Hi, Not too long ago I made an audit dashboard with input forms/date pickers etc. My team wants a scheduled report send to our mailbox. So I cloned the audit dashboard and made it static by removing the forms/date pickers etc. But still I don't see the option "Export > Schedule PDF delivery".. I only see Export as PDF, which downloads the current dashboard. But I should be able to schedule a report now right? Only thing which might conflict is a dashboard-item which shows the used commands in the last 7 days.. But everything works on it's own without input.. I'm I missing something here? Thanks. ... View more

Hi, I'm a trainee at my company and soon I'm leaving. I created several dashboard, but want to change ownership of the dashboards because my account will be deleted. I'm not sure if the dashboards will be deleted too. We currently use an "App" in splunk for our department. I read online that I can change it here: Setting > All configuration > Reassign ownership But I don't see "Reassign ownership"? Is it still possible in this version? Or how can I do this. ... View more

Hi all, I inserted a submit button in a form in the source code of a dashboard, but that's not possible, unlike an input field. Input fields can be placed inside dashboard items. My guess is that the source code isn't being compiled and gets stuck on "loading...". The problem is that I can't access the source code because I can't click on Edit. Is there any way to undo my last change or access the source code somehow? I read something about using Element inspect, but I'm not sure on what to change. Thanks. ... View more

Hi all, I currently have a table showing all used commands from a specific machine. Search is something like this: source="/var/log/log" | stats count by comm | table comm, count | sort by count desc | head 10 This shows the top 10 used commands. Now I would like to search for specific commands using an Input field and submit button. I would imagine the search would be something like this: source="/var/log/audit/audit.log" comm="*$Token_Name$*" | stats count by comm | table comm, count | sort by count desc | head 10 But I don't understand how I can use the input field to alter the existing table.. How should the input field be configured and how do I make the existing table use the input? Or does the input field create a table with given value? I hope my question is clear.. Thanks! ... View more

Hi, Currently I use this search: index=Linux | search host!="test*" | timechart span=1d count by HCS | timewrap 1w To get the following result: But as you can see, there are some results with 0 because of the count. I want to exclude everything that is zero. I thought of something like this: index=Linux | search host!="test*" | timechart span=1d count by HCS where count >= 1| timewrap 1w But that doesn't seem to work.. What would be a correct way of excluding zero values? Thanks! ... View more