Yes you set a rotate under the options of the plugin. Then you set a separate refresh on the dashboard to keep the data up to date. ... View more

You may also need to give the user access to the sos and sos_summary_daily indexes. ... View more

There are three separate items in play here; the hardware limit, the User-level limit and the Role-level limit. Your hardware limit will not change, if it can only handle 13 concurrent searches you will never be able to exceed this, regardless of what is applied to the user and role. The User-level limit is the number of searches a single user with that role can run, If it is set to 8 any user with that role can run up to 8 searches before receiving limit warnings. Now, there is also a Role-level limit. This is a shared limit between all users with that role. Lets say this is set to 10... User A is running 5 concurrent searches, at the same time User B attempts to run 7 searches, both users have the permissions to do this, but User B will receive limit warnings because the total number of concurrent searches for the role has now exceeded 10, (5+7=12). ... View more

Most of the default settings are helpful for understanding how role administration works, but should be customized for your environment. You will never be able to exceed the hardware limits, but hitting the limit will result in queued searches and poor user experience. Other things to watch out for are a high volume of real-time searches, scheduled searches and dashboards running inline searches. All of these are competing for the same pool of resources. So, if you have admin/power users who are creating and consuming without consideration for search-head resources it could cause issues for other users. If you are able to, I would recommend installing the S.O.S. app. It's great for troubleshooting resource issues. http://apps.splunk.com/app/748/ ... View more

Here is a link to the timeformat http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Commontimeformatvariables ... View more

Have you tried using the top command? This will give you a count and a percentage. | top 10 field ... View more

What we have done is to create separate apps, we call them "workspaces", for each group. A Role is created for the group/department and assigned write access for their app. (this is done via the app management) If the data for a group needs to be segmented we would create a separate index, the groups Role would then be given access to this index. (this is done via access controls) You can learn more about assigning the permissions here. http://docs.splunk.com/Documentation/Splunk/6.0.3/Admin/Aboutusersandroles ... View more

For reference: http://en.wikipedia.org/wiki/Cron http://docs.splunk.com/Documentation/Splunk/6.0.3/Alert/Definescheduledalerts#Schedule_the_alert ... View more

That should run at noon every day ... View more

I've found that you do want to include _time in information you are summarizing. Otherwise Splunk will apply the time based off your search. If I am summarising events I like to table out all of the necessary fields, then perform calculations after the fact. I've found this allows me to run fewer summary searches, and achieve better performance. When doing this you must specify your fields. Allowing _raw to sneak into your summary will cause problems. ... View more

Are the permissions for the searches/reports powering the dashboard also allowing user A to view them? If the user does not have permissions to also view the report it may not allow access to the saved/scheduled search. Additionally, What is the alert expiration for the scheduled search/report? This could be causing the report to expire before the next days report has run. You can also check the Activity > Jobs to insure the search is running and caching results. ... View more

I dont expect anyone to respond, but I found a specific problem that was causing similar issues. If there is a menu shared globally with the same title (usually default) It will override all settings for any local app menus that have the same name. In my case it all objects for a TA were shared globally, including a default menu. ... View more