I try to modify the flashtimeline to remove the app dropdown list on the right hand side upper corner or just leave Getting Started, Home and Search apps in there. I cannot find which module and what parameter i should use. Thanks in advance. ... View more

I have question about saved searched in the navigation menu. Let say if have more than 20 users and they have permission to saved their own searches. How can I configure the nav. menu so it will dynamic group saved searches by user. I help users build dashboard using my own saved searches. When users login and click on the saved searches, most of them are belong to me. Is it possible to hide them from user but only visible to admin? I cannot make them private because the dashborad used the saved searches. From the link below, we can build a custom css, (http://docs.splunk.com/Documentation/Splunk/latest/Developer/UseCSS). Any one has an example\command how to hide collection of label by role? Thanks ... View more

I have created a summary index, from the following query (i called it base query), and the summary index configured to run every 15min, time range is -17 to -2 mins. source= | sistats avg(response_time) count by source, server_name, status_code, application When i compare the result between the summary index and the base query in the same period, like yesterday with\without the 15 mins windows adjustment. There is a huge difference in the results, it does not matter count by source, server_name, status_code or application by itself. source= | stats count by source vs index=summary search_name="summary_web_sistats" | stats count by source What i did wrong here? Does anyone have the same issue using summary index? Thanks in advance ... View more

In our environments, we have a standard naming convention for the servers. For example, Front End servers: AppFE01_CA, AppFE02_NY Middle tier servers: AppMT01_CA, AppFE09_NY Back End servers: AppBE01_CA, AppBE08_NY If the source contains the cpus information for all these servers, how can I use eval, if and like funcation to get avg cpus by group. This statement works, sourcetype=serverscpu | eval host = if( host like "AppFE%CA", "FE_CA", "others")| stats avg(CPUs) by host but multiple like failed, I got invalid eval statement sourcetype=serverscpu | eval host = if( host like "AppFE%CA", "FE_CA", host like "AppBE%CA" , "BE_CA", "others") My goal is to get average cpus for front end, middle tier and back end servers by data center in the same graph. Thanks in advance. ... View more

I schedule report and recevie mail from the pdf report server. However there are 2 issues. I selected the results in email as csv option in the configuration but the csv in the mail has no data the bar graph in the pdf only showed half of the data set but the UI shows 24 hours. How do i change this pdf report to landscape format? I couldnt find any charting option for that. Thanks ... View more