I think you want to use the tokens that you created in the drilldown set elements: "clicked_earliest" and "clicked_latest" So the second chart would look like: <chart> <searchString>index = rss_2 | dedup link | sentiment imdb title | stats avg(sentiment)</searchString> <earliestTime>$clicked_earliest$</earliestTime> <latestTime>$clicked_latest$</latestTime> </chart> ... View more

Yes you can include javascript in your simple xml dashboards and forms. All dashboards in an app will load dashboard.js from $SPLUNK_HOME/etc/apps//appserver/static/dashboard.js Also you can load other js files (csv) from your app ... will load $SPLUNK_HOME/etc/apps//appserver/static/myJs.js and $SPLUNK_HOME/etc/apps/otherapp/appserver/static/otherJs.js ... View more

A couple of things Text inputs do not support populating search: http://docs.splunk.com/Documentation/Splunk/6.0.3/Viz/PanelreferenceforSimplifiedXML#input_.28text.29 seed supports text or tokens, not search I don't think you can do this with simplexml only. You could write a javascript extension to help you, would you be open to using javascript? ... View more

Currently you can't schedule forms for PDF generation. Work around: Copy the form to another dashboard and remove the inputs. Change all the tokens to the values that you want printed and schedule the newly created dashboard. ... View more

Default is that the search page is shared globally. Is this true in your case? ... View more

What is your xml? ... View more

In Splunk 6 the best way is to use: http://localhost:8000/en-US/debug/refresh Or restart splunkweb ... View more

Yeah this is a subtle change in the two versions To work around use an empty default: <input type="text" token="get3"> <label>Get from drilldown: Count</label> <default></default> </input> ... View more

Yes, one of the advantages to using saved searches (reports) in dashboards is to have them run faster by using the latest run of that saved search. So if you want results more frequently you can schedule that search to run more frequently. You could also set the dispatch.ttl to a smaller number so results will expire quicker. ... View more

Could you provide the xml you are trying? Possible you would like to use table tag in place of event tags - Event in 6.0 will always show the events vs results which come from reporting commands like top. Or post screenshot. ... View more

This is not in the product directly, but if you are willing to write some javascript: This is a good case for our Custom Table Cell Renderers. If you look at Splunk 6.0 Dashboard Examples app there is an example on using the cell renderers. ... View more

Yes this is possible, there are several different techniques that can be combined: First, custom drill down lets you specify a link to take per field/series clicked on: http://docs.splunk.com/Documentation/Splunk/6.0/Viz/Dynamicdrilldownindashboardsandforms Second, in page drill down in Simple XML in Splunk 6.0. If you look at the Splunk 6.0 Dashboard Examples (note: requires javascript knowledge) Lastly, use tokens to select a macro. This allows you to specify different search snippets based on user input. This is useful in either advanced xml or simple xml. ... View more

In Splunk 6.0 and before this can be done with row grouping <row grouping="9"> <chart>...</chart> <chart>...</chart> <chart>...</chart> <chart>...</chart> <chart>...</chart> <chart>...</chart> <chart>...</chart> <chart>...</chart> <chart>...</chart> </row> In Splunk 6.0 we removed the limit of 3 panels per row. ... View more

@FRoth currently there is no way to customize those pages outside of the header color and logo. ... View more

We are close, it is : eval searchStartTime=relative_time(now(), "-5m") other eval commandes: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions ... View more

It looks like you are trying to use eval for concatentation, that would look like: ... | eval hourTimeStamp= date_hour + ":" + date_minute + ":" +date_second | ... View more