OR run <splunkweb>/en-US/debug/refresh ... View more

Old question, but needs a better answer 🙂   You can use a non-breaking-space  alt 255 Here you have 10 of them between START-END START          END   So if you like nice space between one field combined from two. add enough blank at end and then cut all equally long. | eval eventid=eventid."                  " | eval eventid=substr(eventid,1,29) | eval message1=eventid.message ... View more

anyone can help for this topic ? ... View more

yes i have this app but there is nothing around my question. so thx for your reply ... View more

well no need to resolve i just replace by var url = TokenUtils.replaceTokenNames("dbDestination?tokenValue=" + value1, _.extend(submittedTokenModel.toJSON(), event.data), TokenUtils.getEscaper('url')); utils.redirect(url, false, "_blank"); thx for your help rjthibod ... View more

i know i should to create my own css and javascript but i can't change the other values. and how what i insert into my javascript and css? i look about rangemap javascript but this example don't help me to change only value3. the content of value1 to valueN shouldn't change this is my problem and don't forget i have a search with a command |transpose also the rangemap accept numeric value for range, and the content of value3 is alphabetic. ... View more

There is some pretty clear example code here - http://dev.splunk.com/view/webframework-codeexamples/SP-CAAAE5V ... View more

Below is an example code for simple search and return progress but no oneshot. http://dev.splunk.com/view/webframework-codeexamples/SP-CAAAEVT ... View more

One thing to consider when looking at the different examples is do you want to constantly instantiate a new window or do you want only one modal window object. The first example from Hurricane Labs creates and destroys the window every time you trigger it. The last example from my latest app instantiates the modal window a single time for each dashboard. This allows me to keep the user input fields and search results tables between activations without triggering new (unnecessary) searches. ... View more

If you have setup Roles and Users from Settings -> Access Controls in Splunk then, all you need to do is set Permissions against each Dashboard/Reports/Alerts and Based on the need Share it within App, and grant Read Write or no Access for specific users. Refer to the following documentation http://docs.splunk.com/Documentation/Splunk/latest/Viz/DashboardPermissions ... View more

it works perfectly, i not tried earliest=-2d thx ... View more

You have to create a Splunk role for these users and then give access rights to this role to the specific apps and objects in app. The best (and more secure!) way to do this is via GUI [Apps -- Manage Apps -- Show Objects] but it's very slow if your app has many objects (you have to manually modify one by one all of them). in this way, you could modify (with much attention!!!) $SPLUNK_HOME/etc/apps/yourapp/metedata/local.meta giving rights access to the new role: give role access rights via GUI to the first object in $SPLUNK_HOME/etc/apps/yourapp/metedata/local.meta modify the row (when exists) access = read : [ * ], write : [ admin, power ] with the new role, copying the correct Access Rights from the first object you modified via GUI in every stanza (each stanza is an App object); restart Splunk. Bye. Giuseppe ... View more

Hi sfatnass, Index your logs and create a custom sourcetype, for example, named mylogs. Then create custom search-time field extraction: Edit $SPLUNKHOME/etc/apps/search/local/props.conf: [mylogs] REPORT-mylogs = mylogs Edit $SPLUNKHOME/etc/apps/search/local/transforms.conf: [mylogs] DELIMS = "#" FIELDS = name date ip ua status acted numact Reload your configuration files through http://your_splunk_web_url:8000/en-US/debug/refresh , and your logs will have the correct fields extracted. Hope it helps. Thanks! Hunter ... View more

no just get logs only for today ... View more

You can mark the entire answer as the answer. Everyone will know to read the full thread. ... View more

I have similar submitTokens but in my auto-generated HTML source I found this near the bottom of the file: // // VIEWS: FORM INPUTS // In here is how I changed it. I'm not sure what some of the inputs are as my dashboard has 5 inputs (4 dropdowns and 1 submit button) but the HTML code has 6 inputs. Here is an example of each type: var input1 = new HtmlElement({ "id": "input1", "useTokens": true, "el": $('#input1') }, {tokens: true, tokenNamespace: "submitted"}).render(); DashboardController.addReadyDep(input1.contentLoaded()); input1.on("change", function(newValue) { FormUtils.handleValueChange(input1); }); var input3 = new DropdownInput({ "id": "input3", "choices": [], "selectFirstChoice": false, **"searchWhenChanged": false,** "labelField": "values(tag)", "showClearButton": true, "valueField": "values(tag)", "value": "$form.tag$", "managerid": "search8", "el": $('#input3') }, {tokens: true}).render(); input3.on("change", function(newValue) { FormUtils.handleValueChange(input3); }); I found that if you have multiple inputs and if any of them have searchWhenChanged=true, then the whole thing kicks off. ... View more

Limits are controlled through limits.conf. I've never been able to ID a corresponding setting. ... View more

It can be faster when you're searching for the fields involved yes. ... View more

You can save a Hunk search as a report, and schedule it to run with any frequency you like. However, you still won't be doing a true real-time search, for a couple reasons. One is that processes which write data to HDFS usually have some latency, i.e. the data does not show up quickly enough to be considered "real-time". Secondly, map-reduce jobs are typically high throughput but high latency, so the job itself may introduce a large delay. Also, please consider that if you schedule a search to be very frequent, it may take up considerable resources that will then not be available for other activity on your cluster. You should consider instead using Report Acceleration: https://docs.splunk.com/Documentation/Hunk/6.4.3/Hunk/Workwithreportacceleration If you truly need real-time searches, consider first ingesting your data into a regular Splunk index, and then archiving the data to HDFS: http://docs.splunk.com/Documentation/Hunk/6.4.3/Hunk/ArchivingSplunkindexes ... View more

you are welcome 🙂 ... View more

i think i will do a full jquery script to create a beautiful home page for my app. i use 3 dahsboard. i just to check some idea ^^ ... View more

wow it worked 🙂 Thank you for the fast reply! ... View more

no one have an idea? ... View more