You've misused the term "search" in your first search. As you have it: sourcetype="source" search NOT field2=*keyword* | table field1, field2, field3 The term "search" is being used as a keyword in a search. Ie find events in sourcetype="source" containing "search" but not having field2="keyword" What you want is simply: sourcetype="source" NOT field2=*keyword* | table field1, field2, field3 ... View more

The order of views / dashboards is based on the file name on disk. The file name won't affect the name shown in the nav menu - that is set within the file by your label. Numerically prefixing each dashboard / view name is the simplest case, and is easy to make a naming convention for using in sub-menus etc also. Eg for a flat life "01_hits_over_time.xml" "02_less_important_hist.xml". For sub-menus something like "apache-01-hits.xml", "apache-02-errors.xml" "os-01-syslog.xml" "os-02-secure.xml" ... You can't easily rename views/dashboards via Splunk Web [you need to clone, set new name, then delete the old]. Remember when you move, or add/modify, files via the file-system you need to fully refresh the app for the files to get re-read [click the splunk logo top right is the simplest way, or set your location bar to the base of your app eg yoursplunkserver/app/yourapp/] ... View more

FlashChart is still available in 4.3, but JSChart has become the default - add the code following to get your FlashChart (and all its supported options) back. 100% 150px ... View more