Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About JohnMurphyAus
JohnMurphyAus
Path Finder
Member since:
10-03-2021
09-14-2023
Community Statistics
| Posts | 13 |
| Solutions | 2 |
| Karma Given | 12 |
| Karma Received | 0 |
| Member Since | 10-03-2021 |
Activity Feed
- Karma Missing Event/Field workflow from "Statistics" tab? for woodcock. 09-15-2023 01:23 AM
- Posted Re: Why is User is not allowed to modify the job error? on Getting Data In. 09-14-2023 11:23 PM
- Karma Re: Why is User is not allowed to modify the job error? for kakawun. 09-14-2023 10:34 PM
- Posted Re: Why is User is not allowed to modify the job error? on Getting Data In. 09-14-2023 07:14 PM
- Karma Why is User is not allowed to modify the job error? for kakawun. 09-14-2023 06:48 PM
- Karma Table Field Actions - Workflow actions for shinobu. 09-11-2023 06:21 PM
- Karma Re: restore a default file that is failing integrity check for andyfrank. 08-27-2023 06:37 PM
- Karma Clustermaps not loading properly using a base search for HaxUez. 08-20-2023 07:03 PM
- Posted Re: How would I design a role that only gives the ability to create (and search) indexes? on Security. 02-26-2023 02:52 PM
- Karma Re: What user role setting allows users to "Add Data"? for j_quickbase. 02-26-2023 02:24 PM
- Posted Re: How do I change the span based on the time picker selection using timechart? on Splunk Search. 01-05-2023 05:17 PM
- Karma Re: How do I change the span based on the time picker selection using timechart? for martin_mueller. 01-05-2023 05:16 PM
- Posted Re: Time Picker display not changing when the $token.earliest$ and $token.latest$ tokens are changed. on Dashboards & Visualizations. 01-04-2023 09:07 PM
- Karma Re: Time Picker display not changing when the $token.earliest$ and $token.latest$ tokens are changed. for acharlieh. 01-04-2023 09:07 PM
- Posted Re: Disable word wrap in custom apps table search on Splunk Search. 01-04-2023 06:18 PM
- Tagged Re: Disable word wrap in custom apps table search on Splunk Search. 01-04-2023 06:18 PM
- Posted Why does time picker display not changing when the $token.earliest$ and $token.latest$ tokens are changed? on Dashboards & Visualizations. 01-04-2023 06:12 PM
- Posted Re: Can't get past subsearch limit on Splunk Search. 07-14-2022 12:15 AM
- Karma Re: Can't get past subsearch limit for gkanapathy. 07-14-2022 12:15 AM
- Posted Re: Whats the splunk equivalent of SQL IN clause on Splunk Search. 07-14-2022 12:05 AM
Topics I've Started
09-14-2023
11:23 PM
Thanks @kakawun this worked. Happy to give users this temporarily. Hopefully Splunk will rectify this bug soon. If you can mark your own comment as an answer I would recommend that! Thanks again.
... View more
09-14-2023
07:14 PM
We have also started getting this issue after updating Splunk from 8.2 to 9.1. When I change user role to Admin, they can upload data, when I change back to previous role with the mentioned permissions, they get the same error "User is not allowed to modify the job". This must be a change in one of the roles in the update, but I'm just trying to figure out which permission is needed for this. My user has the following permissions which is what I read is required to add data: edit_monitor indexes_edit edit_tcp search But still no luck. Will update if I find the specific permission required.
... View more
02-26-2023
02:52 PM
You can add the "indexes_edit" capability to the role. This will allow a user to create and edit indexes.
... View more
01-05-2023
05:17 PM
Perfect. Thank you!
... View more
01-04-2023
09:07 PM
Wow! As simple as that! Thank you! Just to simplify. All I had to do was change my drilldown from this: To this: Now when I select a date column, my time picker changes! Thanks @acharlieh !!
... View more
01-04-2023
06:18 PM
This was actually a heck of a lot easier than it seemed. In the results pane, click Format -> Wrap Results = No This is auto saved for future searches. [face palm]
... View more
- Tags:
- This
01-04-2023
06:12 PM
Hi,
I have a dashboard with a column chart to display time ranges. I have set the drilldown to update the $timePicker.earliest$ and $timePicker.latest$ tokens within the dashboard. This works perfectly and there are no issues here.
The issue is that the display of the time picker does not change, it always just says "All time" even though the tokens are set to a one-day range.
As I mentioned, the whole dashboard recognizes the one-day range, all I need is the Time Picker display to also show this range. I have tried setting the default time range using the $timePicker.earliest$ and $timePicker.latest$ values, as you can do with a text input, but I have had no luck.
This is the code I have tried but didn't work.
This is the code for the column chart drilldown, which does work and changes the timePicker tokens appropriately.
This is the default screenshot when the app is loaded
This is a screenshot after a column is clicked in the bar chart. Note that everything changes due to the time picker tokens being changed, but the time picker display is not updated and still says "All Time".
Additionally, when I open the events in a search after I have selected a time column, the time picker in the search is displayed correctly. This is how I would expect the time picker in my App/Dashboad to display.
Pleease help!
Thanks,
John
... View more
07-14-2022
12:15 AM
12 Years later, still the only solution I have managed to find! Thank you 🙂
... View more
07-14-2022
12:05 AM
Splunk now has an "IN" operator. So you can simply add the following to your search: CAR_MAKE IN (BMW, Volkswagon, Ford) If your search values have spaces, it will need to be wrapped in quotations. E.g: CAR_MAKE IN (BMW, Volkswagon, "Mercedes Benz", Ford) I know its late, but hopefully it can help people looking for it now. Also, you may want to correct the spelling of Volkswagen 🙂
... View more
10-05-2021
10:38 PM
Update: I have had to use a bit of a workaround and added to the drilldown in the XML for my dashboard. To do this, I added "../search/" in front of each 'link' tag in the XML of my dashboard for the searches I want opened in the Search app. This basically goes back a directory (out of my custom app) and into the search directory (Search and Reporting app) and performs the search there. Hope this helps anyone else with the problem. It's a bit annoying having to add it to every link tag, however no other option was available that I could see.
... View more
10-05-2021
03:39 PM
Thanks again, however the table I want to affect is not part of any panel. as you can see in the screenshots and from my explanation of the problem, it is separate from my dashboard. It is the Search that comes with any new app created. I can't find any ID or any properties for this Search.
... View more
10-04-2021
04:36 PM
Thanks @ITWhisperer, but I have no idea where to add this CSS? I'm a bit of a noob when it comes to this side of Splunk. However, I have added CSS to my custom dashboard, because it allows me to edit it. I can't see anywhere that I can edit the Search within my app?
... View more
10-03-2021
10:14 PM
Hi Everyone,
I created a custom Splunk app, and when using the (un-modified) search dashboard within the app to produce a table, it is text wrapping most of the fields. I.e. single row fields are appearing on multiple lines. When I run the exact same search (literally copy and pasted) in the "Search and Reporting" app, the fields are not word wrapped and show on single lines as expected.
Is there a setting somewhere that I need to enable/disable in my app settings so that when running a search to produce a table in the Search dashboard, it expands the field width, like it does in the Search and Reporting app?
Screenshots Below. I basically want my search results in the custom app (first pic), to look like the search results in the Search and Reporting app (second pic), hopefully via a setting or something. Custom App Search
Search and Reporting Search
Thanks in advance.
... View more
