Hi All, Is there a way to import a panel into dashbaord studio, in a similar way to simple xml. Simple XML: This would import/insert that panel into the dashboard, so I could manage all filters/inputs in a global application and not have to manage it within the dashboard. <row> <panel id="overview_filter" ref="overview_filter" app="Filters"></panel> </row> Why: Imagine you have n dashboards, all which use the same set of inputs/token. Instead of writing the inputs/token code n times (once per dashboard), you an write it once and import it with the panel and panel-id.  The benefit here, apart from less coding, is that when ever anyone wants to change the name or title of a token, or they want to add a new token - you only have to do it in 1 place and it altomatically goes into all dashboards. I could not find the same way to import code/panels into dashboard studio.  I am sure it exists - my searches just couldnt find how to do it. cheers -brett   ... View more

Hi, I am using the REST API to pull data from splunk, using the output_mode=json. The data that is returned is a mix of strings and JSON (objects) and I am trying to work out a way for the API to return the entire data set as JSON. For Example: Curl Command: curl -k -u 'user1'' https://splunk-server:8089/servicesNS/admin/search/search/jobs/export -d 'preview=false' -d 'output_mode=json' -d 'search=|savedsearch syslog_stats latest="-2d@d" earliest="-3d@d" span=1' | jq . Results: Note how the result is in JSON, but devices is an array of strings not json. {   "preview": false,   "offset": 0,   "lastrow": true,   "result": {     "MsgType": "LINK-3-UPDOWN",     "devices": [       "{\"device\":\"1.1.1.1\",\"events\":12,\"deviceId\":null}",       "{\"device\":\"2.2.2.2\",\"events\":128,\"deviceId\":1}",       "{\"device\":\"3.3.3.3\",\"events\":217,\"deviceId\":2}"     ],     "total": "357",   } } Query: | tstats count as events where index=X-syslog Severity<=4 earliest=-3d@d latest=-2d@d by _time, Severity, MsgType Device span=1d | search MsgType="LINK-3-UPDOWN" | eval devices=json_object("device", Device, "events", events, "deviceId", deviceId ) | fields - Device events _time Filter UUID Regex deviceId addressDeviceId | table MsgType devices Query Result in UI: MsgType devices total LINK-3-UPDOWN {"device":"1.1.1.1","events":12,"deviceId":null} {"device":"2.2.2.2","events":128,"deviceId":null} {"device":"3.3.3.3","events":217,"deviceId":null} 357   As can be seen from the UI the device is in JSON format (using json_object), but from the curl result it is a string in json format - is there a way for the query to return the whole result as a json object, not a mix of json and strings ? I have also tried tojson in a number of differnt ways, but no success. Desired Result: where devices is a json object and not treated a string as above. {   "preview": false,   "offset": 0,   "lastrow": true,   "result": {     "MsgType": "LINK-3-UPDOWN",     "devices": [       {"device":"1.1.1.1","events":12,"deviceId":null}",       {"device":"2.2.2.2","events":128,"deviceId":1}",       {"device":"3.3.3.3","events":217,"deviceId":2}"     ],     "total": "357",   } } I can post process the strings into JSON, but I would rather get JSON from SPlunk directly. Thanks !         ... View more

Hi, Is there a way to target which application lookup you want to use? Lets say there are 3 applications, A, B and C,  where A and B each has device.csv but they have different data in them. Depending on a requirement Application C needs to use device.csv from A and other times it needs it from B.  That is, I cant use permissions to restrict the lookup, as application C needs access to both. Is it possible to prepend the application to the lookup or csv at search time - so that I know define which lookup I want to access? Something like: | inputlookup A::device.csv - I tried this and it didnt work 🙂  regards -brett ... View more

Hi, In the top menu at the Splunk level (black bar) there is a `Find` text box.  Is the contents of this made available as a token, such that I can use it in a dashboard ?   I want to change how this field works within certain applications, so it can be used within a search in my dashboard and not used by the Splunk Application its self. tia ... View more

Hi, I have a query which I am not sure why its not working, Assume I have the following JSON record, which has been extracted at index-time index: network sourcetype: devices record: { "deviceId" : 1234, "hostName": "Router1} 1. index=network sourcetype=devices deviceId=1234 => works as expected 2. index=network TERM(sourcetype::devices) => works as expected 3. index=network TERM(sourcetype::devices) deviceId=1234 => Fails, returns 0 records 4. index=network TERM(sourcetype::devices) earliest=-7d@d => Fails, returns 0 records 5. index=network sourcetype::devices deviceId=1234 => works as expected 6. index=network sourcetype::devices deviceId::1234 => works as expected 7. index=network sourcetype::devices deviceId::1234 earliest=-7d@d => works as expected The real question is, why do queries 3 and 4 fail, when the others work, especially when I can see that query 2 works and returns the correct data. What impact does TERM() have in the process flow, such that earliest and = make it fail ? cheers -brett ... View more

Hi, I tried to find this in the docs, but no luck, more than happy to RTM if someone has the link. On the black menu, top right, there is Help, with Sub Menus of: ... Tutorials Help with this page File a bug ... I want to change where these either point to, or want to be able to leverage the link they point to; for example Help with this page : Where do I put my own docs so they will be used ? File a bug: I want this to point to my Jira Tutorials : I want this to point to a wiki or sharepoint or ? Cheers -brett ... View more

When running an external script, where is the executable defined ? That is, it always seems to call /usr/bin/perl and I want it to use a different installation. Is the location of perl defined in a configuration file or is it taking it from the splunk-users environment ? ... View more