Actually, you should use the new preview feature (shipped in 4.3) to test any tz configs. ... View more

All you have to do to add form searches to a simple XML dashboard is edit the xml and change the document tag from to . Then you can use all the form elements described in the docs here: http://docs.splunk.com/Documentation/Splunk/latest/Developer/Step1CreateAForm ... View more

splunk.com/download if you're trying to collect syslog from a remote client, you have the following options: use syslog-ng on the remote machine to forward the data to the splunk server install the splunk forwarder on the remote machine and send data to your splunk server. everything you need to know about this is documented here: http://www.splunk.com/base/Documentation/latest/Admin/Aboutforwardingandreceiving ... View more

You can make changes to your chart (including the size of the axes) using the custom charting properties. A number of these are documented here: http://www.splunk.com/base/Documentation/latest/Developer/ChartReference Please also read the documentation about how to use these properties from within your chart here: http://www.splunk.com/base/Documentation/latest/Developer/AddAChart Cheers Emma ... View more

Hi Kirby, It depends on what you're interested in doing. If you want to use your own custom JQuery in an app to affect the way app content is presented, you can do this and quite easily. I suggest you check out the Getting Started app that ships with Splunk. This app contains JQuery/custom JS that is used to show/hide menu items and TOC. That should be enough to get you started building your own custom JS into your app. The other option for including custom JS is building a custom event renderer. This is useful if you want to change the way your events are displayed in Splunk Web. Documentation for this is here: http://www.splunk.com/base/Documentation/latest/Developer/EventRendering. In fact, I'd suggest perusing that entire section of the Developer Manual, since there are other options for customization that might work for you: http://www.splunk.com/base/Documentation/latest/Developer/CustomizationOptions If you want to change the modules, as Nick mentioned, there is no documentation on this and there is no real support for doing this, yet. Can you clarify what exactly you're interested in doing with your JS/JQuery and then we can give you more specific instructions? Thanks! --Emma ... View more

Hi Lowell, There is mention of this in the docs about building dashboards. Many of the pages mention that you can have up to three panels in a row. Where were you looking that you didn't see this so I can add some more notes? Thanks! Emma ... View more

Hi Dianbo, In your copied app, did you update the default.XML file to change navigation or are you still linking to the original dashboard (not your new modified dashboard) from the default.XML file? Thanks, Emma ... View more

This is a great request. You can submit enhancement requests through support, which will get them triaged and into our tracking system. Although it's also useful to see this here, so we can respond directly and see how many other people are interested in the feature as well. Feel free to submit your request through support, or I can submit it for you. Cheers, Emma ... View more

can you copy in your XML and possibly the saved search conf? i suggest if this is really not working for you, that you contact support to file a bug. it sounds a bit buggy to me. ... View more

What happens if you try to run that saved search "search_ids"? What kind of data are you getting back? is "idname" one of the fields that's present in that search? ... View more

First off, I'm curious about why you're trying to do this in the advanced XML? It's much easier in the simplified XML but there might be something specific you're trying to accomplish by using the advanced XML. What is that? Now, to answer your question. If I take one of the simplified XML views from the UI examples that includes dropdowns, then append ?showsource=true to the URI, I can see the advanced XML behind the dropdowns. It looks like: <view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html"> <label>Simple select drop down</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="Message" layoutPanel="messaging"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="HiddenSearch" layoutPanel="viewHeader"> <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps</param> <param name="earliest">-30d</param> <param name="latest">-0d</param> <module name="SearchSelectLister"> <param name="staticFieldsToDisplay"> <list> <param name="value">*</param> <param name="label">Any</param> </list> </param> <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series</param> <param name="label">Select series</param> <param name="settingToCreate">series_setting</param> <param name="searchFieldsToDisplay"> <list> <param name="value">series</param> <param name="label">series</param> </list> </param> <param name="searchWhenChanged">False</param> <module name="ConvertToIntention"> <param name="settingToConvert">series_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="series"> <param name="fillOnEmpty">True</param> <param name="value">$target$</param> </param> </param> </param> <module name="SubmitButton"> <param name="allowSoftSubmit">True</param> <param name="label">Search</param> <module name="JobStatus"> <module name="EnablePreview" layoutPanel="panel_row1_col1" group="Matching events"> <param name="groupLabel">Matching events</param> <param name="enable">True</param> <param name="display">False</param> <module name="SimpleResultsTable"> <param name="count">50</param> <param name="drilldown">row</param> <param name="allowTransformedFieldSelect">True</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> ... View more

Oh sorry, you can also completely remove the messages module, so just delete the entire block that Glenn pasted above. ... View more

If you're using Splunk 4.1, you can append "?showsource=true" to the end of your view URI, like this: http://localhost:8000/en-US/app/search/dashboard?showsource=true Then, scroll down to the bottom til you see "XML source." Take this XML -- it is the advanced XML syntax -- and paste it into the view edit window in Manager to overwrite your simplified XML. Then, remove the messages module as Glenn described. If you're not using 4.1, you will have to migrate your XML by hand. ... View more

Can you be more specific about what files you're talking about? If you are trying to package an app for other users, you can use the setup.xml to direct your users to specify where the file/directory is they'd like to index. They can set this up while installing/setting up the app. I wouldn't advise putting anything in $SPLUNK_HOME/var/log -- that's for internal Splunk logs. ... View more

i'm actually looking for a way to send search results into my custom code within Splunk's UI. I can use the XML but I am way more comfortable writing my own HTML, JavaScript and CSS. So I'm looking for a way to send and receive search results from my custom code to other modules within Splunk Web. ... View more

The easiest way to do this is by navigating to Manager, then clicking on Apps. Next to the App you're interested in, click the Permissions link. At the bottom of the page, you'll see a set of radio buttons with this text: Sharing for config file-only objects Set permissions for configurations that have been copied over or added to config files rather than created through the UI. Objects defined in config files only (not in the UI) should appear in Set this to All apps, and everything you create within this app will be shared. If you want to share a specific object (saved searches, event types, fields, etc), you can navigate to that object within Manager, for example Manager -> Saved Searches -> Permissions for specific saved search. You will see a similar set of radio buttons. Choose All apps to share your saved search. ... View more

an important thing to note: if you're indexing syslog data, set the sourcetype to "syslog" and your host will be extracted automatically from your events. you can set a default host that will get assigned to any event that doesn't contain a host name or IP address. ... View more