I found it. User's roles are stored in $SPLUNK_HOME/etc/passwd file. So I you have also to copy that file if you want to sync users between two Splunk instances. To recap: Follow these instructions (and the info in comments) if you have to sync users and roles for the first time. Later, you have to sync only: $SPLUNK_HOME/etc/users $SPLUNK_HOME/etc/system/local/authorize.conf (or wherever you put it) $SPLUNK_HOME/etc/passwd ... View more

With getInstance() you can also create the component if it does not exists. From $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/splunkjs/mvc/registry.js : /** * @param id The id of the instance to return. * @param options (Optional). * @param options.create Whether to create a new token model with * the given name if the specified instance * does not exist. * @return The specified instance, or a falsy value * if the instance does not exist and * options.create is omitted or false. */ getInstance: function(id, options) { options = options || {}; // If an instance with this id doesn't exist, // figure out whether we want to create one or not. if (!this.has(id)) { if (options.create) { this.registerInstance(id, this._createTokenModel(id)); } else { console.error(this.createError("No instance with id: " + id)); } } return this.get(id); }, ... View more

SHORT ANSWER You have to create a $SPLUNK_HOME/etc/system/local/limits.conf file, add the stanza: [restapi] maxresultrows = 4294967295 Furthermore you have to add 0 to your sort search command: query = """ search source=xyz event="watch" | table _time event | sort 0 - _time """ and run in your Python code: service.jobs.oneshot(query, count=0) LONG ANSWER If you dig into the minimal and cryptic documentation: http://docs.splunk.com/Documentation/PythonSDK you can read for job.oneshot() that The oneshot method makes a single roundtrip to the server (as opposed to two for create() followed by results()) So job.oneshot() is a job.create() followed by a job.results() (almost). So it can take the arguments of create() : http://dev.splunk.com/view/SP-CAAAEE5#searchjobparams and the arguments of results() : http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D.2Fresults Since Python SDK is a py wrapper around the REST API, you have also to specify an higher limit for it in limits.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Limitsconf Note that I specified 2^32 - 1 in maxresultrows because if you run this code on a 32 bit machine it hangs: job = splunk_connection.jobs.create(search, max_count=2**32) This is probably caused by a C for loop. From sort documentation: sort <count>+ [desc] <count> Syntax: <int> Description: Specify the number of results to sort. If no count is specified, the default limit of 10000 is used. If "0" is specified, all results will be returned http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Sort ... View more

Short answer Well, it seems that you can't. Long answer: Reference Panels: You can only use Reference Panels. This only works for panels obviously, so you can't use it for inputs, for example. Furthermore you can't customize your reference panel. For example, if you want to change the drilldown behaviour from row to cell in one specific dashboard for that referenced panel, you can't do it. SplunkJS: I think you can add a div id="some_id" and create a javascript view associated with that id. Obviously, you are managing client-side something that should managed by server. This is a problem if security is a concern for you. Advanced XML: I think you can do modularization with Advanced XML, but for what I know its usage is deprecated. Conclusion: Django bindings seem to be the only way to have a proper template system in Splunk. This, IMHO and without offence, makes simple XML completely useless. ... View more