How do I add the SearchBar and FlashTimeline into my dashboard? Given this simple XML <dashboard> <label>Dummy dashboard</label> </dashboard> In Splunk 5.x, with Advanced XML, this is achievable with <module name="SearchBar" layoutPanel="mainSearchControls"> What are the elements I need to add between dashboard element to display the following in Splunk 6? ... View more

Splunk Ninjas, It seems that I'm unable to remove "other" in my pie chart when I do this: index=facebook sourcetype="facebook_stream_table" stream_attribution="*" | eval stream_attribution=if(stream_attribution=="", "None", stream_attribution) | chart count over stream_attribution useother=false Also I'm seeing this message "The following options were specified but have no effect when a split-by clause is not provided:useother" Then I tried index=facebook sourcetype="facebook_stream_table" stream_attribution="*" | eval stream_attribution=if(stream_attribution=="", "None", stream_attribution) | chart count over stream_attribution limit=1000 useother=false and I get this message "The following options were specified but have no effect when a split-by clause is not provided:limit, useother" I'm unable to get any results when I drilldown with stream_attribution=other since there isn't such value in sourcetype=facebook_stream_table I also took a look at this http://splunk-base.splunk.com/answers/30018/useotherf-in-a-pie-chart but it doesn't work. Splunk version: 4.3.1, MacOSX ... View more

This is a wall to gather feedback and interesting ideas from you (the end users) about features you want to see implemented in this app to make it more exciting! Post your thoughts here. Link it, tweet it, retweet it, pass this question around. Keep the ideas coming in! The app is available at: http://splunk-base.splunk.com/apps/splunk+for+facebook ... View more

I would like to know if there is a way to create new buckets at a defined interval, say a 5 minutes interval? I have been trying to tar an index at every 5 minutes using a cron job but it seems that the size of the tarball increases over time. For example: The first 5 minutes: 1MB - in a tarball with a unique time-based ID The second 5 minutes: 2MB (fresh 1MB + previous 1MB) - in another tarball with a unique time-based ID The third 5 minutes: 3MB (fresh 1MB + previous 2MB) - in another tarball with a unique time-based ID The fourth 5 minutes: 4MB (fresh 1MB + previous 3MB) - in another tarball with a unique time-based ID The fifth 5 minutes: 5MB (fresh 1MB + previous 4MB) - in another tarball with a unique time-based ID ... ... ... Ideally, I would want to see: The first 5 minutes: 1MB - in another tarball with a unique time-based ID The second 5 minutes: 1MB (fresh 1MB) - in another tarball with a unique time-based ID The third 5 minutes: 1MB (fresh 1MB) - in another tarball with a unique time-based ID The fourth 5 minutes: 1MB (fresh 1MB) - in another tarball with a unique time-based ID The fifth 5 minutes: 1MB (fresh 1MB) - in another tarball with a unique time-based ID ... ... ... Is there a documentation I can look at? What is the conf file that I should configure and how should the stanza look like? Nicholas ... View more

I didn't find it mentioned anywhere in the documentation. I might have overlooked it. http://www.splunk.com/base/Documentation/latest/admin/Propsconf ... View more

Hi all, I have the following output from a Perl script that runs every 5 mins: 09-13-2010 16:21:20 - Inventory Report DATACENTER, CLUSTER, VMHOST, VM PPD, DNSAS-Cluster1, dnsas-esx1, dnsa-secweb1 PPD, DNSAS-Cluster1, dnsas-esx1, dnsasval1-dev9 PPD, DNSAS-Cluster1, dnsas-esx1, ddist3-dev9 PPD, DNSAS-Cluster1, dnsas-esx1, dmplupe1-dev9 PPD, DNSAS-Cluster1, dnsas-esx1, dnsasext1-dev9 ... ... ... (520 lines) And this is how my props.conf looks like: [source::vm_inventory] SHOULD_LINEMERGE=True BREAK_ONLY_BEFORE_DATE=True TIME_FORMAT=%m-%d-%Y %H:%M:%S However the events got truncated into 256 line chunks. Am I missing anything here? Or should I do it this way? [source::vm_inventory] TRUNCATE = 0 LINE_BREAKER = (?!) ... View more