This is likely caused by the way dedup is behaving with the MV field created by eval-split. Try: sourcetype="email" sender="jgauthier*" subject="Specific email" | eval recipientlist=split(recipient, ";") | stats count by recipientlist | fields - count If you want the "count" just remove "| fields - count" above... ... View more

Blurblebot, You can do this via props/transforms like so. The trick is to use MV_ADD http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf: ## props.conf [<your_sourcetype>] REPORT-name_for_your_sourcetype = name_for_your_sourcetype ## transforms.conf [name_for_your_sourcetype] REGEX = Name=(\S+) FORMAT = name::$1 MV_ADD = True ... View more

gljiva, You need to do this using CSS. Each view can specify it's own custom CSS file using the following syntax: <view template="dashboard.html" stylesheet="access_center.css"> The CSS file should live in $SPLUNK_HOME/etc/apps/$your_app$/appserver/static/ Each module in the view get's an ID. This is easily retrieved using firebug. In the case of getting those to span horizontally, you will want something like this: #ExtendedFieldSearch_0_8_0 { float: left; padding-top: 2px; } ... View more

CLEAN_KEYS is actually a transforms.conf setting, not props.conf. This is why config checker is barking. It's not actually a typo, but an invalid setting for props.conf. http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf ... View more

You can change the host field at index time with a "TRANSFORMS" property: ## props.conf [mysourcetype] TRANSFORMS-force_host_for_mysourcetype = force_host_for_mysourcetype ## transforms.conf [force_host_for_mysourcetype] DEST_KEY = MetaData:Host REGEX = \d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\s+server=(\S+) FORMAT = host::$1 You can create a dashboard using the following search. The dashboard creation itself can be a bit tricky. We may have to incorporate the "rangemap" search command and map 0=low 1=severe. sourcetype=mysourcetype | stats last(state1) as state1, last(state2) as state2, last(state3) as state3, last(state4) as state4 by server, env, os | addtotals fieldname=stateTotal ... View more

You should be able to do this by specify multiple fields in Splunk's join command: sourcetype=test1 | fields col1,col2 | join col1,col2 [search sourcetype=test2 | fields col1,col2,col3] ... View more

Luke, The following code should work. Basically I converted your addterm intentions to stringreplace. The searches may not be exactly correct depending on how you have fields extracted. I would recommend extracting fields via props.conf so that you have key=value pairs extracted automatically at search time. The bottom line is that you have $deviceToken$ and $filesystemToken$ at your disposal: <?xml version="1.0"?> <view onunloadCancelJobs="False" autoCancelInterval="100"> <!-- autoCancelInterval is set here to 100 --> <label>Nagios Filesystem Usage Graphs</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="SearchSelectLister" layoutPanel="mainSearchControls" autoRun="True"> <param name="search">index="nagiosdev" nagiosevent="CURRENT HOST STATE" | rex ".+CURRENT HOST STATE\: (?P&lt;device&gt;[^;]*)(?=;)"| stats count by device</param> <param name="earliest">-24h</param> <param name="selected">dev1web07</param> <param name="label">Select a Hostname:</param> <param name="settingToCreate">device_setting</param> <param name="searchFieldsToDisplay"> <list> <param name="value">device</param> <param name="label">device</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">device_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="deviceToken"> <param name="value">$target$</param> </param> </param> </param> <module name="SearchSelectLister"> <param name="searchWhenChanged">True</param> <param name="settingToCreate">filesystem_setting</param> <param name="label">Select a Filesystem:</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="search">index=nagiosdev sourcetype="nagiosserviceperf" plugin="Disk" device=$deviceToken$ | rex max_match=1000 field=_raw "(?&lt;filesystem&gt;\/[^= ]*)=" | stats count by filesystem</param> <param name="earliest">-1h</param> <param name="searchFieldsToDisplay"> <list> <param name="label">filesystem</param> <param name="value">filesystem</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">filesystem_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="filesystemToken"> <param name="value">$target$</param> </param> </param> </param> <module name="TimeRangePicker"> <param name="selected">Last 4 hours</param> <param name="searchWhenChanged">True</param> <module name="SubmitButton"> <param name="allowSoftSubmit">True</param> <param name="label">Search</param> <module name="Message" layoutPanel="graphArea"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">2</param> <module name="GenericHeader" layoutPanel="resultsAreaLeft"> <param name="label">Filesystem Usage over time</param> </module> <module name="HiddenSearch" layoutPanel="resultsAreaLeft"> <param name="search">index=nagiosdev sourcetype="nagiosserviceperf" plugin="Disk" device=$deviceToken$ filesystem=$filesystemToken$ | rex max_match=1 field=_raw "\Q$filesystemToken$=\E(?&lt;fs_used&gt;[^M]*)MB;[0-9]+;[0-9]+;[0-9]+;(?&lt;fs_total&gt;[0-9]+)" | timechart span=5m avg(fs_total) as "Total $filesystemToken$",avg(fs_used) as "Used $filesystemToken$"</param> <module name="HiddenChartFormatter"> <param name="chart">area</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">MB</param> <module name="JobProgressIndicator"/> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </view> ... View more

Splunk refreshes the Incident Review dashboard as long as the underlying search is still running. The refresh deselects any check boxes you have selected. To avoid this behavior, wait for the search to complete before attempting to edit the status of the events. You can also click Finalize or Pause from the search controls. ... View more

Internet Explorer displays an error ("Navigation to the webpage was canceled") when external links under the Resources -> Threat Intelligence menu are opened. This is due to Internet Explorer's security-zone settings which prevent the views from displaying due to security controls. ... View more

ESS leverages summary indexes and lookup tables extensively. The data in summary indexes and lookups may contain information pertaining to raw events that are no longer in Splunk. Raw events may have been rolled out of the system (frozen). See your Splunk administrator for more information related to your implementation's indexing and retention policies. ... View more