It happens in chrome's incogneto mode too. I think the problem is with the page. There are areas south of that button that dismiss the context menu. ... View more

mssql does care about their end users. Their place to submit bugs used to be called microsoft connect. Now they have a new thing. And yes I think you can generally expect that the people who get paid to write the software would be interested to know when basic functionality doesn't work. If it was my software I would find things like broken links and broken menu options embarrassing and feedback related to those things would be appreciated. Our environment is taken care of. It's just that neither he nor I want to spend months playing telephone. And after looking into it, I now know that the app thing doesn't matter at all. The menu option is broken on the new search view regardless of the app it is on. I can now think of no software-related reason for people to not know about splunk's search page. ... View more

That is true. I don't blame him though. The person at my company is busy doing things. I also didn't particularly want to play the game of telephone either. And I don't know if I agree with this. My company also uses datadog. There was a bug in their UI. I submitted a ticket with them and they fixed it in what felt like less than a day. It was actually kind of concerning... I hope they have good unit tests. I get the impression from them that they care a lot about problems their end users experience using their software. Anyway are we sure that the story here is that there is no way to give feedback directly to splunk? That if there is a bug or a security vulnerability then the best place to direct that is this website (essentially a subreddit I guess) or a trash can? That end users aren't really customers so they can bring it up at their next support group or something? I'll check out that course but if it turns out that the app doesn't matter because this search page is the same in every app and there isn't a good reason people don't understand when I refer to a "context menu that appears when you click a value in the search results" or "the 'new search' option in the context menu"  then in my mind it will seriously call into question how much splunk actually gets used by people. ... View more

Well maybe you can point me in the right direction then? At work I find very basic and frustrating problems with this software. For example I frequently click on a context menu in splunk that says "new search" to start a new search on a specific piece of information from the results of a previous search. The query that splunk creates is akin to this "* | spath source | search source=app-name". This query is very slow. I believe the query splunk should make should look like "source=app-name". I explain this to someone at work. They explain it to a splunk support person. The support person says that the query is slow... He gives plenty of detail for why the query is slow. When I ask if I could talk to them I'm told I'm not on the support contract.. This is months of interactions here. There doesn't seem to be a path forward here where I can make it understood that I think the problem is that splunk shouldn't generate these queries. Ok. What about this website? How hard can it be to file a bug? I'm sure splunk wants to have working softare. I made an account. The only place to give feedback seems to be an option to make a support case. That links here. I've been making support cases here ever since. In truth I think part of the problem is that I don't know what everything is called. I might be using a page that most people don't normally see. I don't really know what "apps" are or what ITSI is. They all seem to let me search. When I explain the problem to people it never seems to connect so we must just be looking at different things. All I know is that I'm performing searches in an app called IT Service Intelligence on a page that looks like the image here: https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/Startsearching except that the events are made to look like json. What should be my next step? Is there one? Is there any avenue for end users to report problems or is support at splunk really just for the b2b contacts at my company that saddled us with these problems in the first place? ... View more

What is ITSI? This is the context menu. Find any string value that takes up enough space to be cut off at the top and bottom of the web browser and click it. This pops up and moves the scroll away from what you would have been looking at.   ... View more

This is the context menu. It appears when clicking on absolutely any value when using splunk to search logs. The queries it produces are really slow.   ... View more

yes * is really the first part of the search Is this not a search option that everyone has? ... View more

The context menu appears when I'm on the search results page. If I click on one of the event's values like ERROR in severity: ERROR then the context menu appears and gives three options. "Add to search", "Exclude from search", and "New search" with little icons that will open it in a new tab. I guess it's under itsi. Here is the URL path: /en-US/app/itsi/search ... View more

In the list of fields on the left side you can click them and click on the "Top Values" report to get a breakdown of the top counts for the field you select. It basically just adds "| top limit=20 x" to the end of your query where x is the field you clicked. If I want a count of how many errors are coming from each app I would use that to make this query: severity=ERROR| top limit=20 source ... View more