About shipitsquirrel

shipitsquirrel · ‎02-21-2024

Thanks for the help! Do you have an example of what it looks like to share a search globally? I've read lots of forum posts and Splunk Docs but haven't gotten a clear answer on how to configure this in the .conf file.

shipitsquirrel · ‎02-21-2024

I'm trying to make it so any search on my KV store will be filterable by the timepicker. So if I were to search |inputlookup {collection_name} I would get back all the entries from my collection based on the selected time range. Are you saying that since it's a KV store I'll need to include time constraints in each query to make this work?

shipitsquirrel · ‎02-20-2024

Hello all, While developing my Splunk Add-On, I've run into a blocker concerning the timepicker on search. Currently, changing the time from the default "Last 24 Hours" to any other value has no effect and the search always returns all of the elements from my KV store. I've read through about a dozen forum threads but haven't found a clear answer to this problem. Any help with what settings/files need to be configured would be appreciated! I am developing in Splunk Enterprise 9.1.3

shipitsquirrel · ‎02-20-2024

Hello, I'm currently developing a Splunk app and am having trouble bundling saved searches to appear in the Search & Reporting app. My intention is to include a list of searches in my app package (in savedsearches.conf or elsewhere) that will appear in the Reports tab of S&R. I've done some digging but haven't found a solution that works. Is this possible? I'm developing in Splunk Enterprise 9.1.3.

Posts	4
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎02-20-2024

Online Status	Offline
Date Last Visited	‎02-23-2024 10:25 AM

Assigning a field to be used by the timepicker

Populate Reports page in "Search & Reporting" page...

Re: Populate Reports page in "Search & Reporting" ...

Re: Assigning a field to be used by the timepicker

Assigning a field to be used by the timepicker

Populate Reports page in "Search & Reporting" page...