Is "pivot_adhoc_acceleration_mode" in web.conf set to "Elastic?" This is the default, but you may have a conflicting setting in your local web.conf. ... View more

This isn't exactly what you're asking for, but there is a UI workflow to narrow down the time window around a specific event to see what happened immediately before and after that event in 6.x Click on the arrow next to the event you want to investigate in "List" view. Scroll down to the time section of the fields listed underneath the event and click on the _time You'll get a pop-up with some options to look at events before, after, or near this time. Choose what makes sense. Search will re-run with your time range in the time picker. If the events you want to investigate are in a separate index or require more keywords/filter terms, you can change that and Splunk will continue looking within that time window until you change the time range in the time picker. If you want to continue zooming out after this, you can use the zoom out controls on the green timeline. ... View more

Take a look at the pivot search command. Pivot Command Docs Field lineage is used to prevent name collisions. Since the Pivot command specifies an object, you can use fieldName sans qualification. If the Data Model is accelerated, it will build the tstats query for you. You can get an idea of how to build | pivot searches by using the UI and then clicking "Open in Search." ... View more

We store this order in user-prefs.conf under the appOrder attribute- there's a local and default version of this. If the user drags and drops the panels, we'll save their specific order to $SPLUNK_HOME/etc/users/USERNAME/user-prefs/local/user-prefs.conf To set the default for all users, go to $SPLUNK_HOME/etc/apps/user-prefs/default/user-prefs.conf ... View more

What browser are you using? The behavior did change from 5.0 to 6.0 to no longer default to opening a new tab. ... View more

To open in a new tab when drilling down from a dashboard or pivot, you can use command/ctrl + click. This isn't supported in the search page yet. ... View more

Hi Marc, We don't currently support this type of organization for searches and reports. As a workaround, you could build an App with custom menus and views to organize your knowledge objects (http://docs.splunk.com/Documentation/Splunk/4.0.11/Developer/TieViews). You can also file an enhancement request by submitting a Priority 4 - Enhancement Request ticket at http://www.splunk.com/index.php/submit_issue ... View more