Hi, I don't entirely understand the purpose of this directory, but I get a lot of "Too many search jobs found in the dispatch directory..." warnings. None have ever seemed to actually impede the performance, but it does bother alarm users. I believe they are stemming from dropdown menu population searches that are sequences of nested "|set intersect [query] [|set intersect [query] [...]]". I don't want these constantly filling up the dispatch directory and requiring maintenance - can I stop this (in particular for a dropdown menu population search), or is that a necessary part of the search process? Further, is it possible to hide these warnings from users? Thanks. ... View more

Hi, I have a dashboard that depends on a number of dropdown menus. These dropdown menus filter each other (e.g., if I pick a 'version', the 'build' dropdown menu will filter based on the builds available for that version). The menus all have the same initial search, but there doesn't seem to be a way to create a searchTemplate that is only for use by the dropdown menus (please correct me if this is wrong). The issue my users are reporting is that the dropdown menus take a while to populate - sometimes it seems longer than the main search. This is because of this staircase-esque nature to the dropdowns where selecting one refreshes others (even if the selection in that dropdown won't change). One option I would like is the ability to type in an option to the dropdown menu independent of whether or not that term shows up (or has shown up yet) in the populating search. This would allow users to specify options they know exist while waiting for the dropdown to populate. Currently, no typing area is available until enough results are found to create a scrollbar (I would prefer there to always be one when the menu is clicked). However, I am wondering if there is a better way to do this all together. There are enough possible settings of the dropdown menus (and more come in every day) that I do not think saved searches are the way to go, even though many of these searches are repeated or almost repeated. I also have all the dropdown menu data stored in its own index (this is done offline - setting up a dropdown index that accurately reflects the data in the main indexes). Excerpt from my dashboard: <fieldset autoRun="true" submitButton="false"> <input type="dropdown" token="index" searchWhenChanged="True"> <choice value="_official">Official</choice> <choice value="_official OR index=_standard">All</choice> <choice value="_standard">User</choice> <label>Data</label> <default>Official</default> </input> <input type="dropdown" token="version" searchWhenChanged="True"> <choice value="*">All</choice> <populatingSearch fieldForValue="version" fieldForLabel="version">index=[| gentimes start=-1 | eval search=if("$index$"="_official","_dropdown","_dropdown_standard")| table search] | dedup version | table version</populatingSearch> <label>Version</label> <default>23</default> </input> <input type="dropdown" token="build" searchWhenChanged="True"> <populatingSearch fieldForValue="build" fieldForLabel="build">index=[| gentimes start=-1 | eval search=if("$index$"="_official","_dropdown","_dropdown_standard") | table search] version=$version$ | dedup build | table build | sort + build | reverse</populatingSearch> <choice value="*">All</choice> <default>*</default> <label>Build</label> </input> <input type="dropdown" token="family" searchWhenChanged="True"> <populatingSearch fieldForValue="family" fieldForLabel="family">index=[| gentimes start=-1 | eval search=if("$index$"="_official","_dropdown","_dropdown_standard") | table search] version=$version$ | dedup family | table family | sort + family</populatingSearch> <choice value="*">Any</choice> <default>Main</default> <label>Family</label> </input> <input type="dropdown" token="device" searchWhenChanged="True"> <populatingSearch fieldForValue="device" fieldForLabel="device">index=[| gentimes start=-1 | eval search=if("$index$"="_official","_dropdown","_dropdown_standard") | table search] version=$version$ (family="$family$") | dedup device | table device | sort + device</populatingSearch> <choice value="*">Any</choice> <default>Main</default> <label>Device</label> </input> <input type="dropdown" token="bin" searchWhenChanged="True"> <choice value="primary">Primary</choice> <populatingSearch fieldForValue="bin" fieldForLabel="bin">index=[| gentimes start=-1 | eval search=if("$index$"="_official","_dropdown","_dropdown_standard") | table search] version=$version$ build=$build$ (family="$family$") (device=$device$) | dedup bin | table bin</populatingSearch> <label>Bin</label> <default>Primary</default> </input> <input type="dropdown" token="corner" searchWhenChanged="True"> <choice value="*">All</choice> <populatingSearch fieldForValue="corner" fieldForLabel="corner">index=[| gentimes start=-1 | eval search=if("$index$"="_official","_dropdown","_dropdown_standard") | table search] version=$version$ build=$build$ (family="$family$") (device=$device$) | dedup corner | table corner</populatingSearch> <label>Corner</label> <default>900mv_100c</default> </input> <input type="dropdown" token="voltage" searchWhenChanged="True"> <populatingSearch fieldForValue="voltage" fieldForLabel="voltage">index=[| gentimes start=-1 | eval search=if("$index$"="_official","_dropdown","_dropdown_standard") | table search] version=$version$ build=$build$ corner=$corner$ (family="$family$") (device=$device$) | dedup voltage | table voltage | sort + voltage</populatingSearch> <choice value="*">All</choice> <label>Silicon Voltage (mv)</label> <selectFirstChoice>true</selectFirstChoice> <default>900</default> </input> <input type="dropdown" token="temp" searchWhenChanged="True"> <label>Silicon Temperature (celsius)</label> <choice value="*">All</choice> <selectFirstChoice>true</selectFirstChoice> <populatingSearch fieldForValue="temp" fieldForLabel="temp">index=[| gentimes start=-1 | eval search=if("$index$"="_official","_dropdown","_dropdown_standard") | table search] version=$version$ build=$build$ corner=$corner$ (family="$family$") (device=$device$) | dedup temp | table temp | sort + temp</populatingSearch> <default>100</default> </input> <input type="dropdown" token="group" searchWhenChanged="True"> <choice value="*">All</choice> <populatingSearch fieldForValue="group" fieldForLabel="group">index=[| gentimes start=-1 | eval search=if("$index$"="_official","_dropdown","_dropdown_standard") | table search] version=$version$ build=$build$ corner=$corner$ (family="$family$") (device=$device$) | dedup group | table group | sort + group</populatingSearch> <label>Group</label> <default>*</default> </input> <input type="dropdown" token="name" searchWhenChanged="True"> <choice value="*">All</choice> <populatingSearch fieldForValue="name" fieldForLabel="name">index=[| gentimes start=-1 | eval search=if("$index$"="_official","_dropdown","_dropdown_standard") | table search] version=$version$ build=$build$ corner=$corner$ (family="$family$") (device=$device$) group=$group$ | dedup name | table name | sort + name</populatingSearch> <label>Design</label> <default>*</default> </input> ... View more

Hi, I want to use Timechart to track daily use, but sometimes the daily data won't arrive until 12 AM (time to compile the results). How can I shift the span=1d in timechart to start at a point other than 12AM? E.g., : index=usage | eval time=time/3600 | timechart span=1d sum(time) as total_time by user Thanks ... View more

Hi, I am working with code that sends data to Splunk indexes via the Python SDK (splunklib.client). I want to create a custom user for the purpose of this code. That is, a user who's privileges are strictly that of writing data into a small number of indexes and be otherwise restricted from writing elsewhere. I currently have a user with just the capability 'edit_tcp' and the 4 indexes I want specified for search capability, but this does not seem to restrict the write capability when using the .send() python function. Any help would be apreciated, thanks. ... View more