@vsingla1 wrote: After grouping the fields into one list, how do I make this list comma separated? This is, what I have somewhere already -- the field Mnemonic (singular), specific to every event, is grouped into Mnemonics (plural), which is then passed to multi-value join: | eventstats values(Mnemonic) as Mnemonics | eval Mnemonics=mvjoin(Mnemonics, ",")   ... View more

Putting the comment box there itself is a simple matter of using Table Embedding features of the Sideview Table module. You can read the full docs of the Table module by logging into the app itself and navigating to "Module Documentation > The Table Module". The question quickly becomes what to do with it then! I would use a TextField module, and then perhaps a Button module and a Search module, so that you can persist the typed comments to a lookup or to the kvstore. The particular details of doing this are pretty finicky but it's been done a number of times by different individuals out there. Here is one that was pretty well written up in an answers post. http://answers.splunk.com/answers/213549/sideview-utils-how-to-get-checkbox-module-to-autor.html ... View more

hi I try above query but the baseline value is static. my query is my query | timechart count(src_ip) by dest | eval baseline=[search myquery earliest=-30d latest=now | stats count(src_ip) as baseline | return $baseline] ... View more

instead of using a rangemap try using eval and case condition, i would call it something like: eval severity=case(secs<1 AND secs>3,"Good",secs<=3 AND secs>4,"Fair",secs<=4 AND secs>2000,"worse") | geostats latfield=latitude longfield=longitude count by severity ... View more

First of all get rid of everything outside of the square brackets (including the square brackets). Do you have a "fieldest" portion of your XML form to set the $earliest$ and $latest$ tokens? If show, you need to included it (actually include all of your XML). ... View more

Unfortunately they do not have much extensibility within the out of the box google maps. It would require you to implement your own custom map: http://answers.splunk.com/answers/117658/google-map-view-event-click ... View more

Hi ! I know that this post is old, but if your need is still relevant, there is an app in Splunkapp called Report Sender that allows you to send an e-mail with a screenshot of your dashboard. Younes ... View more

I had this exact symptom and managed to fix it by disabling Transparent Huge Pages (THP) on a server. Basically when server is pressed on memory or search is pushing some limits - THP comes into play in a weird ways causing silent failures. See more here: https://answers.splunk.com/answers/188875/how-do-i-disable-transparent-huge-pages-thp-and-co.html ... View more

If you want to do calculations automagiclly consider using EVAL- with your props.conf. With regards to caching Report Acceleration and Summary Indexing are going to be the best answers, you could try building a lookup table. @disha sorry if that dont help. ... View more

This is probably where you should look; http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Advancedsourcetypeoverrides The regex should probably be something like below, but you'll have to adjust it according to your data. REGEX = \"ID\":32, Hope this helps, Kristian ... View more

A showOnlyWhen parameter would be an welcome addition! ... View more

Thankyou.Appreciated.!! ... View more

Well, yes, of course. Have a look at Accelerated Searches or Summary Indexing. http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Aboutsummaryindexing Just saving the results of the calculation round((mu/1024),2) won't improve performance significantly. /K ... View more

Well I'm behind on writing up the official docs for this in Sideview Utils itself, but at this point I've spilled the beans and a number of people have started doing it successfully. It's already written up in this answer here: http://splunk-base.splunk.com/answers/72088/saving-the-current-configuration-on-the-dashboard If you follow the steps in that answer, then when you save searches, they'll be saved with a little snapshot of the relevant keys, right into the savedsearch stanza in savedsearches.conf. One side effect to be aware of, is that when the user clicks a savedsearch link to come back to this view and re-run their savedsearch, the URL will very briefly be ?s=saved_search_name and then it will quickly redirect to ?search.name=saved_search_name . This is a normal state of affairs, until Sideview Utils has a replacement for the AppBar module. Also note that since that referenced Question and Answer, Sideview Utils 2.4 came out with the new Checkboxes module, which gives you a nice new option to reduce complexity in complex views where you were using multiple Checkbox modules. http://sideviewapps.com/apps/sideview-utils/ ... View more

Hi - this page might be helpful for you: http://dev.splunk.com/view/SP-CAAAEJ7 It talks about how to get the user object. ... View more

Yes, it's possible from splunk view. ... View more

You could take a look at $SPLUNK_HOME/etc/apps/search/bin/*.py for inspiration. ... View more

You could register your python script as a custom command, and use splunk.Intersplunk to retrieve search results. ... View more

Concerning number one, set the chart to omit null values and compute your own connect for the other chart like this: ... | streamstats count(f) as temp | streamstats count by temp | eventstats max(count) as max by temp | streamstats last(f) as last | reverse | streamstats last(f) as next | reverse | eval f = if(isnull(f),last+((next-last)/max)*(count-1),f) | fields - temp count max last next To keep things looking nice, call your first(mu) as f at first, and later rename it - else you'd have the human-readable field all over the query. Concerning number two, something like this? ... | where Debug!="{}" ... View more

Can we do like this..when user just scroll over x axis,he can see the Debug string in tooltip? 😞 ... View more

while there's not direct SDK support, you can use the REST API and HEC injection to interact with Splunk via perl scripts. One example: https://answers.splunk.com/answers/766443/whats-the-fastest-way-to-inject-data-to-http-event.html ... View more

Thanks for clearing my doubt.Socket communication is the better choice if we want to extend the functionality or service from splunk.Thanks ... View more

Cool. Well which to use depends on what you're trying to do. Since you want to have the search language version in the URL you want the $VMSID$, including the templating and the separator. If instead you wanted to prepopulate a different multiselect Pulldown in the second view you would use $VMSID.rawValue$. Happy to help. ... View more

Thankyou So much. AutoRefresh is the module..I was looking for. Thanks for guiding me in right direction. Thanks ... View more