I am having this same problem. Maybe I can add some clarity to the specific problem with a specific example. This is my search (minus the host data):  source="WinEventLog:Security" Keywords="Audit Failure" Failure_Reason="Unknown user name or bad password." | top Account_Name Looking in the events it returns, about 70% of the events have this: Account Name: - As well as: Account Name: actual user account name So when it outputs as a bar chart, the account name '-' shows as the largest, because it totals up every result that has that name in it, but it then also lists out the actual user account names. So the data is all listed twice in effect. But doing =! to the '-' user name ends up excluding the bulk of my other results, the info I am trying to track. Obviously this isn't the end of the world, I could just ignore that, but it does skew my bar charts a bit. ... View more

what kind of data is it that you're displaying -- raw events, tabular output, a flash chart? ... View more

Kristian, I just wanted to say thanks for the tip. I've been able to successfully use this method to do field extractions in some xml logs I'm working with. ... View more

Anything about openvas vulnerability scans in xml format ? ... View more

This was my bad. I apologize, this is a syslog issue. Thanks so much for your help. ... View more

Well the easiest way is to change the default app for users to your own app via; http://docs.splunk.com/Documentation/Splunk/latest/Admin/Setupbuilt-inauthentication#Add_and_edit_users From here you could select your App as the default. Each time a user sign's in this will be displayed. For a splash screen you are best editing the welcome/login page. http://docs.splunk.com/Documentation/Splunk/latest/Developer/CustomizeLogin Finally. You can remove all the links in the top right if you wanted to create a seamless look for your App, you don't even need to have a Splunk logo on it! Have look here for advanced customization options for the XML. http://docs.splunk.com/Documentation/Splunk/latest/Developer/AdvancedSearch If you wanted to run it outside of Splunk, then no. Not at the moment, it requires a browser to access as it is run from a Python based Web Server. ... View more

That worked perfectly! Thanks. ... View more