If the Javascript is not loading then there is a problem with the Splunk "cache" not being bounced or you are restricted from accessing the dashboard.js file that is in the etc/apps/spgt_*/appserver/static directory. Please restart your Splunk search head if you have not yet done so. The app needs a restart after download due to new files being present. (Splunk can't see new files unless it is bounced, thus adding the new objects to application cache) If you restart the search head and are still having the issues then you have browser caching issues. You will need to bounce your browser to make sure that there are no overriding cached values in place. If you still don't see the change then follow this link for other caching tips..... https://onedrive.live.com/redir?resid=7B40CF5975EEE325%21122&authkey=%21ALYIlLvXByjSyPA&page=View&wd=target%28Champions%20Content.one%7C5948d5c6-ce55-5049-b8a0-41498ac4bbbc%2FSplunk%20Bits%20Restarting%20and%20reloading%20Splunk%20Enterprise%7C6de63680-0b27-434d-afb0-e69f8ae4a90f%2F%29. If you keep zillions of tabs open in your browser then this can be a chronic issue... If the file is then "seen" by splunkweb AND your broswer has no cached overrides you should be good. If not its a permissions or soft-link routing issue. ... View more

We have an instance in AWS that is running java version "1.7_101". Should that make a difference, Damien. Thanks for your help. ... View more

Please download and look at the Splunk Dashboard Examples app ( https://splunkbase.splunk.com/app/1603/ )that was built exactly for this usecase. There are many examples of how to use SINGLE VALUE in many creative ways including where your drilldowns go and where you want to place your drilldowns. Please install the app on your Splunk instance and go to the Single value area where you simply cut and paste the examples into your app and change out the appropriate searches to get your desired effect. It could not be easier. Another tidbit of advice. IF you are looking to do anything new with your Splunk UI the answer is always YES. Google it, get it from the Examples, do Google searches for "Splunk Viz Apps". Its exciting stuff. If you can't follow email [email protected]. I have created single value animated gifs to emulate multiple stages of severities through visual cues such as motion and color. Its really a highly extendable visualization with CSS. ... View more

Shane. I am surprised. I will figure this out for you personally. I am sorry for the tardiness in getting this resolved for you. Your contributions to Splunk are numerous. ... View more

You really only need three data points here. A push, a pull, and a count. And then you should have a fine Force directed graph. So table out the data to fit this criteria. ... View more

Got it all figured out… In my situation the user tried to install a Forwarder OVER a full Splunk installation, not understanding the process. He had to back out of the install due to errors. The documentation clearly states Important: Do not install the universal forwarder over an existing installation of full Splunk. This resulted in the disappearance of splunkd in the services manager. Upon uninstalling the services as part of a reinstall, even though I was deleting the Splunk services manually they were not being released in memory so I could not overwrite them when I went to do a new install. Whenever I went to reinstall I got the error message: "Splunk Installer was unable to create Splunk Services. Please make sure that the user running the installer has the correct privileges, including being able to create Windows Services. Exitcode='1'". ANSWER: Make sure that the Splunk install folder does not have "read-only" anywhere within its properties. 2. Bounce Splunk after you do an installer uninstall on Windows or you manually delete the services. Windows will not always release the memory. It makes it appear as if its a permission issue which is common on Windows2008 r2 which only exacerbates issues. ... View more