I'm sorry I misinterpreted your requirement, I did not realize the click value was the name of the dashboard you were trying to link too. You may be able to accomplish this through javascript with something like this. Not 100% sure on this though: require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { var CustomLinkRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return cell.field === 'column_name'; }, render: function($td, cell) { var link = cell.value; var a = $('<a>').attr("href", "/app/search/"+cell.value).attr("target", "_blank").text(cell.value); $td.addClass('table-link').empty().append(a); a.click(function(e) { e.preventDefault(); window.open($(e.currentTarget).attr('href')); }); } }); // Get the table view by id mvc.Components.get('table_id').getVisualization(function(tableView){ // Register custom cell renderer tableView.table.addCellRenderer(new CustomLinkRenderer()); // Force the table to re-render tableView.table.render(); }); }); ... View more

You need to tell it which dashboard (or view name) to go to in this case. As an example if I had a dashboard called my_example_dash that took an input named examplein it would look something like this: <drilldown> <link> <![CDATA[/app/search/my_example_dash?form.examplein=$click.value$]]> </link> </drilldown> This documentation page may help clarify a bit more: http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/Dynamicdrilldownindashboardsandforms ... View more

It looks like you attempted to use CDATA tags but didn't quite get the syntax right. Try this: <drilldown> <link> <![CDATA[/app/search/$click.value$]]> </link> </drilldown> ... View more

Splunk reccomends that you use a trace listener to send logged events to splunk, either through TCP/UDP or to the new HTTP event collector. You can use some frameworks that are pretty popular such as log4net to send logs directly into Splunk. This documentation page details it pretty well: http://dev.splunk.com/view/splunk-loglib-dotnet/SP-CAAAEX4 ... View more

What that command is doing is a field extraction using a regular expression. I did not test the one I wrote above against your data so it may be off. Have a look at this page which may help: http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/rex ... View more

You would want to use a regex to extract the field in this case, something like this would extract it to be used in subsequent searches in the pipeline: | rex field=_raw ".*RESPONSETIME:(?<ResponseTime>.*)\*|.*" Would add the response time to a field called ResponseTime for you to work with. ... View more

I believe what you are looking for is this endpoint: http://docs.splunk.com/Documentation/Splunk/6.2.5/RESTREF/RESTdeploy#deployment.2Fserver.2Fserverclasses You would use the post method to create a new serverclass on: deployment/server/serverclasses To modify you would use the post method on: deployment/server/serverclasses/{name} Hope this helps. ... View more

I'm not sure if you are using the Splunk SDK for C# or not. However if you are there is a class called JobArgs that the CreateAsync method will accept which allows you to specify the earliest and latest time. Here is an example of the creation method using the class: Job job = await service.Jobs.CreateAsync(search, 0, ExecutionMode.Normal, new JobArgs{ EarliestTime = "@d", LatestTime = "now"}, null, DispatchState.Running).ConfigureAwait(false); ... View more