Nope as the minimum unit is 1 min. ... View more

Hi, I too have a similar issue.  Disabling via the _internal call does not work for me. Thanks ... View more

Like this: | makeresults | eval XYZ="123" | eval year="2018" | rename StuffBelowIsTheSame AS "rename XYZ AS ABC2018" | eval newname="ABC" . year | eval {newname}=XYZ | fields - newname XYZ ... View more

Hi @marziaolla You need to configure outputs.conf to send data to indexer like in the normal case as mentioned in https://docs.splunk.com/Documentation/Splunk/7.1.1/DistSearch/Forwardsearchheaddata ... View more

How is this done? [setnull] REGEX = (API PROXY|WARN|ERROR) DEST_KEY = queue FORMAT = nullQueue ... View more

Thanks for the quick reply. My Email is -> zauberpferd12@gmail.com Thanks again. Mat ... View more

I get that error too. The URI p_gurav posted above is the correct question relevant to the error we're getting. No comments have been posted on how to fix it yet though that work. ... View more

@marziaolla, Try the following Run anywhere dashboard example. It uses post-processing to identify the second value in the dropdown and sets the same as a token for default value. PS: If the search for Dropdown returns only one result, the same will be set as default value. Also in case the Search does not return any results, I have used Static All option to be set as default value. <form> <label>Second Value in the list</label> <!-- Your Search to populate the second item from the list should go here ---> <search base="baseComponentSearch"> <query>| head 2 | tail 1 </query> <done> <!-- In case the Search does not return any results Static Option All should be selected --> <condition match="$job.resultCount$==0"> <set token="tokDefaultSelectedComponent">*</set> </condition> <!-- Set the token using Search Event Handler's default token result.<yourFieldName> --> <!-- If the Search returns two or more results 2nd result will be selected --> <!-- If the Search returns only one result, the same will be selected --> <condition> <set token="tokDefaultSelectedComponent">$result.component$</set> </condition> </done> </search> <fieldset submitButton="false"> <input type="time" token="tokTime" searchWhenChanged="true"> <label></label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="tokComponent" searchWhenChanged="true"> <label>Select Component</label> <fieldForLabel>component</fieldForLabel> <fieldForValue>component</fieldForValue> <search id="baseComponentSearch"> <query>index=_internal sourcetype=splunkd log_level!="INFO" earliest="$tokTime.earliest$" latest="$tokTime.latest$" | stats count by component | sort - count | head 5</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <choice value="*">All</choice> <default>$tokDefaultSelectedComponent$</default> </input> </fieldset> <row> <panel> <chart> <search> <query>index=_internal sourcetype=splunkd log_level!=INFO component="$tokComponent$" | timechart count by component</query> <earliest>$tokTime.earliest$</earliest> <latest>$tokTime.latest$</latest> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> </form> ... View more

@493669 yes i am facing the same problem..i want to adjust the width how can i do it?? ... View more

I have converted my comment to answer so you can accept/upvote it. ... View more

harsmarvania57 has a very good point, which is that data stored in the index does not affect your license capacity. Quoting from the Admin Manual: "Splunk Enterprise licenses specify how much data you can index per calendar day (from midnight to midnight by the clock on the license master)." Here are two documentation topics that might help you: Remove indexes and indexed data About license violations ... View more

@marziaolla, were you able to try out any of the answers provided below? ... View more

You just need to define jsonText like this: jsonText = {'format': 'CSV', 'encrypted': 'none', 'queries': [{ 'name': object, 'query': query , 'type': 'type'}], 'name': 'Estrazione'} So that when later you call json.dumps(jsonText) this will do the right thing. ... View more