Hi according to the suggestion, I have tried out and successfully getting the expected behavior that only "admin" role users can have the options to do "Open in Search"/"Export" and etc... Amend the SPL search accordingly to what you desire to achieve <!-- Running searches and gaining role value for current user --> <search> <query>| rest /services/authentication/current-context | search username!=splunk-system-user | fields roles </query> <earliest>-15m</earliest> <latest>now</latest> <done> <eval token="search_visible">if($result.roles$=="admin","true","false")</eval> </done> </search> <!-- Running searches and gaining role value for current user --> <!-- selectively disable only exporting fucntion --> <!-- admin role can export, other roles can't  etc etc..--> <option name="link.exportResults.visible">$search_visible$</option> ... View more

Thank you very much for this tip. It doesn't work for me on 8.2.0 in type="multiselect" 😭   ... View more

I realise this is a post from 2016, but I noticed that the <input> uses a <default> value rather than the recommended <initial> value per the Splunk docs (for the current version of 8.2.3), which may help others while troubleshooting this or similar issues on newer Splunk versions. https://docs.splunk.com/Documentation/Splunk/8.2.3/Viz/FormEditor#Configure_input_value_handling ... View more

The css option is a good one, however this potentially requires you to add this css to all the dashboards in your app. Another option is to add the following to your dashboard.js file (that gets loaded by default on all dashboards in your app): document.getElementsByClassName('edit-other')[0].style.visibility='hidden'; Remember to bump after changes to javascript.  ... View more

Restarting with      http://debug/refresh      worked when editing files outside of Splunk Enterprise 8.0.6.   If I edit the file directly in (\default\data\ui\views\) and then click on the App in the upper left corner of the screen under 'Apps', the display content for the modified file is not updated. Confirming what @DanMurad posted.   ... View more

hi am also searching for this type of problem please help for this .my question links are:: https://answers.splunk.com/answers/592116/related-to-tokens-in-multiselect.html https://answers.splunk.com/answers/593597/developing-a-splunk-app-and-it-doesnt-work-on-mobi.html ... View more

Thanks!! its working for me:) ... View more

This works well. Thank you 🙂 ... View more

If you are using v6.5, there is a new token filter to force no encoding: <link>https://somewhere.co/?reportRepositoryKey=$click.value|n$</link> ... View more

You can also style using xml options: <chart> ... <option name="charting.backgroundColor">#475565</option> <option name="charting.foregroundColor">#EBF5FF</option> <option name="charting.fontColor">#99CCFF</option> </chart> Which should result in something like this: ... View more

Note, that if your saved-search is a scheduled report, then the and tags do not apply in the dashboard -as far as I can tell anyway. All of the data created by the scheduled search over the scheduled time-period is displayed. If you remove the schedule from the saved search, then the "earliest" and "latest" tags will be applied in the dashboard as described above. ... View more

Searches within dashboards are run in "fast mode", which means that only those fields that are explicitly referenced within the search are available as selected fields in the result set. To ensure that you pass the necessary fields from a global search down to the post process searches, you will need to use the "| fields" command with the list of fields needed. As a shortcut, you can also use "| fields *" to pass all fields as selected fields. So your search could look something like this: <searchTemplate>index=_internal log_level="ERROR" | fields *</searchTemplate> ... View more

Thanks, this worked just as expected. ... View more

It works but the width that i want to change is not the panel but inside panel. I want to change the group inside the panel. How can i in a row change the width of the groups? ... View more

This gave me what I wanted. Thank you! ... View more

Thanks for the clarifications. Unfortunately this isn't an instance I have control over upgrading, so I'll write it off for now. ... View more

That worked! Thanks! ... View more

Converting those js/css files to dashboard.js and dashboard.css will result in those files being loaded on every Simple XML dashboard. Not sure that that is what you want here. As of Splunk 6, Simple XML now supports both app-level as well as page-level customizations via JS/CSS. - App-level: All Simple XML dashboards will load dashboard.js and dashboard.css if these files exist within your appserver/static/ directory - Page-level: You have the option load custom js/css for that specific page by explicitly including it in your top-level xml element. ... View more

Hello I tested this, and in Splunk 5 doesn´t works if you hide the field with the "fields - fieldname" command. Althougt it works fine without hidding the field... Does you solution works in Splunk 6? Regards ... View more

Yes its a good example. But can we add another icons ????? like icon-power, icon-battery-1, icon-closethick .... present in this page http://api.jqueryui.com/theming/icons/ Thank you for your answer. ... View more

+1 for requesting this feature. It seems odd that maps don't support this feature while others do. ... View more

Upgrade to 6.0.2 Maintenance version and then use options mentioned in the accepted answer. The property is not present in documentation though. ... View more

So in this case, you probably don't need any default here as the suffix will do what you need. ... View more

rakesh - that's a good question but you'd be better off posting it as a new question rather than a comment on this one. ... View more