You've misused the term "search" in your first search. As you have it: sourcetype="source" search NOT field2=*keyword* | table field1, field2, field3 The term "search" is being used as a keyword in a search. Ie find events in sourcetype="source" containing "search" but not having field2="keyword" What you want is simply: sourcetype="source" NOT field2=*keyword* | table field1, field2, field3 ... View more

The order of views / dashboards is based on the file name on disk. The file name won't affect the name shown in the nav menu - that is set within the file by your label. Numerically prefixing each dashboard / view name is the simplest case, and is easy to make a naming convention for using in sub-menus etc also. Eg for a flat life "01_hits_over_time.xml" "02_less_important_hist.xml". For sub-menus something like "apache-01-hits.xml", "apache-02-errors.xml" "os-01-syslog.xml" "os-02-secure.xml" ... You can't easily rename views/dashboards via Splunk Web [you need to clone, set new name, then delete the old]. Remember when you move, or add/modify, files via the file-system you need to fully refresh the app for the files to get re-read [click the splunk logo top right is the simplest way, or set your location bar to the base of your app eg yoursplunkserver/app/yourapp/] ... View more

JSChart also renders much faster and uses far less system resources than FlashChart's. This can be very evident if you have dashboards with many charts displayed on the same page, and particularly on systems & mobiles with low memory available for flash. ... View more

FlashChart is still available in 4.3, but JSChart has become the default - add the code following to get your FlashChart (and all its supported options) back. 100% 150px ... View more