I have a solution that works beautifully to display the user's selected time zone on a dashboard. I typically display it in the label for the time picker and the X axis labels of all timeline visualizations. Step 1. Make a hidden single value panel that pulls one event (usually just looking back one second is enough). Step 2. From that one event, first I get the _time field (which HAS been offset by the user's TZ preference selection). Step 3. Then I do your own extraction of the timestamp from the _raw event (with a rex command) this time has NOT been shifted. Step 4. Then I subtract those two times to see how far from GMT they the user has shifted their data. Step 5. I then use a case statement in eval to convert the time offset to a user friendly string. For example, a -8 hour shift from GMT might get converted to something like "Pacific time (GMT -8h)" Step 6. Display the desired timezone string in the (hidden) single value panel. Step 7. I add some XML to save the value in the panel to a token. Step 8. Use that token where ever you desire to display the user's selected time zone. Beware of the fact that in some places you have two possibilities for any given offset (Daylight savings time and standard time). I usually account for that in my case statement (Step 5) by rather crudely assuming that Nov-Feb are Daylight Savings time and the other months are not. (This works for my location but might need to be tweaked for your location. I can provide some sample XML to get anybody going in the right direction. ... View more

I downvoted this post because using value=* does not quite address the scenario. imagine a systems with thousands of host values. my dynamic search in the input will find at most only 20 of these thousands of hosts. but on any given day, it will find only a subset of those 20 host values... if today it finds only 4 host values, i'd like the default value for the input to be only those 4 hosts (not host=*). tomorrow the default might be some set of 7 host values... i'd find this very useful if there is a way to do it in simple xml. thanks! ... View more

Sure. just add this to your query earliest=1/1/2017:0:0:0 latest=1/1/2017:23:59:59 yourSearchTerms | stats ... Edit: Sorry, upon a re-read I am guessing that you want to add that fixed time range to the Presets menu of the standard Splunk Time picker input. I'm not sure how to do that but you could create a drop down of time options that contain the same Preset selections as the standard time picker. ... View more

Seeing an example of a set of three events would help, but if I understand correctly, then that this might work. yourQueryThatPullsOnlyTheDesiredEvents | stats values(_raw) AS _raw BY userId transactionId This will give you userA txnA _raw userA txnB _raw ... View more

This might be kind of clunky as I am a bit of a beginner as well... I suggest adding a second column to your CSV file (I recall the documentation saying that a csv file must have at least 2 columns anyway.). Like this DOMAIN, FLAG company.com,0 comp2.com,0 comp3.com,0 The value in your new, second column is the same for every row (in this example "zero") | inputlookup whitelist_domains.csv | rename DOMAIN AS domain | append [search yourQueryHere | stats count BY domain] | stats sum(count) AS Count, values(FLAG) AS Flag BY domain | where isnull(Flag) This will give you a list of the domain that are not in your whitelist (along with a count of events if you care) ... View more

Thanks cmerriman! That looks like it might be promising. I'll create one "view only" user that can be used in all dashboards then also suppliment the url with the hideChrome, hideEdit and hiseFooter options... Thanks again. I have hope. 🙂 ... View more

That's a lot of activity about a link which is not relevant to the original post. The post is asking for a way to embed an entire dashboard, and it explicitly says that it is NOT asking about how to embed any one scheduled report. 🙂 I too would LOVE to see this feature. I have hundreds of dashboards and every one of them has multiple panels. At least in my situation, it isn't feasible to create hundreds (probably over a thousand) scheduled reports, then convert every single panel in every dashboard to then rely on the appropriate scheduled report, then individually embed every single panel so that I can take these thousand or so iframes and embed them into web pages...ugh. Every time I see activity on this thread I get excited thinking that maybe somebody has come up with a clever way to embed a dashboard (not just a single report). But alas, not yet. ... View more

Try a variant of this. | rex "(?<json_blob>{.*})" | spath input=json_blob You might need to tweak it a little to deal with the square brackets, but the idea is that the rex function isolates the json and then the spath parses out all the values. ... View more

More generically, put a | fields * at the end of the base query. This will make certain that you have all the fields you need for all the other panels that might reference that base. ... View more

Absolutely need this. I have hundreds of dashboards that I would like to embed. Each dashboard has from 2 - 20 panels. With the current limitation of only being able to embed reports, I would have to manage many thousands of saved reports rather than only a few hundred dashboards. This unfortunate limitation is driving me to use Tableau for publishing visualizations when I would really prefer to use Splunk. ... View more