Hi everyone, I have a dashboard input with ~40 options. I could set this to a Dropdown which would work fine, but ideally want to keep it as a radio button and split the many rows across a couple columns.
The inputs are different events across the week with a variety of start times, and if I can I would like to split it up into 5 columns, one for each workday of the week, that way they are nicely sorted, and all still visible.
If there is a way to edit the xml source to split the radio button choices into custom columns, or even just to split them into a couple columns automatically, that would be great, thanks!
... View more
Hi, I have a couple searches where the main search can be limited a fair amount, lets say the last 2 weeks, but I have a subsearch that requires searching across all time, albeit on a small dataset.
Currently I handle this as follows:
| where _time < relative_time(now(),-14d)
| join type=left userId
| table userId userProperty]
| where userProperty = X
With the time picker set to All Time. The SmallSource contains some user Properties tied to creation date of the user, so I need it to search across All Time, but this slows down the main search which must now search every event across time despite only needing the last 2 weeks!
Is there a way I can make this more efficient? I'm fairly new to Splunk so I'm not sure if I can put some of this info in another search, like a report I can reference, or if there is another way to restrict time more efficiently than this.
... View more