What would cause a command line query ( bin/splunk search "..." ) to return duplicate results over what the UI would return? ... View more

When performing a query that creates a summary report, the associated search.log file shows: ResultsCollationProcessor - writing remote_event_providers.csv to disk. Then two hours later reports: StatsBuffer::read: Row is too large for StatsBuffer, resizing buffer.  row_size=77060 needed_space=11536 free_space=153653063 This is soon followed by lots of ~min-by-min output of: SummaryIndexProcessor - Using tmp_file=/opt/splunk/..../RMD....tmp messages. What might be happening in that two hour window?  We are running Splunk Enterprise 9.1.1 under Linux. @koronb_splunk @C_Mooney  ... View more

In a modified  search_mrsparkle/templates/pages/base.html, we have a <script> tag inserted just before the </body> tag, as follows: <script src="${make_url('/static/js/abcxyz.js')}"></script></body> with abcxyz.js placed in the search_mrsparkle/exposed/js directory. The abcxyz.js file has the following code:   require(['splunkjs/mvc'], function(mvc) { ... } which performs some magical stuff on the web page.  But when the page loads, the debugging console reports "require is not defined".  This used to work under SE 9.0.0.1 (and earlier) but now fails under SE 9.1.1. Yes, we realize we are modifying Splunk-delivered code, but we have requirements that required us taking these drastic actions. Anyone have any ideas on how to remedy this issue? --------------------------------------------------------------------------- @mhoustonludlam_ @C_Mooney ... View more

When loading a Dashboard page in version 7.3.3 Splunk Enterprise, regardless of application, the css-loader.js JavaScript file is getting interpreted as having a MIME type of text/HTML when it should have the application/javascript MIME type. This results in the following console error: The resource from "https://......./js/css-loader.js" was blocked due to MIME type mismatch (X-Content-Type-Options: nosniff). This error causes a ripple effect resulting in an incomplete loading of the page. Please advise. ... View more

I would like to make some modifications to an application's default navigation menu bar once it is rendered. I can do this simply in dashboards and forms using the script tag, but I can't seem to find a way to do it for other pages (e.g., search page, report list page, dashboard list page, etc.). ... View more

When the query results are returned in a lengthy table, and the user has selected a "many visible rows" setting, when the user scrolls the table of results in a downward manner, I would like to see the table's column header freeze (dock) at the top of the window and subsequent scrolling of the table data slides under the header. When the user scrolls back up, I would like to see the table's column header become detached (undocked) when the table content reaches the top. This behavior is already available in the "Search" window when scrolling the events in the results table, so it should be a somewhat trivial matter of providing this capability to the dashboard designer. ... View more