Nope, not yet. Using Task Scheduler for now... (It's only on one machine.) ... View more

@martin_mueller, I agree education is the best approach, so I continued with getting the CSS hack to work. This is the file I ended up appending to: Splunk\share\splunk\search_mrsparkle\exposed\build\css\bootstrap-enterprise.css using this code: .search-name:after{font-size: small; font-weight: bold;background:none; content: "You should always use an index in your query. To understand why visit the Splunk FAQ"} Worked like a champ, and I found out that because this is a global CSS file the reminder shows up in every search bar regardless of the UI app. ps. We thought about limiting the indexes to a smaller list, but the current expected behavior is that it is searching everything, so it would be harder to communicate that out, rather then using friendly reminders. We also send out weekly reminders to any users that performed a search without an index during the last week. ... View more

Interesting... There are some "creative" ways to use CSS to modify content after the fact. I'll have to try. I think you can also swap out text for an image using CSS. I'll post back m findings. (But would still like to know where the source of the search dashboard is...) ... View more

adonio Thanks for the quick reply. The idea isn't to restrict who can see what, but to insure that an index is used in the query, and I don't mean index=*. A lot of our users will use Splunk like they do google and just throw in a key word or error message, the idea is to remind them that using an index speeds up the query by a factor of 10. Also I would like to include a link to our Wiki on why it is important and some common indexes that they could be using but aren't. Cheers, Paul ... View more

Thanks Nick for the response, I had already started down the road of wrapping the ButtonSwitcher: In the flashtimeline.xml I added a customBehavior module before the ButtonSwitcher and my custom ResultsHeader before the other three result tabs (Event list, Table and Chart). switchTabsOnContextChange if (typeof(Sideview)!="undefined") { Sideview.utils.declareCustomBehavior("switchTabsOnContextChange", function(myTabSwitcher) { var methodReference = myTabSwitcher.onContextChange.bind(myTabSwitcher); myTabSwitcher.onContextChange = function() { var buttonswitcher = this._children[0]; var activechildindex = buttonswitcher._activeChildIndex; if (activechildindex == 0) { buttonswitcher.setActiveChild(1); } return(methodReference); } }); } And all of this appears to be working fine except that the checkCompatibilities code is acting up, so an events list search will often pick my home page tab. My first query is 'system' and I will see my results in the event list as my custom code switched it to the second tab. My second query is 'system | timechart c by host' and I click it to the chart tab. Now if I run just 'system' again, it flips to my home page tab instead of the event list tab. Almost like the setActiveChild is going to 0 instead of using the tab title of Event List. Would marking my tab as Incompatible be a good approach? I must be missing something simple. Or should I start over using a Switcher module? So you are saying to insert a Switcher after my customBehavior and before the ButtonSwitcher and have a custom behavior use getModifiedContext()? I'll look at the examples and try this way as well, I've got nothing but knowledge to gain. Thanks again, Paul ... View more

After a lot of additional reading I've realized a few things. A ButtonSwitcher can not have a custom behavior. I don't really want to hide the first tab, I just want to switch tabs to the second one when a search is started. A tab module under the ButtonSwitcher can capture an onContextChange event, but I can't figure out how to call the ButtonSwitcher's setActiveChild method to switch from the first tab to the second tab. Does this mean that I need to wrap the ButtonSwitcher module with something that can have a custom behavior or find a way to call the parent's setActiveChild method? Paul ... View more

OK, that was kind of what I thought. So does the interval time, say 5 minutes, start from the time that the last execution ended? Or does Splunk think that it needs to run again immediately because it missed the last time? My choice is to have Splunk run a database dumper executable on a timed interval, or have a Windows Service run continuously and do all of the work and just have Splunk read its output. Paul ... View more