21|100.200.10.21 (host.net.com)] Trying to saves duplicate points in data filed 1287/OBRC on 12/7/10 9:59:48.000 AM EST [END] This is the format, when they are processes as multiple events Event #1 [LOG|INFO|2010 December 07, 09:59:43 (208)|TRACK_MD|RMI TCP Connection(61072)-100.200.10.22|100.200.10.21 (host.net.com)] Event #2 Saving MD: DataInfo.1891568 LAST 12/7/10 10:59:31.000 AM EST FROM: 100.200.10.20 (host.net.com) @ 12/7/10 9:59:43.208 AM EST [END] Is there any ways to resolve this multi line nfs issue? We tried different options such as: BREAK_ONLY_BEFORE=\[LOG\| MAX_TIMESTAMP_LOOKAHEAD=50 Thanks, Jean ... View more

I am trying to find out how much auditing is built-in in Splunk related to adding/deleting/updating Users Configuration (inputs.conf,outputs.conf) Parsing/processing (props.conf, transforms.con) I added a new file or a new user, and tried to find out an audit event, but I could not find it in the internal indexes? May be I need to monitor all the Splunk config files? Thanks, Jean ... View more

Hello, Is it possible to start a search (or report, chart, etc) which will display the last 15 minutes of events, and will continue to display in real time? This would be like specifying -15m, rt or -1h, rt Thanks, Jean ... View more

I would like to reduce the size of the chart in the dashboards (Splunk 4.1.5) to add more charts. I am using the default xml like: <?xml version='1.0' encoding='utf-8'?> <dashboard> <!-- NOTE: This file was automatically generated by Splunk. Use caution when editing manually. --> <label>Today's Metric</label> <row> <chart> <searchName>Report - Save Reference Transaction - Count</searchName> <title>Save Reference Transaction - Count</title> <option name="drilldown">all</option> </chart> <chart> <searchName>Report - Save Reference Transaction - RT</searchName> <title>Save Reference Transaction - RT</title> <option name="drilldown">all</option> </chart> </row> </dashboard> ... View more