@sshahmoon, FYI, Above rex works too. However, ? is missing in that regex. Try this, | rex field=yourfield "^(?<yourfield>\D+)" Thanks, Sandeep ... View more

@the_wolverine, You can restrict the users using roles and capabilities from Access controls. The one capability you can remove is "output_file" : Lets the user create file outputs, including outputcsv (except for dispatch=t mode) and outputlookup. Above is the definition from Splunk docs. You can also control the user access from local.meta file. Remove write access to those users for a specific file. Hope this helps. Thanks, Sandeep ... View more

@Hppjet , Can you elaborate your problem? Do you need to see the data between 11:30PM to 11:30PM when you select "Today" in time range picker? From the time range picker, select Date & Time range option and provide your custom time. OR You can create your own custom time ranges at any time by going to Settings -> User Interface -> Time Ranges Thanks, Sandeep ... View more

I can see that minimum disk space is fallen below 5000MB. This will stop searches. As a workaround, change that to 1000 or 500MB and give a restart. I used to do this every time. Once our /OPT folder increased to 60GB from 6GB, I changed back the setting to 5000MB. ... View more

@nick405060 , It's strange really. Can you post those errors? Also, make sure there are no special characters inserted in .conf files. Check recently changed .conf files. I usually press "CTRL + C/V/S" while doing changes in VI editor. I had this issue sometime back, After the restart Splunk web was unavailable. It took sometime for me to figure out the error. ... View more

@nick405060 , Do you see any error messages related to dispatcher? I used to see same error when all of our installation space occupied by a large search. As soon as we stop that search, we get back our space and then searches will run normally. Try to use default values in your limits.conf and give a restart. Thanks, Sandeep ... View more

@knst, This approach uses more Splunk license and storage space. When it comes to clean, Either use Delete keyword or Clean CLI command. However, Delete only hides from visibility and you won't get your storage back. Clean can be used to flush out data from storage. Use it with very caution. But, I have never tried to clean part of an index [however, cleaned entire index]. Best thing is to filter duplicates before sending to Splunk. PS: Splunk doesn't suggest clean on PRODuction systems. Thanks, Sandeep ... View more

@renjith.nair, We are having the same problem and getting the same HttpListener error message as above. We are on 7.1.2, I am trying to secure my Splunk Web using 3rd party certificate. Enabled SSL, privKeyPath and serverCert in web.conf as suggested in docs. I see this error as well : "[initandlisten] ** WARNING: No SSL certificate validation can be performed since no CA file has been provided " Do I need to provide caCertPath in server.conf to avoid this error? Thanks, Sandeep ... View more

Hi @sd306, This is very helpful for me. I love the way you wrote both the scripts (easily readable). What are the changes needed for RHEL 7-64? Thank you for the great work. Sandeep ... View more

@tiagofbmm, Wow strange. Can you post a snapshot if possible and Splunk version please? Thanks, Sandeep ... View more

@patb23, Which log source is unique "Type1" or "Type2" ? Try to keep unique log source with policyNo in the subsearch and join the duplicate events source with the unique events source. If both the sources have duplicates, It's difficult to achieve the JOIN functionality. What exact output are you expecting? Thanks, Sandy ... View more

@niketnilay, Thank you for the nice explanation about the CSS selectors. I will definitely follow inspector tip. And, This worked beautifully - https://answers.splunk.com/answers/659719/how-to-add-style-to-panel-titles-in-my-dashboard.html Is it possible to increase font size of the table contents and x-axis/y-axis values of chart in the same way? Thanks, Sandeep ... View more

@niketnilay, I have the same requirement. I am using the above code in my dashboard. But, it is changing the font of chart/table title instead of main panel title. <panel> **<title>failed passwords: I need this bold and big in size</title>** <chart> **<title>But, This is bold and big</title>** <search> <query>index=buttercup source=*secure* *fail* |eval User2=USER | timechart count(USER) by User2 span=1d | fields - NULL</query> <earliest>0</earliest> <sampleRatio>1</sampleRatio> </search> PS: I can't attach because of less karma points. So, tried to simulate my need with code Thanks, Sandeep ... View more

Hi @niketnilay, Here is my xml and js respectively. I have used your xml and js file. Followed this answer: https://answers.splunk.com/answers/581652/how-can-i-create-a-button-switcher.html I have created a hidden filed which gets populated with button click action. panel "Summary" depends on this field for the submit button functionality. <form script="srch_btn.js"> <label>Dashboard with multiple input panels and Submit</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="text" token="tokSearchOne"> <label>Search One</label> </input> <input type="text" token="tokSearchTwo"> <label>Search Two</label> </input> <input type="dropdown" token="tokAppFilter"> <label>App</label> </input> <input type="time" token="field6"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="time" token="field6"> <label></label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input depends="$hidden$" type="text" token="searchbtn"> <label>searchbtn</label> <html> <button id="srch_btn" class="btn-primary">Search</button> </html> </panel> </row> <row> <panel depends="$toksearchone$,$tokSearchTwo$,$tokAppFilter$,$searchbtn$"> <title>summary</title> <table> <search> <query>index=_internal | head 1</query> <earliest>$field6.earliest$</earliest> <latest>$field6.latest$</latest> </search> </table> </panel> </row> </form> my "srch_btn.js" code: require([ "splunkjs/mvc", "splunkjs/mvc/simplexml/ready!" ], function( mvc ) { var defaultTokenModel = mvc.Components.get("default"); var submittedTokenModel = mvc.Components.get("submitted"); $("#srch_btn").click(function(){ defaultTokenModel.set("searchbtn","true"); submittedTokenModel.set("searchbtn","true"); }); }); This has worked properly last Friday. Now, my hidden field is not getting populated as a result Summary panel is waiting on this. I have used completely wrong JS code (wrong keywords) in order to see the errors. But, nothing is happening after button click. Do you see any code mistake? Thank you. ... View more

@niketnilay, I am using this code with JS. Buttons worked as expected on Friday. But, from yesterday buttons stopped responding. I have added debug messages in JS and ran dashboard. I haven't seen any debug message. No luck even after Splunk restart and refresh. What could have happened and what went wrong? My Splunk version is 6.5.2. Thank you. ... View more

@niketnilay, Definitely I will use this drop down method. I have made a note of it. Thank you for your help and learning a lot (specially coding) from your answers. ... View more

@niketnilay, This is wonderful. I was trying the same way as you suggested. However, input type="text" worked for me. But, this input type="dropdown" doesn't worked for me. I have created dropdown as below: <label>App</label> <input type="dropdown" token="appname" id="appnameid" searchWhenChanged="true"></input> But, Your code is perfect. Thank you so much. ... View more

@niketnilay, Thank you so much for the quick response. I have been following this answer https://answers.splunk.com/answers/581652/how-can-i-create-a-button-switcher.html from sometime. Only thing I was looking for HTML text input and dropdown tags to fit there. But, I couldn't find them. I will go over Jason blog andtry if I can find those tags. ... View more

PS: The page in the attachment is built with django framework ... View more

Thank you so much. This is wonderful piece of information. I will definitely use. ... View more

Perfect.. Thank you so much. looking for this kind of access for some time and it worked amazingly. ... View more