cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
damickel
Explorer
Member since: ‎04-14-2020
‎03-23-2021
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎04-14-2020
View All

Re: Latest time in time picker only allows 'now'

by in Dashboards & Visualizations
‎03-22-2021 10:22 AM
‎03-22-2021 10:22 AM
Thanks! I think I was looking to hard and missed the obvious. Is there any way to set 'Between' as the default behavior? It seems like it is that way outside of Dashboards. ... View more

Latest time in time picker only allows 'now'

by in Dashboards & Visualizations
‎03-19-2021 01:55 PM
‎03-19-2021 01:55 PM
I am trying to create a dashboard for users that need to be able to set a time/date range manually. But in the time picker that is created by default in the dashboard, the latest_time is always 'now'. The only way around this is to use the presets or the advanced options, but I can't expect users to work out the necessary times in the advanced.  I've tried looking through the documentation and forums, but not finding anything yet that indicates how to get around this. Anyone have a way to get around this? ... View more
Labels

Send email only once after an episode is open for ...

by in Splunk IT Service Intelligence
‎10-09-2020 12:34 PM
‎10-09-2020 12:34 PM
I'm creating a number of correlation searches, and I'd like to be able to send an email ONLY when an episode has been open for more then X number of  minutes.  If i go into the aggregation policy and set 'If this episode existed for X second(s)', then any event that is added to the episode after X seconds triggers an additional email, which potentially could be a lot of emails. I haven't been able to find a combination of settings that will just send an email once from the aggregation policy rules. I considered the option to create an alert search for an episode that has been up for a certain period of time in a 'New' state, but I'd prefer for it to be built into the aggregation policy. Anyone else hit something similar? ... View more

move itsi build across environments

by in Splunk IT Service Intelligence
‎04-14-2020 02:41 PM
‎04-14-2020 02:41 PM
We have a large team of admins and users that will be using our ITSI instance. Part of our build is to move configuration from our dev environment to production. With Splunk enterprise we are used to managing everything through conf files, but it looks like we have to do it through kv stores with ITSI. Is there another way to manage services and services templates without using the backup and restore process? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎03-23-2021 09:45 AM