Hi, I really like the new dashboard beta app. My question - lets say i have a dashboard that i have created inside the app(json), can i use the code in this dashboard inside the regular splunk environment? can i create a costum app that will "call" the dashboard beta and present it? (without being inside the app itslef). Thanks. ... View more

Hi, I have a choropleth  dashboard with a divergent color mode set up. The dashboard uses only 2 fields to display results - count, country. I want to change the divergent color mode to colors of my choosing.  (green, orange, red) I tried using "mapping.fieldColors", also tried using ""mapping.seriesColors", but nothing seems to work. What am i missing here? Thanks in advance.   ... View more

Hi, I have a lab setup with 1 SH, 1 Master node, 2 indexers peers. My question is, which one of the indexers should act as the receiving server (from light forwarders). Both of them? Thanks ... View more

Hi guys, I have an issue with splunk ES, any help would be much appreciated. The symptoms - some correlation searches (under content management) does not translate to incidents (under incident review). When i search for the manuali for the events they appear fine. When i search for the events under index=notable, they also appear. the action that creates notable events is working. So why is the system doesn't generate incidents for some correlation searches? Thanks in advance, Itzik ... View more

Hi guys, I need to build a search that compares 2 different indexes. search 1 - index=indexname1 suser=username act=select search 2 - index=indexname2 duser=username act=select I need to compare the time stamp between the field values "suser" and "duser" (the value of "suser" and "duser" results in the same username). Also, both indexes have the values "suser" and "duser", so it's kind of confusing. I would like to display it on the same table. Anyone knows how to accomplish that? Your help would be highly appreciated. ... View more