The beauty of this site! Some things (troubleshooting) never change hahaha Thanks so much for contributing!  ... View more

I think fillnull is the best approach. You could use and | eval ifnull(field) bla bla bla, but it would be even more intensive. The approach I use with heavy dashboards is to create a couple of reports, outputting all to a table and scheduling it to run every X minutes/hours. I than create my dashboard using searches starting with: | loadjob "admin:search:my saved report" | search fieldA="1" AND fieldB="*" | stats count by fieldC You can do all lookups, fillnulls and any data cleansing at the schedule report phase and the dashboard will run fast, very fast! The pitfall is, that the "loadjob" command will only work if the report already ran and has results. The report needs to run at least once via scheduler. You can keep eye on your "Activity->Jobs" and you'll see your saved report running and completed. Cheers ... View more

Instead of creating an input to store the drilldown value (which I believe is used as input for some other panel) you can create token. $click.value$ Place this piece of code before or ... View more

You should edit the splunk_servers_cache.csv asset table manually and remove the unwanted entry. For more details, please read this Splunk Answer. ... View more

That works perfectly! I'm going to go with this solution, as this particular log has less than 5k events per day and only a handful of login events. Thanks for your help! ... View more

Sure. If your view is called "your_view_name_here", then you would use this custom CSS. .splView-your_view_name_here .dashboardCell .splHeader-dashboard, .splView-your_view_name_here .dashboardCell .splLastRefreshed { display:none; } note that "splView-" has a hyphen! as a custom CSS refresher, you put the above snippet into either into 1) application.css, or 2) a custom CSS file in the app, referenced in the view's "stylesheet" attribute, or 3) a custom CSS file in the app, referenced as one of the stylesheets referenced in the SideviewUtils module's "customStylesheet" param. ... View more

I see. You essentially want to be able to do <param name="fields"> field3 field1 field4 *`, as you would do with the fields command. Incidentally, you can easily do this with the fields command. Just use it in a postprocess instead of the fields param. <module name="PostProcess"> <param name="search">field3 field1 field4 *</param> <module name="Table"/> </module> ... View more

I have set the variable as mentioned above and I still am not getting perfmon data. But I do get it from the TA-Windows add on. ... View more

no worries... what's with the "b" in your regex? ... View more

That was my fear. Thanks! ... View more

Also, have you tried running btool on the forwarder - $ cd /opt/splunkforwarder # or wherever you installed splunk $ ./splunk btool props list iis --debug or just $ ./splunk btool props list --debug | more ... View more

Hi All, Is there any possibility to create a unique index number while indexing because i want to search the result on behalf of last event id i read.then i will read the event greater then from that last event id. The problem i faced is device is generating wrong date time and that time is future date time in that case our earliest and latest logic is failing. because i was storing the _time value as a last trigger date and that was future date.so i want to create a unique auto incremented row number id while indexing. Please help!! ... View more

Hi sdaniels, Is it possible to give a more detailed explanation how you display the values? do we need to extract the time field as _time and code in the search query : table _time, temperature (for example.) thanks!!! ... View more

In my case, serverclass was correct but the app was not present in the repository. corrected that issue and restarted splunk on deployment server. while the app was missing, clients were getting the handshake error noted above every 60 seconds. my phoneHomeInterval is set to 4 hours but the handShakeRetry (undefined) was recurring every 60 seconds. With thousands of deployment clients, the constant retries were overrunning our deployment server. eventually, I got the message "DeploymentClient has been asked to redo-handshake. Resetting to initial state." after that, the app downloaded and I didn't get the handshake error any more. lessons learned? don't forget to put app in in repository. don't assume that handShakeRetry tracks with customized phoneHomeIntervalInSecs value. ... View more