Okay after some more research I found out that Splunk isn't parsing the token as a query, but as a string. 03-07-2018 21:49:45.182 INFO SearchParser - PARSING: search "| makeresults count=1 | eval test=\"Hello\"" After passing the string through a macro, everything works as expected | makeresults count=1| eval query = "| makeresults count=1 | eval test=\"Hello\"" | map search="`getSearchAsString($query$)`" maxsearches=1 where the macro is defined as [getSearchAsString(1)] args = search definition = $search$ iseval = 0 ... View more

Okay then how about setting the token in the done section of the search? Although I could not find a solution to get the real search string, try this with the optimizedSearch string as shown: <panel> <event> <title>Base Search</title> <search id="baseSearch"> <query>index=_internal | where $earliest$ &gt; 0</query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <set token="query">$job.optimizedSearch$</set> </done> </search> <option name="list.drilldown">none</option> </event> </panel> <panel> <event> <title>Double used Base Search</title> <search base="baseSearch"> <query>$query$</query> </search> <option name="list.drilldown">none</option> </event> </panel> ... View more

The base search will only run once and the post-process search will use the cached base search as starting point for its post-process search. However if your base search needs to be refreshed it will influence all post-process searches that are based on it. ... View more

Any errors visible in your _internal logs on your indexer? Maybe permission issues? Note that Splunks config are case sensitive, maybe a mistyping in your path? ... View more

I assume these configs are on the UF. Have you defined the index on your Linux box? Also have you enabled the port listening on the indexer? And is the IP reachable from the UF? ... View more

You can use a time-based kvstore lookup. This will compare the event time with the defined time field in the kvstore. A useful primer would be the previously questions answers here on this forum: https://answers.splunk.com/answers/209693/time-based-lookups-and-kvstore.html for example. However if your event time differs from the hourly digit in your table, you should try to modify your _time value before doing the lookup. ... View more

You can define your query in a token that can be set in an init section of your dashboard. Here's an example: <form> ... <init> <set token="query">your repetitve search</set> </init> <row> <panel> <event> <title>Tokenized Based Query</title> <search id="baseSearch"> <query>$query$</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="list.drilldown">none</option> </event> <event> <title>Tokenized Append Search</title> <search base="baseSearch"> <query>| $query$</query> </search> <option name="list.drilldown">none</option> </event> </panel> </row> </form> Note that you don't need to state the base search in your postprocess seach. ... View more

Splunk's nativ deployment process using a Deployment Server is not a syncing process, more a delete and push whats on the DS. So if you edit the dashboards in the apps on the search head, rather than the apps on the DS, you will loose all progress. Better to set up a repository that is synchronized with DS and develop on the repository, instead on the machines itself. Hope I could clear your understanding of Splunks deployment process. ... View more

Okay and have you already tried setting the TTL (time to live) of your search job? See http://docs.splunk.com/DocumentationStatic/JavaScriptSDK/1.0/splunkjs.Service.Job.html under setTTL for an example. ... View more

Hi @faustf, I haven't used this SEARCHER_AUTO_CANCEL_JOB_SEC parameter yet, but if you want to reduce the expiration time of your results, limits.conf is the way to go. See https://answers.splunk.com/answers/52973/how-to-set-search-result-no-expiration.html which answered this previously. ... View more

Have you set searchWhenChanged = true on the time range picker? Alternatively why do you parse the time token in your queries? I suggest you to use a changed snippet that transforms the time string constraint directly into an epoch value that can be used in your queries: <change> <eval token="earliest">if(isnum($time.earliest$), $time.earliest$, relative_time(now(), $time.earliest$))</eval> <eval token="latest">if(isnum($time.latest$), $time.latest$, relative_time(now(), $time.latest$))</eval> </change> You can simply add this to the input definition of your time range picker and use the new tokens $earliest$ and $latest$ for time comparisons. You could also add more tokens and formations, depending on your needs. Oh and by the way, in your example (your first query) you also need to escape > into &gt; . ... View more

So I did a bit of research, since I could not find an out-of-the-box solution and as always there are multiple approaches: In my opinion the prefereable way would be to use the already existing system monitoring apps for Windows (https://splunkbase.splunk.com/app/1680/) and Linux (https://splunkbase.splunk.com/app/273/). Although I'm not sure on what level they can be used directly, I think they'll give you a fair starting point. At worst you would need to write your own alerts and maybe add a software installation monitoring system (https://www.raymond.cc/blog/monitor-software-installs-remove-leftovers-install-monitor/) which log files can be indexed into Splunk. However you could also try it from scratch. On Windows, Splunk is able to monitor the registry and you could check any changes for new software installation (https://answers.splunk.com/answers/8005/how-do-i-monitor-only-the-changes-to-windows-registry.html). For Linux there are many more solutions, since there are many more ways to install software on it. For example if you'd like to monitor installation over the APT package manager you should look into https://askubuntu.com/questions/425809/where-are-the-logs-for-apt-get and add it as an input to Splunk. I'm sorry that I can't give you a pinpoint solution, but depending on the vast amount of variables I think that you need to invest some time adapting it to your parameters. Best regards, Bojan ... View more

@jonasm1 can you provide some more information, like on what systems are you planning to log your software installation and maybe the tools you are planning to use for this? The information analyzed by Splunk needs still somewhere to be generated, e.g. using a script or some professional tools. ... View more

Hi @niketnilay, thanks for your solution. I see that - depening on the size - I sometimes get the lowest tickmark and sometimes not. So Splunk does calculate the tick below the lower border. Is there a way to enforce it regardless of the chart size? ... View more

@niketnilay in your solution and in the appended image, I see no tickmark below your lower limit. So I assume that you encountered the same issue without realizing it. What I'm facing is that there is no tickmark below my lower border. The range extension works only for positive values and direction, not for the opposite. So do you may have an idea how to see the next tickmark below my lowest data point (even if it's the border line)? ... View more

@niketnilay, I don't know if this option is supposed to show hidden tickmarks, but in this case it just changes the scale of the panel and adds no more information to it. Can you show me how you implemented the solution? Maybe I'm missing another parameter? Just to confirm the problem: I have a two border sensor range and want tickmarks above the highest and below the lowest, while there are positive and negative values. Up until now I've just finished this for positive values with the charting.axisLabelsY.extendsAxisRange option but it does not work for negative values. ... View more