I have installed chrome 31.0.1650.57 and the problem still happen. It looks like the problem is rerunning a search and trying to hit CTR Z afterwards. The history of undo seems to have gone away. Very frustrating. ... View more

I am running mac OSX 10.8.4 and chrome 26.0.1410.65. This feature used to work in splunk 4.3 but now it's not working anymore. I really need it! Does anybody has a solution? ... View more

I have made an enhancement request for this, see topic here: http://answers.splunk.com/answers/102710/view-and-inheritance ... View more

Thanks! didn't see this topic. I have made an enhancement request and will give information as it is available. ... View more

Thanks to take time to answer. Unfortunately I can't use this, as I do not want any search to show up in the navigation menu, as it should only contain "macro" dashboards link, and should be high level enough that non-specialist can understand it. What I am looking for is a way to organize and manage, internally, just for me, the way saved searches are displayed, so I can remember where (in which dashboard for exemple) each saved search is used, and what is its general "theme" (error, draft, summary indexing etc...). things that end user don't want to know about. ... View more

That's too bad, but I think I may be doing something wrong then? I have like 3 pages of saved search within my app. Some are used for summary indexing, some are used to display results in views, some are alerts, and some are just sketches. I don't want to have to add an entry in the navigation menu of my app for all the drafts I create, and I also don't want to have to filter user that doesn't have to see these searches. Thanks anyway! ... View more

Alright, I have found the problem. The partition of my server for / was full. So when trying to upload the csv file (roughtly 1Mo), splunk first tries to copy it to /tmp (I guess) and fail. Using scp and copying the lookup file directly in the good folder did the trick. Unfortunately the error message given by splunk isn't very helpfull. Hopes that helps ... View more

I am having the same problem when trying to import a 2Mo csv lookup table: SyntaxError: Unexpected token < Doesn't look likes its related to encoding (UTF-8 without BOM), any clue? btw I am using splunk 4.2 ... View more

I can't remember where this search is, but I am now using this solution: index=myIndex | join FIELD1 max=0 [search index=myOtherIndex | stats values(FIELD2) as FIELD2 by FIELD1 ] | eval FIELD2 = split(FIELD2, " ") because split creates a multivalued field by splitting FIELD2 using the given delimiter (here it is the space character) It is far from efficient but it works. I am sure it is possible to update it to a more efficient version thow ... View more

You are totally right with the htmlModule. But my code is really ugly right now (I duplicate customBehavior to hide module for each module, because they don't hide on the same condition...). I would love to have only one nice function that takes some parameters as input (namely the $single$ value) and hides if it's equal to something, but I can't find how to pass parameters in the onContextChange overwrite function. ... View more

Many thanks for the detailed answer. I just tried it and it works perfectly. I think I will stay with the customBehavior as I have quite some now. Actually the value of $single$ is -1, so it does work (I tend to overkill and always set an onValue AND an offValue) ... View more

Sorry didn't check it but I have the xml2json in the right place (/etc/apps) I really don't understand how to set up everything here (can't understand this page: http://dev.splunk.com/view/SP-CAAAEFM, last paragraph) ... View more

I have made another question as there is not enough room in the comment. See http://splunk-base.splunk.com/answers/84184/javascript-sdk-internal-server-error ... View more

Did you solve this problem? I have exactly the same error as you describe and would be interested in a solution. By the way you need to use node v0.8.x (and not the latest release) as otherwise it will not work. see http://splunk-base.splunk.com/answers/79378/splunk-502-javascript-sdk-server-error-500-examples-browsertests ... View more

Thank you SO MUCH for the question and the answer. Just made my day. So I suggest you accept the answer as it give the solution (was having the same problem, switching to port 8089 solved it) ... View more

As this works, I will accept it, but still, I am not satisfied with it. ... View more

All right I am stucked. The method above is not the right way to go. I must use the new Splunk.Popup, but even if the html code I put inside show in the firebug console, it DOESN'T APPEAR in the popup. That very confusing. I don't know what to do. If anybody has an idea. btw I'm using splunk 4.3 ... View more

Hi, I am trying to do the same here, I suggest you take a look. By the way, here is the code documentation from the Popup.js file: cloneFlag: (bool) Flag to tell popup whether to clone the passed contents into the popup (true) or move them. This should generally only be left as true when passing a reference to an existing element that you wish to leave untouched, for example a dom scaffolding you intend to reuse. contents: (JQuery object or html) The contents of the popup. (ex: $('.popupContainer')). NOTE: if html is used, cloneFlag should be set to false ... View more

I am slowly crawling the Popup.js file, and I have "improved" my popup: _myPopup = Splunk.Popup.createEAIForm(window, "My popup", { url : Splunk.util.make_url('manager', Splunk.util.getCurrentApp(), '/saved/eventtypes/_new?action=edit&noContainer=2&viewFilter=modal&eleOnly=1'), title : "My Popup", pclass : "myPopupClass", buttons : [ { label: 'Cancel', type : 'secondary', callback: cancel }, { label: 'Apply', type : 'primary', callback: handleSaveSubmit } ] }); I think I have understood that you can't directly inject some html code inside it. It looks like you have to take the layout of the popup from a page (by the url property). I have taken this example from the Popup.js file itself, and I can use it in my page, but there is so many things that I still don't have any clue: 1°) How to create the html content and where to put it for it to be displayed in the popup 2°) How do you pass values back and forth the page <-> popup (how do you save changes done in the popup) 3°) Where can I find documentation on the Popup class (except from inside the code comments)? (I don't know what meansEAIForm, what exactly does the make_url function ...) If any one could help, it would be greatly appreciated PS: I have put it inside another answer for clarity, besides it partially answer the question EDIT: I was able to answer 1°) : here is the code of my popup: _myPopup = Splunk.Popup.createEAIForm(window, "My Popup Name", { url : Splunk.util.make_url('app', Splunk.util.getCurrentApp(), 'The view you want your popup to be populated with'), title : "My popup", pclass : "myPopupClass", buttons : [ { label: 'Cancel', type : 'secondary', callback: cancel }, { label: 'Apply', type : 'primary', callback: handleSaveSubmit } ] }); I still have a problem (JS error: TypeError: Splunk.EAI.getInstance(...) is null). I am currently investigating. Hope this helps, but I still don't know how to do n°2. ... View more