I would like to display a textbox where users can enter the username and click on submit. The results to be displayed are saved search for the username,last 5 searches,Roles(from a lookupfile) and last login information. I am not sure the kind of Intentions to use and the ordering of the HiddenSearch and ExtendedFieldSearch modules. I just want the user to click submit once and replace the username field in all the searches to be replaced with the value from the textbox. ... View more

Given a splunk username how do i search for the following. The roles that the user has - The last 15 searches performed - Any saved searches ... View more

How do i find users who have never logged in.I have the total list of users available in a lookup file. ... View more

How can I add search bar (flashtimeline) to a simple dashboard. ... View more

How do I get a list of scheduled searches associated with user info. ... View more

I have file which has a set of all users and roles with the Splunk account.The file name is usermap.csv I am using the following query to get all users who have logged in the last 30 days. *index=_audit action="login attempt" info="succeeded" earliest=-30d | stats max(timestamp) by user | lookup usermap.csv user OUTPUT role1,role2,role3,role4 | eval role2 = if(isnull(role2),"", ", ".role2 ) | eval role3 = if(isnull(role3),"", ",".role3 ) | eval role4 = if(isnull(role4),"", ", ".role4 ) | strcat role1 role2 role3 role4 Role | fields user,max(timestamp),Role | rename user as "UserName",max(timestamp) as "Last Login", Role as "Roles"* Since I have the complete set of users in the lookup file. I am getting the list of users who had not logged in he last 30 days using the following query. *| inputlookup usermap.csv | search NOT [ search index=_audit action="login attempt" info="succeeded" earliest=-30d | dedup user | fields user] | fields user* How Do I get the last login information and roles for the second query.i.e for the users who did not login for the last 30 days.May be I should use the join.But I am not getting it right. ... View more

I have 8 Indexers in my environment.I would like to keep the configurations especially the props.conf and the Transforms.conf similiar in all the indexers. Can I achieve that with a Deployment server.Does it push the conf files to a specific directory or should everything be under etc/apps directory? ... View more

I have hosts/forwarders reporting to multiple indexers using load balancing.I have 3 in Americas,2 in Aspac. I am able to get the output using the query index="_internal" source="*metrics.log" per_host_thruput | chart sum(kb) by series, splunk_server. I want to get the output with the following columns host,TotalVolume,Indexer/s Could you please help. ... View more