There is a concept of Row Grouping in simplexml. Here is an example of a row with one panel which has two visualizations in it. <dashboard> <row grouping="2"> <table> ... </table> <table> ... </table> </row> </dashboard> There is more details in the docs here: http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#row Also you can check out the Splunk 6 Dashboard Examples App ... View more

There is some documentation on how to do this is simplexml: Roughly if this a table you could do something like: <table> ... <drilldown> <link>http://website.com/info?$row.id$). </drilldown> </table Some other tokens available: click.value2 - the value that you clicked on if you drilldown type is cell click.name1 - the fieldname that clicked on. click.value - the far left column's value click.name - the far left column's field name ... View more

You are correct. In Splunk 6.0 saved searches are dispatched via the saved search endpoint, which requires the scheduler to be enabled. ... View more

All of the pages in Splunk no longer load application.css or application.js in 6.0 To help clarify, here is a list: pages (search, pivot, dashboard listings page, report listings page, alerts listing page) - no application.css/js dashboards + forms (simple xml) - Load dashboard.css/js views (advanced XML) - still load application.css/js ... View more

I think that is a great idea. I have done something similar to this by separating the range into several series, where each entry only shows up in one series, then using stackmode "stacked". This can be done in either simple or advanced xml. Take a look at the table I would try to create: domain | red | yellow | green example.com | 0 | 1 | 0 mydomain.com | 0 | 0 | 1 anotherdomain.com | 1 | 0 | 0 Step 1 - search: index=_internal | stats count by sourcetype | rangemap field=count green=0-100 yellow=101-1000 default=red | eval red=if(range=="red", 1, 0) | eval yellow=if(range=="yellow", 1, 0) | eval green=if(range=="green", 1, 0) | table sourcetype red yellow green Step 2 - graph - add this to a panel in a dashboard and edit visualization to be column in stacked mode Step 3 - change the series color to match - check the docs here ... View more

I have used macros in the past to help with this. You could use the stringreplace to pick which macro to use. So you would have at least two search macros. oslogs-windows and oslogs-linux In the search you can refer to them like .... | oslogs-$os$ so when os is linux it will use the oslogs-linux macro, and when windows it uses the oslogs-windows` macro ... View more