You have to use the drilldown element as linked here: http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/PanelreferenceforSimplifiedXML#Drilldown_elements With the link value, you specify the separate view that you want the drilldown values to get passed to and then list out the values separated by "&". The following two xml examples show how to set up drilldown options in one view, and how to accept them in the second view. This first view (we will call the dashboard "test1" will generate a table of values sourcetype, component, name and count. When you click on a value in the table, the sourcetype, component and name of that row will be sent to the second dashboard (we will call test2). Dashboard xml for "test1" which has the drilldown table: <dashboard> <label>test1</label> <description/> <row> <panel> <table> <title>Test for drilldown case</title> <searchString>index=_internal | stats count by sourcetype, component, name</searchString> <earliestTime>-60m@m</earliestTime> <latestTime>now</latestTime> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <drilldown> <link> <![CDATA[ /app/search/test2?form.sourcetype=$row.sourcetype$&form.component=$row.component$&form.name=$row.name$ ]]> </link> </drilldown> </table> </panel> </row> </dashboard> Dashboard xml for "test2" which accepts the drilldown values passed from "test1" dashboard: <dashboard> <label>test2</label> <description/> <row> <panel> <event> <title>drill down panel</title> <searchString>index=_internal sourcetype=$form.sourcetype$ component=$form.component$ name=$form.name$</searchString> <earliestTime>-60m@m</earliestTime> <latestTime>now</latestTime> <option name="wrap">true</option> <option name="rowNumbers">0</option> <option name="dataOverlayMode">none</option> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <fields>["host","source","sourcetype"]</fields> </event> </panel> </row> </dashboard> You will notice that the values get passed via the url and the search in the "test2" dashboard panel is populated with the values passed from the row clicked on in "test1". ... View more

Most likely this is due to the instance being busy and responding to the rest endpoint query is taking longer than the default time that Splunkweb waits for a response, which is 30 seconds by default. This can happen more frequently on search heads that service many users or have a large number of scheduled searches that are running in the background with a large dispatch directory. Looking in the web_service.log will show results like these: 2013-09-25 18:52:11,076 ERROR [5243921ef67fd8b01eae10] search:227 - Splunkd daemon is not responding: ('The read operation timed out',) Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/search.py", line 224, in dispatchJob job = splunk.search.dispatch(q, sessionKey=cherrypy.session['sessionKey'], **options) File "/opt/splunk/lib/python2.7/site-packages/splunk/search/__init__.py", line 268, in dispatch serverResponse, serverContent = rest.simpleRequest(uri, postargs=args, sessionKey=sessionKey, rawResult=True) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 443, in simpleRequest raise splunk.SplunkdConnectionException, str(e) SplunkdConnectionException: Splunkd daemon is not responding: ('The read operation timed out',) There is also a helpful view in the Splunk S.O.S. app called "HTTP Response Times For splunkd" that will show more detail on response times and what is being accessed: Every time that the response is longer that 30 seconds, you will get a 500 error when trying to access that object. To allow Splunkweb to wait for a longer period of time that the default 30 seconds, you can edit the $Splunk_home/lib/python2.7/site-packages/splunk/rest/__init__.py file and change the value of the following line: SPLUNKD_CONNECTION_TIMEOUT = 30 to a value that is suitable for your response times. In the above case, changing this value to 50 or 60 would probably work since we had a few instances where it took 30 - 40 seconds. Once this is edited and saved, you will need to restart the Splunk instance in order for the change to take effect and then you should no longer get the 500 errors as before. ... View more

This is a known bug in 4.3.1 and 4.3.2. The bug is SPL-50576 and has been fixed and will be released with the 4.3.3 version of splunk. In the mean-time, the work around is as follows: You must define a [tcpout:nothing], give it a false address, and tell it to drop events on queue full as shown in below example: [tcpout] defaultGroup = nothing [tcpout:nothing] disabled = false server = falsefoo.bar.com:9998 indexAndForward = true dropEventsOnQueueFull = 1 [tcpout:firstlocation] disabled = false server = foo.bar1.com:9998 sendCookedData = false indexAndForward = true [tcpout:secondlocation] disabled = false server = foo.bar2.com:9998 sendCookedData=false indexAndForward = true This will circumvent the problem with routing to a non-existant group and index all data as normal, also routing any other data you have set up to go to the other output stanzas as expected. ... View more

When splunk is shut down improperly, sometimes it will leave behind a corrupted PID file in $SPLUNK_HOME/var/run/splunk directory and this error will show up when ./splunk start, restart or status is run. The following steps should help resolve the issue: run ps -ef and make sure that Splunkd and Splunkweb are not running. Then move splunkd.pid and splunkweb.pid from $SPLUNK_HOME/var/run/splunk directory to a temporary directory. Then try running the command "./splunk status" The error should no longer show up. After that try restarting and splunk should start up without the warning. ... View more

You must add the following stanza in $Splunk_home/etc/system/local/searchbnf.conf [CustomCommand-command] syntax = CustomCommand <field> description = This is a description of my CustomCommand usage = public Once this is added and splunk is restarted, the command should pop up in the search help when you are typing in your relevant search. ... View more

I believe I found the answer: <param name="charting.chart">column</param> <!-- Define Min and Max Range of Y axis --> <param name="charting.axisY">numeric</param> <param name="charting.axisY.minimumNumber">96.00</param> <param name="charting.axisY.maximumNumber">100.50</param> <param name="charting.axisY.includeZero">true</param> <!-- Define Unit --> <param name="charting.axisLabelsY.integerUnits">false</param> <param name="charting.axisLabelsY.majorUnit">0.5</param> <param name="charting.axisTitleX.visibility">collapsed</param> <param name="charting.chart.nullValueMode">zero</param> ... View more

To learn how to create a custom form search and use check boxes/radio buttons, the following link will start you from the beginning: Form Infroduction For more information on setting up radio buttons, which are like check boxes, the following link describes it in detail: Creating Radio Buttons ... View more