You should also be able to delete within the UI. On the datasets listing page, there should be a "Manage" item in each row. For a Table dataset created with the new Table UI: 1) select Manage for the dataset you want to delete 2) select "Delete" from the menu that opens up under Manage For a Data Model: 1) select Manage for the Data Model you want to delete 2) select "Edit Data Model" from the menu that opens up under Manage (this will take you to the editing page for that Data Model) 3) in the upper-right portion of screen, you should see the options: Edit|Download|Pivot|Documentation 4) select Edit, which will result in a little menu opening up 5) select Delete from the Edit menu and then on the Data Model's editing page, under the "Edit" menu in the upper-right (just under the Settings and Activity part of the Splunkbar) there should be ... View more

Victor, I'm glad that you got it working. I'll make sure that this information gets to our engineering teams so that we can hopefully identify root cause and make sure this doesn't happen again. ... View more

Victor, Hope SplunkLive went well. I'll be out of the office for a scheduled medical procedure for a while starting Friday. If you need further help at that point, please reach out to the support team. Andrew ... View more

Victor, I'm sorry you're running into this. I set up this redirect in order to make sure that system migrations worked. Unfortunately, it looks like it didn't work for you. Generally: The datasets page lives in the search app and should have system-wide read permissions set via default.meta. Thus, it should be accessible via any app context in splunk. That is, /en-US/app/appname/datasets, should work for any appname. This is the same way that the search page, the pivot page, and all other standard pages are set up. I'm very curious as to why you don't seem to be able to access this from apps that you made previous to the 6.5 upgrade. This would be the first thing that I would try investigating. Can you access the "dataset" (no s) page from the same apps? How about the older pages that have the same system-wide access, like job_manager and date_model_editor? I will do my best to help you out here, but, for the most in-depth investigation, I'd recommend filing an issue with our support team. Again, I'm sorry this isn't working for you, and I hope we can get to the bottom of it quickly, Andrew ... View more

great. as you're probably aware, changes like this are likely to break during upgrades. Hopefully the PM can find a way to expose a configuration for you and customers in a similar position. Have fun with 6.4.x! There's some great stuff in it. ... View more

what version were you on previously? and did you see the limit then? ... View more

I will relay this to the PM responsible for the navigation bar. I believe the current limit there is 500 searches. ... View more

Which drop-downs are you referring to? ... View more

You can use the savedsearch command to integrate any report (saved search) into another search. If your report is named mysearch, | savedsearch mysearch | where user="arobbins" or ip="127.0.0.1" ... View more

There is no built-in solution to this at this time. However, if you download the Splunk 6.x Dashboard Examples App (https://splunkbase.splunk.com/app/1603/) there is an example of how to customize a dashboard to achieve cell coloring. ... View more

OK... so since field1,field2,field3,field4 are null when you get to the pipe with fillnull, the search processor doesn't know that they exist, and therefore cannot fill them with null... try: ... | fillnull value=NULL field1,field2,field3,field4,field5 | ... that should explicitly tell the fillnull processor that those fields exist and need to be set. ... View more

if you're using the preview_results endpoint with output_mode:json_rows, you should be able to set the field_list to include the fields you want. Those fields then should come back even if all the values are NULL. ... View more

You're not doing anything backwards -- you just need to lookup into a different KML/KMZ. As you figured out, geo_us_states will only work if your featureId maps to state names. Similarly, geo_countries will only work if your featureId maps to country names. You need a KML/KMZ file that maps to zip codes. Here is a link to the blog post that @mporath wrote about adding your own KML/KMZ lookup files: http://blogs.splunk.com/2015/10/01/use-custom-polygons-in-your-choropleth-maps/ Good luck! ... View more

your first case works because featureId is a field that it output from lookup your second case does not work because featureId does not yet exist index=main | stats count by foo | geom geo_us_states featureIdField=foo should work if foo is in index=main, and the values of foo map to the names of US states as stored in geo_us_states. To see what is expected, check out geo_attr_us_states ( |inputlookup geo_attr_us_states ) ... View more

@mikenagra, I'm not sure if I understood your comment completely. I think that you stated that you can only use geo_countries in the geom command IFF geo_countries was used in the lookup command previously. This is not quite the case. geo_countries, and geo_us_states are geo-lookup files. They can be used by two commands: lookup and geom. Lookup uses the geo-lookup file to derive a region id (featureId) from specified per-row lat & lon Geom uses a geo-lookup file -- and the field specified by featureIdField (defaults to "featureId") -- to insert a GeoJSON blob into the result set that represents the border of the referenced region. If you derived the featureId via some method other than using lookup you may use geom with geo_countries or geo_us_states as the other reference to the geo-lookup file. ... View more

... I'm not sure how to help with that... but I'm going to get in front of someone who may... stay tuned... ... View more

the choropleth map will only show a single aggregate split by region... given that your aggregate is count per region, that is what the choropleth will show ... View more

Could you post your entire search? ... View more

All instances of this issue that I know about can be traced to the issue described in tyronetv's answer above. ... View more

Another option you could possibly use: make a templatized simple XML page. The first panel could be an HTML panel with $name$, the page level search could be $search$ and the second and third panels could be a chart and table that use the page level search. Check out the Splunk 6 Dashboard Examples App on apps.splunk.com to see a variety of examples (nothing quite like what you're looking for, but enough building blocks to put it together). If you want to explore this method, let me know and I'll point our Simple XML experts at this question. ... View more

I'll point the PM in charge of viz at this. Thanks for the suggestion! ... View more