About manikdham

yulsplunkops · ‎03-25-2024

What about defining this on a Cloud Index you create ? I get a defaut app assigned and there is no filed available to edit this. Thanks

jkat54 · ‎05-19-2022

Except that it doesn't apply RBAC view of the indexes. Except that it doesn't work if you can't reach indexers on 8089 and don't have indexes configured on your SH. Except that it's not as fast as eventcount and probably shouldn't be used in dashboard drop downs.

Drainy · ‎02-28-2013

This has been covered in a couple of threads, one more about the feature and another about options. http://splunk-base.splunk.com/answers/67574/fschange-deprecated-what-options-are-available http://splunk-base.splunk.com/answers/63874/why-is-fschange-a-deprecated-feature-in-splunk-50

TennisTragic · ‎10-15-2018

Have a look at the Cloud Security information on the Australian Signals Directorate's website.

sloshburch · ‎10-11-2013

Check out what I posted for an answer to this: http://answers.splunk.com/answers/41129/use-of-the-search-description-field-in-an-alert-email

Lucas_K · ‎11-11-2012

I believe it's the Splunk\etc\apps\search\bin one. more info here : http://splunk-base.splunk.com/answers/2641/how-do-i-customize-scheduled-search-alert-emails

adamw · ‎09-09-2012

I don't think this is currently possible, although you can populate the search bar with a default value, similar to how the Unix app works. Basically if you edit $SPLUNK_HOME/etc/apps/ /default/data/ui/views/ .xml, you should find an XML module named "SearchBar", and you can add a new param named "q" with the parameter being whatever you want in the search bar for that view. true true index=os False See $SPLUNK_HOME/etc/apps/unix/default/data/ui/views/about_dashboard.xml as an example. Thanks, --adam

jonuwz · ‎09-10-2012

You wrap it around any searches you want to be modified by your intention. (Don't forget to close the </module> Also, HiddenIntention might not be valid as a root module, wrap it in a GenericHeader to test

manikdham · ‎05-11-2012

I want to create a drop down menu in default.xml which has links to other apps. How do i do this using this.

MuS · ‎09-10-2013

Hi manikdham you can add a HTML link to any URI to the navigation menu, if you add something like this to your default navigation menu: <a href="/app/YourAppName">YourAppName</a> either do this in the Manager » User interface » Navigation menus » default or by editing the file nav.xml in the path $SPLUNK_HOME/etc/apps/YourAppName/default/data/ui/nav hope this helps cheers, MuS

sdaniels · ‎04-26-2012

You use roles to lock down access to indexes. IE you could create a role with access to only one index. Then you are able to give individual users that role. That means that if they come into the search app and try to search on other indexes, they will get nothing. At the app level you assign roles that can access an application. Hope this helps.

bmunson_splunk · ‎10-16-2014

See this question for a list of fields you can use http://answers.splunk.com/answers/27329/what-variables-can-you-use-in-email-subject.html

Simeon · ‎11-16-2011

good answer

I_am_Jeff · ‎06-14-2013

On version 4.3.4, I copied the file from the "search" app and added this to the equivalent spot. (I've removed the angle brackets to ensure it appears.) param name="default" index=myindex /param I ran "splunk btool fix-dangling" as I use pooled search heads. I had to log out and back in to see the change. ("index=myindex" appears automatically in the search box.) All seems to be working well in the short time it's been modified.

Posts	18
Solutions	0
Karma Given	0
Karma Received	6
Member Since	‎05-10-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

FSChange in Splunk 5.0 onward

secure splunk in cloud

Include description field in email

which sendemail.py to use

suffic index name to all searches made in the app

prefix string to search query

app menu links to other app

create static drop down menu in app

Customize splunk search app to index

define index for my app

Re: define index for my app

Re: Is it possibl to get a list of available indic...

Re: FSChange in Splunk 5.0 onward

Re: secure splunk in cloud

Re: Include description field in email

Re: which sendemail.py to use

Re: suffic index name to all searches made in the ...

Re: prefix string to search query

Re: app menu links to other app

Re: create static drop down menu in app

Re: Customize splunk search app to index

Re: Use of the search "description" field in an al...

Re: reports getting delivered before calculation c...

Re: Specify Default Index for App

Join the Conversation