The above response will works for me.  We can get our base search job id  into "sid"  token.  Then we can use  "| loadjob  <sid of search>"  splunk command to run our panel without make it base search.   <search id="basesearch"> <query>| makeresults count=1 | streamstats count</query> <done> <set token="sid">$job.sid$</set> </done> </search>       <panel> <title>Dashboard panel without use of basesearch</title> <table> <title>Can export</title> <search> <!-- Remove base="<BaseSearch>" from here --> <query>| loadjob $sid$ | search "user your query here.." </query> </search> <option name="drilldown">none</option> </table> </panel>     ... View more

Hi , Am using Splunk Enterprise Version:7.3.3. Still cant see drop down option for my saved search report even though I use below lines in my savedsearch.conf file.   action.summary_index = true auto_summarize.dispatch.earliest_time = @w0 ... View more

My working solution... My solution ended up being as follows slightly different to what Giuseppe suggested but since he gave me the clue I needed so he gets qudos. Below initialises the host field from the OS. transform init host copies the host to another field called log_host transform overwrite changes the host to be a value found in the the source path It seems to work and I guess has a dependency on the transforms sequence. inputs.conf # nothing special here as taking the hostname from the OS props.conf TRANSFORMS-init_host = init_host TRANSFORMS-override_host_from_logs_dirname = override_host_from_logs_dirname transforms.conf [override_host_from_logs_dirname] SOURCE_KEY = MetaData:Source REGEX = \/(\w+\/){1}logs\/(\w+)\-log FORMAT = host::$2 DEST_KEY = MetaData:Host [init_host] SOURCE_KEY = MetaData:Host REGEX = host::(.*) FORMAT = log_host::$1 WRITE_META = True ... View more

Right!... easy to avoid. ... View more

The alert is displayed when a user login (image above), you have to specify some parameters in the authentication.conf (https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/Authenticationconf), to do so : declare the stanza splunk_auth and modify the following keys : [splunk_auth] minPasswordLength = 8 minPasswordUppercase = 1 minPasswordLowercase = 1 minPasswordDigit = 1 minPasswordSpecial = 1 expirePasswordDays = 20 expireAlertDays = 42 expireUserAccounts = True forceWeakPasswordChange = True lockoutUsers = True lockoutMins = 30 lockoutAttempts = 3 enablePasswordHistory = True passwordHistoryCount = 5 ... View more

Yep - rex can be your friend. Many thanks for taking time to respond today. Much appreciated. ... View more

Trellis got introduced in 6.6. Since, you are on 6.5 you can remove the lines with validation error (Do check out trellis example it is a cool new visualization feature). For reducing the size of Single Value font, you have two options: Option 1) Simple quick fix is to reduce the Single Value Panel height which reduces Font Accordingly. Following is Simple XML code for the same <option name="height">100</option> Option 2) Through CSS you can override font-size of specific/all single value results using !important in CSS (add to existing Style section). .single-value .single-result{ font-size:75% !important; } PS: You will have to make changes as per your need. I have give percent option so that you can easily change and understand impact. Absolute numbers are displayed in HTML Panel with their respective CSS Styles you can override as per you need. Finally color ranges (grey) as you have intended can also be done via UI. I think currently since it is on Percent Trending it should be Grey for 0%. ... View more