Hello, I am trying to implement a function which triggers by the change of a token's value. Splunk's framework has a method for this, as documented here: http://dev.splunk.com/view/SP-CAAAEW4 Unfortunately, they documentation is very sparse and the example they give only confuses me further. The function which fires on a token change is supposed to accept the arguments ( model, value, options ). In the example, the model that they pass isn't defined anywhere on the page. When I tried putting in a model that I thought was relevant (a search manager which relies on the token) the page threw the error "Uncaught TypeError: Cannot read property 'query' of undefined ". Also, the second argument seems likely to throw another undefined error, since no variable with the same name as the token has been declared. Moreover, the documentation doesn't specify any of the "options" that can be passed in as a third argument. Can anyone point me to some better documentation, or clarify this for me with a better example? Thank you! ... View more

Hello, In the PostProcess Search documentation it says that non-transforming searches which return raw events have a 10,000 return limit. It is unclear if a transforming search still has this limit. If I run a stats command that returns 15,000 rows for example, will post processing still truncate the data? Documentation: http://docs.splunk.com/Documentation/Splunk/6.1.2/AdvancedDev/PostProcess ... View more

Hi there, I am trying to use a single element panel as a key for understanding the other single element panels which contain some concatenated data. I just want to put the string "Count of Orders | Average Time | 95th Percentile of Time" inside this box. I have tried the following queries as the input: fieldformat string = "Count of Orders | Average Time | 95th Percentile of Time" eval string = "Count of Orders | Average Time | 95th Percentile of Time" with <option name="field">string</option> to set the variable as the input. I appreciate any help or comments! ... View more

I’m trying to get rid of the refresh time indicator on a single value element panel. I’m reading the documentation here which says that the option is refresh.time.visible. I have done the following: <single>       <title>Sign Orders</title>       <searchPostProcess> where concept="sign_orders:"</searchPostProcess>       <option name="refresh.time.visible">false</option>       <option name="field">count</option> </single> Any clue what I’m doing wrong? I know I am setting false correctly in the first example, according to other examples given in the documentation. ... View more

Hello, What I am trying to do is create a customized HTML dashboard that renders a box with some statistics in it for each result returned from a search. I am using the Data Template as documented here: http://docs.splunk.com/DocumentationStatic/WebFramework/1.0/compref_data.html (it is better documented in the web framework app, but I don't know where to find an online version of that to link https://apps.splunk.com/app/1613/). So far it works decently well, I can get the template to print out the categoryID and count, but the other fields generated by stats (like avg(price)) are not being passed. I am working with the demo data that the Splunk tutorials give you. Whenever I do a JSON.stringify on the line var, it only has the fields categoryId and count. UPDATE: I have tried a few more stats functions like distinct_count and also a rangemap. It passes the rangemap value perfectly as line.range, and it also passes a line.distinct_count(price) but it is always a zero, even though the actual search has actual results. Something very strange is going on here. Here is my code: tag openings removed to make them display properly ... {% block content %} script type="text/x-underscore-tmpl" id="top-artist-search-template" style="display:none"> div id="box-wrapper"> <% for(var i=0, l=results.length; i < l; i++) { var line=results[i];%> div class="box" > h2 class="profile" > <%= line.categoryId %> div><%= line.count %> div><%= line.avg_price %> div><%= line.perc95_price %> /div> <% } %> /div> /script> {% dataview id="table-top-artist-searches" managerid="search-top-artist-searches" templateName="top-artist-search-template" %} {% endblock content %} {% block managers %} {% searchmanager id="search-top-artist-searches" search='sourcetype=access_* status=200 action=purchase | stats count, avg(price) as avg_price, perc95(price) AS perc95_price by categoryId | sort avg(time) desc' cache=True %} {% endblock managers %} ... View more