You could also make use of an automatic lookup table. So have a csv file with the following: UniqueID,Output A,A B,B C,C D,5 Splunk will find the UniqueID and rename it to whatever is in the "Output" column. So you can totally rename any field you like. There's a tutorial here: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Usefieldlookupstoaddinformationtoyourevents to walk you through automatic lookups. I've only recently started using them, but they save a lot of hassle and shortens search strings drastically. If you need any help, just ask. 🙂 ... View more

Hi, thanks for the suggestion. I tried this, but it didn't make a difference. I was using the transpose command to make the table look neater, but this seems to cause problems when using it in conjunction with alerts. I removed the transpose command and it started to work, but the e-mail from the alert isn't in the format I showed in the question. I suppose it will have to do! Service 1 | Service 2 | Service 3 | Service 4 | Service 5 OK | Error 400 | OK | OK | OK ... View more

so.. eval StepName = case(HTTPRequest="GetLoginPage","GetLoginPage",(HTTPRequest="PostLoginPage" and HTTPRequest="ProcessUserDetails"),"PostLoginPage",HTTPRequest="GetHomePage","GetHomePage") so it's case(name of fields you wish to rename/combine,"new name",name of fields you wish to rename/combine,"new name".......) ... View more

I would suggest searching the documentation for eval(case). I had a similar issue and this was a suitable workaround. If you need any more help, let me know 🙂 ... View more

Hi Kristian, Thanks for your help. That is exactly what I was after. Only thing is, I want to raise the first row of the results to become the column headers so that user 1 is Row 1, user 2 is Row 2 etc. Any ideas on how to do this? Thanks 🙂 ... View more

The only thing I've been told by the after-sales team is that it's due for release in Q4, but I wondered if anyone knew an exact date.. ... View more

Thankyou so much!! 🙂 ... View more

Try this: NAS Usage False 2 dashboard "" All True filer_setting Select a Filer: True index=usagereport sourcetype="nasoverall" | top 20 Filer Filer Filer filer_setting stringreplace $target$ splunk.search.job True 10 Total NAS Usage by Filer index=usagereport sourcetype=nasreport_log Filer_Name="$filerName$" | rename Aggr as "Aggregate", Volume_Total as "Total Allocated", Volume_Used as "Used Space" | table Volume "Total Allocated" "Used Space" "Aggregate" | sort +Aggregate line 100% 300px ... View more

It's when Splunk doesn't recognise the view as valid. This could be because there are unsupported modules/parameters in your code. It's probably worth looking through it and making sure everything is there that needs to be. Maybe post your code and I'll have a look when I've got time? ... View more

I've done this myself very recently. You would assign a search to the drop down menu to populate it. I would suggest using something like | TOP 10 Filer (depending on how many filers there are) as this would speed up the population of the drop down. Here is some code that I've put together to help you. If you have any questions, please ask! NAS Usage False 2 dashboard <!-- ^ This displays the usual stuff at the top of the dashboard!--> <!--This will be a static option which selects all Filers!--> All True filer_setting Select a Filer: True index=usagereport sourcetype="nasoverall" | top 20 Filer Filer Filer filer_setting stringreplace <!--filerName is used as the name of the filer to substitute into your search string!--> $target$ Total NAS Usage by Filer <module name="HiddenSearch" layoutPanel="panel_row1_col1"> <!--Your search which is populated from the dropdown!--> <param name="search">index=usagereport sourcetype=nasreport_log Filer_Name="$filerName$" | rename Aggr as "Aggregate", Volume_Total as "Total Allocated", Volume_Used as "Used Space" | table Volume "Total Allocated" "Used Space" "Aggregate" | sort +Aggregate</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <module name="FlashChart"><!--Displays chart!--> <param name="width">100%</param> <param name="height">300px</param> </module> <module name="JobProgressIndicator" /> <!--Shows loading bar for results!--> </module> </module> </module> </module> ... View more

We've converted the inline searches to saved searches and that's freed up a lot of resource and our offshore guys can have access to that dashboard at the same time. thanks for your advice 😄 ... View more

With the useHistory option, does the search have to be a saved search? Ours are embedded in the XML for the dashboard. How does postprocessing work? Thanks ... View more

What if upgrading the system isn't an option? Is there a way of specifying that once a dashboard has been opened by User 1, all other users who wish to view the same dashboard will see the current real-time searches running for User 1. Almost like a screen capture tool works. ... View more

Thanks again for your help 🙂 ... View more