edited developer manual-4.0.3-jpn · k" w$$ bjk" w$$ bjk"" w$$ bjk""...

!"

"

#$%&'("

)*+,-./0123"

4.5678"9:;:<"

=>?" @;;A B CD @E FGHI ;AJ KA L"

MN$OP!QRS"#$%&'(T"U'V:"W%%"X!QRSY"XZYZP[Z\"

!!"

]^"

_`":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"a!)*+,-./0123b_`":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"a!

W$$ bcde"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"@!

W$$ f7g.h7i":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"<!

W$$ bjk"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"K!W$$ bjk"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"K!

lmnopU bjk":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"E!

W$$ q3rbst":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"C!

W$$ )uvwixjy"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"A!

<:z"W$$ b/{|v.i":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"a;!

)}~3i W$$ b��":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"a@!

r,�1�.�bjk":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"a<!r,�1�.�����"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"a<!

r,�1�.�bjk��"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"a9!

��r,�1�.�":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"aK!

���r,�1�.���"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"@@!

}~.o��bjk"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"@E!}~.o������"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"@E!

��}~.o��":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"@E!

r{��,w}~.o��"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"<;!

���}~.o��":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"<a!

��q1.bjk"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"<E!��q1."::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"<E!

��q1.b��":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"<E!

����v,5��5�wib��":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"9;!���b��b����v,5��5�wi�{�":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"9;!

W$$:VN'�"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"9@!

 ¡¢e��"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"9<!

W$$ £,i2,¤¥¦b��":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"99!

W$$ §¨b��"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"9©!

!!!"

W$$ b3,wª27�ª}u.3blmn/{«"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"9A!W$$ b3,wª27�ª}u.3blmn/{«"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"9A!

�q¬.�67­01.blmn/{«":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"9A!

®��x¯.m°q1.±��":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"K<!

W$$ bmn{3b²³"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"KE!

´51.3bcde":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"K©!

´51.3v}µv7m"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"E<!

���i¶,w":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"A@!´51.3bjk":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"A@!

·¸(N ¹7¤v.ibjk"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"A@!

#$%&'( r,�1�.�ºv­7i°»¼½¯}i®�2±¾�¿À"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"A@!

ÁÂÃÄÅ"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"AK!W$$ °-,Æ.5±ÇÈ"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"AK!

#$%&'("ɸYZ bÊË"::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"AK!

ÌÍÎ":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"AE!ÌÍÎ":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"AE!

r,�1�.�bÎ":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"AE!

}~.o��bÎ":::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::"a;C!

"

a"

_`"

)*+,-./0123b_`" "

)*+,-./0123b_`" "

#$%&'( )*+,-./0123±ÏÐÑÒÓÑb/0123�G#$%&'( bÔÕÖ×�Ø WÙU bÌͱÚ�ÈÛÜG#$%&'( b��±ÝÚÞßàcÞÚÛÇÓÑb/0123Ü�á±G#$%&'("âZã blmn/{«�2¤xÆ.�67äW$$åbjk°æç±ßàcÛÇÓ"

W$$ ����è" "

éÛ�±êëìGW$$ �Gíîïðñbst°òóÇÈô.wmõ.mÜÇÓÎëìGaÝb #$%&'( b{7mi.3ÜGö3¤)mw W$$Gq5hmL÷ W$$Gâ!'\NøYW$$ ùÏú�� W$$ bÇûÞ°üJ±ýþÇÈÑ�ÿÜ!ÛÇÓW$$ �?" "

"! #.$.b).n%&±']cÛÇÓ""! stÆ.m°æç±jk()ÛÇÓ""! *+�#.$.|3.¤�,-°.g.icÛÇÓ""! /0ÜýþcÛÇÓ""! 12b3b #$%&'( b��ùÏú�v,5��5�wi°4eÛÇÓ""! }+7iº7��Ø4,wº7�±5ÈÛÜG67�lmn/{«ÿ89ÜÇÓ""! :;<=GM##ùÏú >¸[¸#VP!$S �?b®��2£,i°4ÀÑ�ÿÜ!ÛÇÓ""! �@ W$$ �b�è"

W$$ ±ÏAG#$%&'( {7mn7mbıB�ÈCD°jkcEFÇÈÑ�ÿ89±�AÛÇÓaÝb #$%&'( b{7mi.3ÜGG3b W$$ °ýþÇÈÑ�ÿÜ!ÛÇÓÑbÏбcÞGG3bB�È|3.¤ÿGüH #$%&'( {7mn7m°GIÚ±JKLMÇÈÑ��dstÇÈÑ�ÿÜ!ÛÇÓ" "

ÎëìGö3¤)mw|3.¤±ÚÈ#.$.ÿ #$%&'( ±+|{7ÇÈ�GÒb.g.iÆ.m°�NÇÈÑ�ÿÜ!Èlmn/{«CD°ÒѱOÝPÈÑ�ÿÜ!ÛÇÓ/.ƹu7||3.¤b#.$.ÿ+|{7ÇÈ�Gq5hmL÷ W$$ °ÒѱOÝPGq5hmiv7��®��2w¹uq¹u±QÇÈvg.i°ýþÇÈÑ�ÿÜ!ÛÇÓR�ÜG#$%&'(ST��G{7mi.3()�ÇûÞb W$$ °EFSTÇÈ��U±Gjk�{7mi.3°��ÇÈÑ�ÿÜ!ÛÇÓ" "

W$$ °jkÇÈÑ�±ÏAGaÝbVWX±ÚÈí #$%&'(#.$.|3.¤ñbCD°ñY±=>ÇÈÑ�ÿÜ!ÛÇÓÎëìGZ­.3..4.bi[�3�1.¹u7|tb W$$Gq5hmiv7�L÷tb W$$ �?ÜÇÓÑbÏбGÇûÞb\�üH #$%&'( {7mn7m°stcÛÇÿGÒ)])bï^±Q_b`È).nbe°OÈÑ�ÿÜ!ÛÇÓ`È|3.¤ÿG3 W$$ ±2w£mÇÈR�ÜGñb|3.¤� aÝb W$$ ±2w£mÇÈÑ�ÿÜ!ÛÇÓW$$ �lmn/{«�ÿ�dGc�ÿaÞGbÿ�°stcGÒ)ÿ?bÏбc9ÇÈ�°ó�ÇÈÑ�ÿÜ!ÛÇÓ"

@"

Ñb/0123�bÿstÇû!�è" "

Ñb/0123�G#$%&'("âZã b²³Gr,�1�.�G}~.o��GW$$ bjkGXZ#;"WÙU °stcÞ #$%&'(bÌÍ°þÚ�Ú\b��bUbÜÇÓ#$%&'( b���deÜÇÓ#$%&'("W$$ jkb���Ü`Èf`�`AÛMgÓ���Ü`ÈÑ��G#$%&'( b��f7g.h7ibTòbhP±�AÛÇÿGij�ØÒ)Øbkl°¶,w2,¤ÇÈÑ�UÜ!ÛÇÓW$$ }v.oô.w�mL±L�AnÇÚ��GðYb #$%&'( {7mi.3°stto±pHÞqrd��ÇÈÑ�ÿÜ!ÛÇÓ" "

W$$ bcde" "

W$$ bcde" "

W$$ ���bsKtÜÇÓÒbuv�Gmwx¤iG�v,5��5�wiGlmnopU �Ø47wº7���ÛÜ`AÛÇÓí W$$ ÿÒ)])b)uvwix°wëÞÚÈ��G-,Æ.5x�ÊË°de±þÐÑ�ÿÜ!ÛÇÓ" "

W$$ �GîïXb+Y�|3.¤b��blmnor,�1�.�°G3=>c�AG#$%&'( b®��..4.b��byzb®��õ.5°=>ÇÈ�Úa�Ñ�°��±þÐÑ�Ü!ÛÇÓ��{|}mwx¤i°j!Glmno+.3°=>cG#$%&'("âZã b pU b²³°þÐ�?G*dbÑ�°þÐÑ�ÿÜ!ÛÇÓ#$%&'( �lmn/{«�ÿ�dGðYb #$%&'( {7mi.3b~=°��?ùA��±��ÇÈÑ�ÿÜ!ÛÇÓ" "

W$$ }v.oô.w" "

4.567 9:; Ü�GW$$ b=>°ÇûÞbv*3Ü.g.iÇÈ��� W$$ }v.oô.wÿ�|()Ûc�ÓÑ)±ÏAGf.�°jdbÜ��dG��±ÏAG�}� W$$ °jkÇÈÑ�ÿ89ÜÇÓ" "

#$%&'( b W$$ }v.oô.w�G^bÏÐ�c9°��cÛÇ?" "

"! lmnoL÷b��blmnopUä ¡¢e��Gvg.iG{*7in{¤å" ""! lmno��ä).n|}G#.$.G{7),wmå" ""! �Ú�p&°wë�pUäm�7G}~.o��Gr,�1�.�å" ""! lmno RS·%GVYY ùÏú >¸[¸#VP!$S °.g.iÇÈVe¿e®��..4." "

W$$ ��°wëÞÚÈ�è" "

í W$$ �Glmn/{«()���ÜQ_).n°��ÇÈô.wmõ.mÜÇÓW$$ ���°wëÈÑ�ÿÜ!ÛÇÓ" "

"! �v,5��5�wiä ¡¢e��Gvg.iG{*7in{¤Gn|G}u.3��?å" ""! �v,5��5�wi°��ÇÈ��br,�1�.�" ""! ��q1." ""! |}ùÏúÒb»b��" ""! lmno��f/7�" ""! ®��2£,iùÏúlmno®��õ.5" ""! lmn/{«()���¥¦äW$$#.$.ÿí W$$ b�`��°��ÇÈ��bUbå" "

<"

?bÏб W$$ °jkÇÈb�è" "

ij� #$%&'( bVe¿eW$$ }v.oô.w°stcÞz�b W$$ °=>cÛÇÓW$$ bjk�GG3b ¡¢e���Ò)Ø ¡¢e��°ÔÕÇÈ��bq1.b=>�?G��±þÐÑ�ÿÜ!ÛÇÓW$$ jkb_`±ÝÚÞ�GÑb£w�67b^�°�!�!��d�(ÚÓ" "

W$$ f7g.h7i"

W$$ f7g.h7i"

Ñbõ.5� W$$ bÇûÞb2{¹o±QÇÈ_���ÜÇÓ).n±�c���°��ÇÈÑ�ÿÜ!ÛÇÓÛ�GÑbõ.5Ü�Gij7tbTò±f`�t�°��cÛÇÓ" "

67±lmn/{«89�pU" "

í#.$.ùÏústto±pH�lmnopU °=>Çȱ�G#$%&'( b W$$ }v.oô.w°stcÛÇÓ#$%&'(b pUä#$%&'("âZãå�67±lmn/{«ÿ89ÜÇÓc�ÿaÞG#$%&'( b3,wª27�ª}u.3°�c²³ÇÈÑ�UG67±)${7c�ÇÑ�U89ÜÇÓ��bÏÐ�lmn/{«° #$%&'( ± ÇÑ�ÿÜ!ÛÇÓ" "

#$%&'("âZã blmnoõ.5°=>cÛÇÓ��ÿ89ÜÇÓ" "

"! r,�1�.�bjk" "

! r,�1�.��G+Y���b./x.°¡¢£±��ÇÈb±¤¥ÜÇÓ" "

! r,�1�.�b¦§�G¨r,�1�.�����©°ª«cÞd�(ÚÓ" "

"! }~.o��bjk" "

! }~.o���G��{7n}�.m°¬¨cÞG4,wÜýþcÞÚÈÏAG­���°®Ð aÝ

Û��G3b���,wm°ÔÕcÛÇÓ" "

! W\\¯¸'¯U°P¸·Z b¦§�G¨}~.o������©°ª«cÞd�(ÚÓ" "

"! ��q1.bjk" "

! ��q1.�G��°ýþc��±²�b³I=t°89±ÇÈõ.5ÜÇÓ" "

! )}~3i��q1.� °%¸YR J´µq1.ÜÇÓÑ)�G#.$.ÿÏdkaÞÚÈÜ`¶Ð·¸£

� #$%&'( �� pU ÜÇÓ" "

! ��q1.b¦§�¨��q1.©°ª«cÞd�(ÚÓ" "

(ر��± W$$ b3,wª27�ª}u.3°lmn/{«Ü!ÛÇÓ"

"! ­01.v{2®i�Ø4,w|[®7�¥¹ÛÜGÇûÞ°²³Ü!ÛÇÓ" ""! Û�GzLblmno RS·% � >¸[¸#VP!$S ° W$$ ±Ve¿ÀÑ�ÿÜ!ÛÇÓ" ""! �ÿÜ!È�±QÇȦ§�G W$$ b3,wª27�ª}u.3blmn/{«©°ª«cÞd�(ÚÓ" "

����v,5��5�wi" "

%�b).nn{¤°ºsùÏúSTÇÈÑ�±ÏAG(ر W$$ °lmn/{«ÇÈÑ�ÿÜ!ÛÇÓ�v,5°

9"

).n±��cG#.$.�stto±»pcÛÇÓ#$%&'( b��b¼�g?�G#$%&'("âZã b/h.5½{7n}�.m�Ø¥tÿ89ÜÇÓ#$%&'( /h.5½±ÏAG��ÿ89±±�AÛÇÓ" "

"! |}�{7),wm°��cÞG).n°ºsùÏú ¡ÇÈÓ" ""!  ¡¢e��nvg.iG}u.3��?b��5�wi°¾HÞ�v,5°��ÇÈÓ" ""! W$$ ùÏú��5�wi±»Çȧ¨°��ÇÈÓ" ""! �cÚq1.ùÏú�q¬.�67­01.°=>{¿sÇÈÓ" ""! #.$.ùÏú,-°��cGÒ)Ø° W$$ ±Ve¿ÀÓ" "

lmno��G��5�wiùÏú§¨±QÇȦ§�¨)*+,-.��ùÏú�v,5��5�wi�{�©°ª«cÞd�(ÚÓ" "

K"

W$$ bjk"

W$$ bjk" "

W$$ bjk" "

W$$ bjkb��b�¤�67�À¼?`AÛÇÓ�ÏAUÛÁGW$$ bst]£�Òbto±ÝÚÞó�ÇÈf`ÿ`AÛÇÓÛÁ��±G#$%&'( b W$$ bjk��±QÇÈ_�°ßàcÛÇÓ" "

f`�Ub" "

"! ¹�miº)un" "

! W$$ � #$%&'("âZã beÜÇûÞjkÇÈÑ�ÿÜ!ÛÇÓ��cGlmno z<=n VYYGRS·% °=

>ÇÈÂK�G¹�miº)un°stÇÈf`ÿ`AÛÇÓ¹�miº)un±� ÃN·N\N"Z\!S °

ÄÅcÛÇÓÆÇÜw+m¤[,i}~.oÜ`AG(ÛÈÛ�·¸}~./,iܹ�mibÉ{[

{iÔÕ°.g.icÞÚÛÇÓ" "

"! #$%&'( �v,5��5�wi" "

! ¼�g?b W$$ ���d�U a Ýb ¡¢e��Û��vg.i°FaÞÚÛÇÓW$$ =>¤+£m

bRÊ�cÞGÑ)Ø°��ÇÈÑ�ÿÜ!ÛÇÓ" "

"! ¤¥Ü�Ë�).n" "

! W$$ ±ÔÕ(M�Ú).n°{7),wmcÛÇÓ" "

! Ñb).nbÌv±�v,5°jkcGÑb�v,5°W$$bpU°¾HÞÔÕ(MÈÑ�ÿÜ!ÛÇÓ" "

"! ®����Í.3" "

! �[®$ΡbÑ)ØÍ.3�GstcÞÚÈ >¸[¸#VP!$SGM##ùÏú RS·% bi[�3�1.¹u7

|Üst()ÛÇÓ" "

! ���lmn/{Ï.�67°þÐÂK�GÑ)ØÍ.3bÚÁ)�°{7mi.3cÞstÇÈÑ�

°�dÄÅcÛÇÓ" "

! °!PZ�NаstÇÈÂKG°!PZã&Q °stÇÈÑ�ÿÜ!ÛÇÓ" "

! UZC �G)*+,-.Í.3bU�±`ÈÍ.3­01.±q3i{7f7¯.3ÿ`AÛÇÓ" "

! #¸�¸P!"9 ±Uq3i{7f7¯.3ÿ`AÛÇÓÛÁ��±G¤v}µv7m" Ñ"¦§��n�±`ÈG

­01.4.b��­01.°ÒÓ±ÇÈf`ÿ`AÛÇÓ­01.4.bæb)*+,-.bÔÕ­

01.°Ô�,wcÛÇÓ^±G��" Ñ" ®��{7mõwnbÔÕ°��cÛÇÓ" "

W$$ jk_`" "

éÛ�±�GW$$ bjk�^bm¹,¤±ÕÚÛÇÓ"

a:" W$$ ô.wmõ.m°=>ÇÈ"

"! W$$ q3r°saÞGW$$ ô.wmõ.m°=>cÛÇÓ" "

E"

"! W$$ q3r±ÝÚÞ�¨W$$ q3rbst©°ª«cÞd�(ÚÓ" "

@:" ).nùÏú�v,5° W$$ ±��ÇÈ"

"! lmno��°��cÞðYb).n°{7),wmxcÞÖTcÛÇÓ" ""! �v,5°��cÞ).nbÔÕ��°lmn/{«cÛÇÓ" ""! W$$ ±ùPÈ).nùÏú��5�wib��b��±ÝÚÞ�G¨)*+,-.��ùÏú�v,5��5�wi�{�©°ª«cÞd�(ÚÓ" "

<:" W$$#.$.±).n°��ÇÈ"

"! {7),wmÇÈ).n°ÔÕÇÈq1.�r,�1�.�°��cÛÇÓ" ""! W$$ b pU blmn/{«��b¦§�GÑÑ°ª«cÞd�(ÚÓ" "

9:" #.$.± W$$ °��cÞUØÐ" "

"! lmno��°#.$.±�ÕcÛÇÓ" ""! W$$ b£,i2,¤¥¦b����b¦§�G¨lmnopU bjk©°ª«cÞd�(ÚÓ" "

K:" #.$.ÿ�v,5° W$$ ±��ÇÈ" "

"! #.$.±§¨°��cÞ W$$#.$.ÿ�v,5��5�wi° W$$ ±��Ü!ÈÏбcÛÇÓ" ""! §¨b¦§�G¨W$$ §¨©°ª«cÞd�(ÚÓ" ""! #.$.ùÏú�v,5/h.5½/0123±�G�v,5��5�wib��ùÏú��±QÇȦ§ÿ×Ø()ÞÚÛÇÓ"

lmnopU bjk" "

lmnopU bjk" "

#$%&'( b W$$ }v.oô.w�Glmn/{«ÿ89�ÔÕv{Ù°XÚcÞùAGf7g.h7ib[{�[x°wë�67�UbÜÇÓ#$%&'("âZã bõ.5bÇûÞ�lmn/{«89ÜÇÓÑ)Øb®��õ.5GÝÛAq1.�Gz<=}µ{3Ü`AGW$$ bq1.)uvwix± ¡()ÞÚÛÇÓq1.�´51.3[{�[x�Ø=>()ÛÇÓí´51.3�ýÛ±�M##G>¸[¸#VP!$SG:;<=b)uvwixÜ`AGÙOSRN' ùÏú °%¸YR b)uvwixÜ`ÈÂKU`AÛÇÓ" "

q1.�GíÃ+±pHÞ²³ÇÈÑ�ÿÜ!ÛÇÓÛ�Gyzbq1.°=>ÇÈÑ�UÜ!ÛÇÓ��±Gq1.°��ÇÈ��bÜi_ÝbRÞ_`°×cÛÇÓ" "

a:" q1.±4��Ú´51.3°ó�cÛÇÓ" "

@. <view_name>.xmlÜí´51.3°��cÛÇÓ" "

<:" W$$ )uvwix?$SPLUNK_HOME/etc/apps/<App_name>/data/ui/views/±`Èq1.)uvwix±<view_name>.xml°ß!ÛÇÓ" "

9:" W$$ ÜG3bq1.ÿ`ÈÂKG q1.fvw�67b=>©±`Èßà±ÕaÞpU ÜÒ)Ø°àácÛÇÓ" "

©"

K:" q1.bM##°²³Çȱ�GW$$ mn{3°²³cÛÇÓ" "

'2?" #$%&'("STbâʱ`È z<=°ã�cÞ W$$ °lmn/{«ÇÈÂKG^bÂä±å~cÞ��°æ+.�ÇÈÑ�ÿÜ!ÛÇÓ" "

�ç W$$ °ÔÕ?" "

https://<splunkserver>:<splunkmgmtport>/services/apps/local?refresh=true

%�b2¤xÆ.�67°æ+.�8" "

https://<splunkserver>:<splunkmgmtport>/services/apps/local/<appname>?refresh=true

ÇûÞbq1.°æ+.�?" "

http://<splunkserver>:<splunkwebport>/app/<appname>/

q1.bèé" "

q1.±�Gr,�1�.�G}~.o��G��q1.b <Ýbn{¤ÿ`AÛÇÓín{¤bq1.�G$SPLUNK_HOME/share/splunk/search_mrsparkle/templates/view/±`È<¸(N¹7¤v.i±��()ÞÚÛÇÓ<¸(N ¹7¤v.i�GÙOSRN' °.g.iÇÈ :;<=}µ{3ÜÇÓ#$%&'( b¹7¤v.i�Gõ.5v{2®i°��cÛÇÓÜi£±�GaÝbõ.5±�tÇÈ`qb3°ó�ÛÇÓ" "

r,�1�.�" "

"! r,�1�.�bjk" "

! r,�1�.��G+Y���b./x.°¡¢£±��ÇÈb±¤¥ÜÇÓ" "

! r,�1�.�b¦§�¨r,�1�.�����©°ª«cÞd�(ÚÓ" "

}~.o��" "

"! }~.o��bjk" "

! }~.o���G��{7n}�.m°¬¨cG4,wÜýþcÞÚÈÏAG­���°®ÐêÝÛ�

�G3b���,wm°ÔÕcÛÇÓ" "

! ¦§�¨}~.o������©°ª«cÞd�(ÚÓ" "

��q1." "

"! ��q1.bjk" "

! ��q1.�G��°ýþc��±²�³I=t°89±ÇÈõ.5ÜÇÓ" "

! ��q1.bjkb��±QÇȦ§�¨��q1.©°ª«cÞd�(ÚÓ" "

#$%&'("âZã b¦§�lmn/{Ï.�67" "

W$$ b3,wª27�ª}u.3°lmn/{«cÛÇÓÎëìG��ÿþëÛÇÓ"

"! ­01.v{2®ib²³""! yzblmno :;<=� >¸[¸#VP!$S b��"

C"

"! W$$ °lmnoM##Üm�7"

�ÿÜ!È�±QÇȦ§�¨W$$ b3,wª27�ª}u.3blmn/{«©°ª«cÞd�(ÚÓ" "

´51.3bèé" "

q1.bjk±stÜ!È´51.3��d(g`AÛÇÓÎëìGõ.5Xb��4.�´51.3b aÝÜÇÓÛ�G´51.3±�G|[}nÔ½.iG¹�mi|}�,wmGx7wG�+,¤r®7­01.GÒb»bf7g.h7iÿ`AÛÇÓ´51.3bc9±QÇÈ_`�G¨´51.3bcde©°ª«cÞd�(ÚÓ" "

´51.3�$SPLUNK_HOME/share/splunk/search_mrsparkle/modules{±`AÛÇÓ7xmi�G´51.3v}µv7m°ª«cÞd�(ÚÓÛ�Gíõ.5b´51.3bëì°Oȱ�Gq1.bpX=±G?showsource=trueG°í�cÛÇÓ"Îëì?" "

http://localhost:8000/en-US/app/search/charting?showsource=true

'2?" %NV¸%RNYS8C;;; �stÇÈ{7mi.3îmiùÏúg.iÜß!ïëÞd�(ÚÓ" "

W$$ q3rbst" "

W$$ q3rbst" "

W$$ q3r°saÞGW$$ ô.wmõ.m°=>ùÏúlmn/{«cÛÇÓW$$ q3r�GW$$ jk¤+£m°ðñxÇÈ��b¹7¤v.i°��cÛÇÓW$$ ¹7¤v.i�GW$$ b=>±f`��ÈÇûÞbÜi£��°ÒÓ±c�ô.wmõ.m°��cÛÇÓW$$ q3r���bc9°�cÛÇÓ"

"! @ Ýbr,�1�.�" ""! < Ýb}~.o��" ""! @ Ýb��q1." ""! éòb ¡¢e��" ""! .7¤3 YZ'\·¸!% ).n" "

Û�G4,wº7��Ø W$$ °=>ÇÈÑ�UÜ!ÛÇÓ��cGW$$ q3r�GW$$ )uvwixjy�f`�}µ{3°#.$.t±z~=>cÛÇÓ"

Y¸·$%Z¯¸$$" "

óôb�ѶGY¸·$%Z¯¸$$ � W$$ q3rÜbe¥tÜ!ȹ7¤v.iÜÇÓY¸·$%Z¯¸$$ ¹7¤v.i�GY¸·$%Z¯¸$$ ±ÏA{7),wmx()�.7¤3 YZ'\·¸!% ).nı=>()ÛÇ($SPLUNK_HOME/etc/apps/sample_app/±`ÈåÓÑb¹7¤v.i�G).nb+Y�%&°àØ�±ÇÈ��bÏÐ�G3bl¹õx.bq1.°wëÞÚÛÇÓ"

"! r,�1�.�" ""! }~.o��" ""! ��q1." "

A"

"! ���vg.i" ""! öLé" "

#$%&'("âZã Ü W$$ q3r°stÇÈ" "

#$%&'("âZã Ü W$$ q3r°stÇȱ�G^bm¹,¤±ÕÚÛÇÓ"

a:" #$%&'("âZã ±+|{7cG#$%&'( /h.5½±å~cÛÇä÷ı`ÈSTx7w°wx,wcÛÇåÓ" "

@:" W$$Y °wx,wcÛÇÓ" "

<:" W$$ b=>:::�n7°øcG�ç W$$ °=>cÛÇÓ" "

9:" W$$ bùIäRZ%%NøNP%\ �?å°|}cÛÇÓÑbùI�G$SPLUNK_HOME/etc/apps/"#$ Appst)uvwix±Q_íPØ)ÛÇÓ" "

K:" W$$ b[*3°|}cÛÇÓÑb[*3�[*3�� ¸$$:VN'� ±-AúÞØ)ÛÇÓ[*3bùI�üHÜUjÚÛMgÓÎëìG:Z%%N"øNP%\G�?Ó[*3�Û�G#$%&'("âZã"W$$ �+,¤r®7ä#$%&'("âZã bûÄå±UÔÕ()ÛÇÓ" "

E:" Y¸·$%Z¯¸$$"¸$$ ¹7¤v.i°��cÛÇÓ" "

©:" ¥¹G2£,iÛ��}µ{3°��cÛÇÓü�c�Ú}µ{3±ÝÚÞ�GW$$ q3rÿ¹7¤v.ib)}~3i°stcÛÇÓ��ÿ89ÜÇÓ"

"! 4�.býþ¥¹°��ÇÈÓÑb¥¹�4�.£w�67býþ��AÛÇÓ"$SPLUNK_HOME/share/splunk/appserver/static/ \!PZVSNPO ±*db4�.¥¹ÿ`AÛÇÓ" "

"! »b¥¹°2,¤+.�cÛÇÓ:;<=´51.3±`È¥¹°ª«cÞd�(ÚÓ" ""! ¸$$%!V¸S!N':VYY °2,¤+.�ÇÈÓÑb}µ{3°stcÞ W$$ bmn{3°²³cÛÇÓ" ""! 2£,i°2,¤+.�ÇÈÓstÇÈ W$$ ܪ«c�Ú :;<=G>¸[¸#VP!$SGÒb»bÒÓ�}µ{3}~./,i°��ÇÈÑ�ÿÜ!ÛÇÓ" "

C:" :W$$ ° ¡cÛÇÓ#$%&'( °æÿ~c�dÞUGW$$ �ÒÓ±�AÛÇÓ" "

A:" r,�1�.�G}~.o��G��q1.°lmn/{«cÞGW$$ bjk°�PÛÇÓ" "

W$$ )uvwixjy" "

W$$ )uvwixjy" "

ÇûÞb W$$ �G$SPLUNK_HOME/etc/appsXblmno)uvwix±`AÛÇÓ" "

'2?" ¸$$ã&!%\ZP Ü W$$ °jkÇÈÛ±�GÑ)ØÇûÞb)uvwixÿz~=>()ÛÇÓ" "

W$$ bjy" "

Ñb)uvwixX±�^b.�)uvwixÿ`AÛÇÓ"

a;"

"! !Z�¸&%S{" "

! W$$ ±f`�ÇûÞb #$%&'( ��}µ{3° !Z�¸&%S ±ß!ÛÇÓÇûÞb W$$ ±� ¸$$:VN'� ÿ�P

)ì�AÛMgÓÛ�GY¸[Z\YZ¸PVRZY:VN'�G!'$&SY:VN'� Òb»bQ_ÇÈ��}µ{3ÿ`ÈÂKU

`AÛÇÓ" "

"! =NV¸%{" "

! ����+.l3)uvwixÜ��°þÚÛMgÓÑÑÜ�GW$$#.$.�ST�ÿ)}~3i�

�°Äj!cÛÇÓ" "

)}~3i)uvwix�+.l3)uvwix±�G(رpU °��ÇÈ��b.�)uvwixÿ`AÛÇÓÑ)Ø�$SPLUNK_HOME/etc/apps/<App_name>/<defaultÛ�� local>/data/UI/±¡ôcG��ÿ4Û)ÛÇÓ" "

"! "¸[{" "

! Ñb)uvwix±� \Z�¸&%S:з% beÿ`AÛÇÓÑb}µ{3°stcÞq1.fvw�67b=

>°þÚÛÇÓ" "

"! #!ZøY{" "

! =>c�q1.�ÇûÞÑb)uvwix±ß!ÛÇÓq1.°stcÞlmnopU °jkcÛÇÓ" "

lmno��" "

lmno´51.3G¥¹GM##GRS·% ° W$$ ±��Çȱ�GW$$ b)uvwixä$#Ù=p"ï:%<Z{ZSV{¸$$Y{&W$$¯'¸·ZÑ{å± ¸$$YZP[ZP{YS¸S!V )uvwix°��cÛÇÓ'�)uvwix°stcÞ��°þÚÛÇÓ" "

"! W$$ bmn{3b²³" ""! ®��x¯.mb��" "

<:z"W$$ b/{|v.i" "

<:z"W$$ b/{|v.i" "

Ñbi¶,wÜ�G<:z"W$$ ° #$%&'("9:б/{|v.iÇÈ��±ÝÚÞßàcÛÇÓÑb(=�G2¤xÆ.�67bf7¹7ͱÏAB�AÛÇÓc�ÿaÞGÛÁ��±G/{|v.ib���GÒ)Ø��ÿ 9:; Ü.g.i()ÞÚ()È�?Ð�°ó�cÛÇÓ9:; ±/{|v.icÞ�ÿÜ!È�±ÝÚÞG{7mi.3/0123bQ_i¶,w°ª«cÞd�(ÚÓ" "

*dbÂKG9:Ð"W$$ ÜU�v,5�]ä{*7in{¤G¯.mn{¤�?å°æ¥tÇÈÑ�ÿÜ!ÛÇÓÛ�GÑbi¶,wb)*°saÞG#$%&'( f�10¹uÜ=>()�¤¥� <:Ð"W$$Y °æjkcGÑ)°" 9:Ð" Ü~=(MÈÑ�ÿÜ!ÛÇÓ" "

|}�Òb»b4,wº7���" "

4,wº7�b��}µ{3�G#$%&'(..4.bc9ùÏú).n��°ü�ÇÈ��bUbÜÇÓÒb¼�g?�+,�d/{|v.iÇÈÑ�ÿÜ!ÛÇÓ��}µ{3±�G¸&SRZ'S!V¸S!N':VN'�G!'\ZÐZY:VN'�G!'$&SY:VN'�G

aa"

N&S$&SY:VN'�GøZã:VN'� ÿ`AÛÇÓ" "

Ñ)Øb}µ{3±�-(�²³ÿ�()ÞÚÈÑ�±'2cÞd�(ÚÓ%�b��ÿ/{|v.i89�?Ð�ÿL�Ø�ÚÂK�GÃ+}µ{3°�.cÞd�(ÚÓ" "

)¤+{­7i..4.b���67±²³()ÞÚÈ��G/~Ü/{|v.iÇÈf`ÿ`AÛÇÓ" "

�v,5�ÔÕb��" "

<:z�Ø 9:;0b��²³b¼�g?��v,5ä{*7in{¤G ¡¢e���?åùÏúÔÕä#$%&'( ®��bâ1åv{Ù±QÇÈUbÜÇÓ��cG��b}µ{3�¾2+,�d/{|v.iÇÈÑ�ÿ89ÜÇÓ"

$PN$Y:VN'�GSP¸'Y�NP·Y:VN'�GZ[Z'SSO$ZY:VN'�GS¸QY:VN'�Ó" "

<:z"W$$�Ø9:;"W$$±�v,5°�3±f¶.ÇÈÂK�G��W$$°w+.07|cG{*7in{¤Gn|G$PN$YG²ïÒb»b�v,5��±f¶.ÇÈÑ�ÿÜ!ÛÇÓ ¡¢e���/~Ü/{|v.iÇÈf`ÿ`AÛÇbÜ�'2d�(Úä45åÓ" "

 ¡¢e���}~.o��" "

 ¡¢e���}~.o���é6±²³()ÞÚÈ��G/~Ü/{|v.iÇÈf`ÿ`AÛÇÓY¸[Z\YZ¸PVRZY:VN'� ±Äj!f¶.ÇÈGÛ�� #$%&'(STb��780±f¶.Ü!ÛÇÓ#$%&'( �Ñ)Ø��°/{|v.icÛÇÿG}u.3�ùÏú9:��f/7�X±;a�88�?�¿sÇÈf`ÿ`AÛÇÓ ¡¢e��°r,�1�.�ÜÔÕ(Mȱ�GÒb��°r,�1�.�±��ÇÈf`ÿ`AÛÇÓÑ)±ÏAG�ç��bq1.m¹.iÿ=>()ÛÇÓ}~.o���Òb�cÚq1.�m¹o°¾HÞ=>ÇÈf`ÿ`AÛÇÓY¸[Z\YZ¸PVRZY:VN'� ±<Ú}~.o��°/{|v.iÇÈÑ��Ü!ÛMgÓ¦§�ijbG¨9:; ±ÏÈ}~.o��©°ª«cÞd�(ÚÓ"

§¨b��" "

9:; ��cÚ��5�wi´)3°�|cÞÚÛÇÓÑb´)3�GÇûÞb W$$ ���5�wiä ¡¢e��Gvg.iGq1.G{*7in{¤�?åb§¨°��cÛÇÓ" <:z"W$$ ° 9:; ±/{|v.i��!�G#$%&'(ST°stÇÈGÛ�� \Z�¸&%S:·ZS¸ }µ{3° W$$ b)uvwix±/~Ü��ÇÈÑ�±ÏAGW$$ b§¨°��cÞd�(ÚÓW$$ §¨b����b¦§�ij±×Ø()ÞÚÛÇÓ" "

'2?"��° #$%&'( ±/~ÜÜf¶.c�ÂKä#$%&'("âZã °stc�ÚåGÒb��ÿ #$%&'("âZã ÜÔÕ()ÈÏбG§¨°��ÇÈf`ÿ`AÛÇÓ" "

stÇÈ2¤xÆ.�67ÿ�±G}µ{2®~.3mwv.-2¤xÆ.�67�?Òb»b2¤xÆ.�67ÜstÇÈ��±��()�).nÜ`ÈÂKGÒb��°|+.43±ºwmg.iÇÈÑ�U89ÜÇÓ" "

Î" "

ÑbÎ�G#$%&'(ɸYZ �Ø®��2w¹uq¹u W$$ °=>cÛÇä ¡Âä?RSS$8{{øøø:Y$%&'(ã¸YZ:VN·{¸$$Y{W%%{;ZVR'N%NQ!ZY{âZã{âZã¯#ZP[ZPY{!¸S¸¯#N&PVZY¯?@Z'ZP¸%¯âZãA{"M#W¯VN·ã!'Z\{¸$$8âZãB¸VVZYYBPZ$NPSYåÓ" "

a@"

Ñb W$$ �GY¸[Z\YZ¸PVRZY:VN'� ùÏú ã&'\%Z:VN'� °4gÜÚÛÇÓ ¡¢e��� 9:; b�cÚ W$$ ±/{|v.iÇÈÑ�ÿÜ!ÛÇÿGã&'\%Z:VN'� �9:()ÞÚÛÇbÜGCLA± ¸$$:VN'� °stcÞd�(ÚÓ"^±GÑb W$$ °/{|v.iÇÈ��b/D°D°�aÞßàcÛÇÓ" "

a:" ��± W$$ )uvwix°=>cÛÇÓW$$ q3r°stÇÈÑ�ÿÜ!ÛÇÓÑ)�z~£±G\Z�¸&%S:·ZS¸G¸$$:VN'�GÒb»b}µ{3�Øú± W$$ )uvwixjyb7t°=>cÛÇÓf`±pHÞG/~ÜÜ)uvwix°$SPLUNK_HOME/etc/apps/±=>ÇÈÑ�UÜ!ÛÇÓÎëìG)uvwix$SPLUNK_HOME/etc/apps/web_activity_4°=>cÛÇÓfE}µ{3ä¸$$:VN'�G\Z�¸&%S:·ZS¸å°��ÇÈÑ�°F)�ÚÜd�(ÚÓ" "

@:" <Ú Y¸[Z\YZ¸PVRZY:VN'� °�ç W$$ b)}~3i)uvwix?$SPLUNK_HOME/etc/apps/web_activity_4/default/savedsearches.conf±f¶.cÛÇÓ" ¡¢e����780°ÇûÞ #$%&'(ST±/~Üf¶.ÇÈÑ�UÜ!ÛÇÓ" "

<:"  ¡¢e��°¿scÞ 9:; Ü~=ÇÈÑ�°�.cÛÇÓ%±G88b{7mn7m°G±²³cÞd�(ÚÓÎëìGsourcetype::access� sourcetype=access±�AÛÇÓ ¡¢e��±�G»±U+,ÿ`ÈÂKÿ`AÛÇÓ#$%&'("âZã �+,±ÝÚÞ2[.i°ÔÕcÛÇÓ��� #$%&'(STÜ�H¿sÜ!ÛÇÓ" "

9:" ¿sc� ¡¢e��° ¡cÛÇÓ�cÚ W$$ °ÔÕÇȱ� #$%&'( bæÿ~ÿf`�ÂKÿ`AÛÇÓ" "

K:" ��±/{|v.ic� ¡¢e��°ÔÕÇȱ�G�çr,�1�.�°=>ÇÈGÛ��I¡br,�1�.�°¿scÛÇÓ" "

)}~3i W$$ b��" "

)}~3i W$$ b��" "

)}~3i W$$ �G#.$.�JÛ��|+.43±��ÇÈÑ�ÿÜ!ÛÇÓÑb W$$ �)}~3iÜG#$%&'( ±+|{7ÇÈK±ÔÕ()ÛÇÓ" "

��" "

a:" &YZPL$PZ�Y:VN'� �Mì)È}µ{3°#.$.b^b+.l3)uvwix±=>cÛÇä#.$.±�tÇÈåÓ"$SPLUNK_HOME/etc/users/<user>/user-prefs/local/user-prefs.conf

Û��G^b)}~3ib &YZPL$PZ�Y )uvwix±=>cÛÇä|+.43±�tÇÈåÓ" "$SPLUNK_HOME/etc/apps/user-prefs/user-prefs.conf.

@:" ^° &YZPL$PZ�Y:VN'� }µ{3±��cÛÇÓ"default_namespace = <App>

ÎëìGST#.$.b)}~3i W$$ °�� W$$ ±��cÛÇÓ" "

1. $SPLUNK_HOME/etc/users/admin/user-prefs/local/user-prefs.conf:°¿scÛÇÓ¹mi#.$.±ÝÚÞ�G$SPLUNK_HOME/etc/users/test/user-prefs/local/user-prefs.conf±`AÛÇÓ" "

@:" ^°��cÛÇÓ" "

default_namespace = Search

a<"

r,�1�.�bjk"

r,�1�.�����" "

r,�1�.�����" "

lmno{*7iv7r[°=>ÇÈ" "

r,�1�.�°stÇ)ìG).nb+Y�%&°�àcG�`���±x7wcGN¾vg.i°ÔÕÇÈÑ�ÿÜ!ÈÏб�AÛÇÓír,�1�.�� aÝÛ��G3b-h3�Ø�AGí-h3����Òb��b¡¢£�./x.ÿÔÕ()ÛÇÓ-h3�Ò)])û÷Û��Ä�±Êß()ÛÇÓ-h3±�^bUbÿÔÕ()ÛÇÓ" "

"! ��Û��vg.i" ""! Ô½.iGxmiÒb»��bÔÕ" "

®��x¯.m°r,�1�.�-h3±4�ÈÑ�UÜ!ÛÇÓ" "

#$%&'( �G�� W$$ ±ÚdÝ�b)}~3ir,�1�.�°·¸OwcÞÚÛÇÓm¹.nm­01.b�±`Èx7wbÇûÞ�r,�1�.�ÜÇÓÛ��� W$$ b)}~3iq1.Ur,�1�.�Ü`AG^bÂä±`AÛÇÓ" "

RSS$8{{%NV¸%RNYS8C;;;{Z'Lp#{¸$${YZ¸PVR{\¸YRãN¸P\" "

'2?" %NV¸%RNYS8C;;; °��c�îmiùÏúg.iÜß!ïëÞd�(ÚÓ" "

�����" "

#$%&'( �Gr,�1�.�jkb��b @èébB�È z<=j7°��cÛÇ?ÝÛAG��ùÏú��ÜÇÓ¼�g?br,�1�.��G#$%&'( bq5123r,�1�.�º)un±ÏAjkÇÈÑ�ÿÜ!ÛÇÓÑ)�G���r,�1�.�j7°j!PcÛÇÓc�cGÇûÞb´51.3ÿ��r,�1�.�Ü¥tÜ!ÈLPÜ�`AÛMgÓc�ÿaÞGÏAQR()�Ub°jkc�ÚÂK�G��j7°stcÞd�(ÚÓ" "

f`�Ub" "

r,�1�.����ùÏúvg.iıjk()ÛÇÓ��ùÏúvg.i�G ¡¢e���vg.iÛ��r,�1�.� z<=��Üst()���ÜÇÓ ¡¢e��°r,�1�.�Üü�ÇÈÂKG#$%&'( �Á�b��±²°stcÛÇÓc�ÿaÞG��°mÆ51.3ÜýþÇÈÏб��ÇÈÑ�ÿÜ!Gr,�1�.���½,�1()�±²°stcÛÇÓST±ýþ()È��ÿ*d`ÈÂKGÛ��*db\ÿüHr,�1�.�°üJ±stÇÈÑ�ÿUV()ÈÂKG ¡¢e��°stcÞd�(ÚÓr,�1�.�°stcÞ±²°x23n{oÜÔÕÜ!ÈÏбÇȱ�G��780°�Hr,�1�.�±jkcÛÇÓ" "

r,�1�.�°jkÇÈI±G ¡¢e��b��±QÇÈ�°ª«cÞd�(ÚÓ" "

a9"

r,�1�.�bjk��" "

r,�1�.�bjk��" "

^±r,�1�.�bjk��b_`°ßàcÛÇÓ" "

�cÚ W$$ b��" "

�cÚ W$$ °��Çȱ�G^bÏбcÛÇÓ" "

"! W$$ q3r°saÞGW$$ ô.wmõ.m°=>cÛÇÓ" "

! r,�1�.� W$$ °jkÇÈÁU������GW$$ q3rÜ��ÈÑ�ÜÇÓ" "

! W$$ q3rbßà°ª«cG¸$$¯Y¸·$%Z ¹7¤v.i°stcÞd�(ÚÓ" "

"! {7),wmQ_).n"

! ýþcÞ�ÚÂKG).n° #$%&'( ±W|cÛÇÓ{7),wmÇÈ).n±ÝÚÞ).n|}°�

�cÛÇÓ�¤�67ÜG).n° W$$ ðñ{7),wm±XÈGÛ��Ò)°LYc�d�ÚÂK

�G)}~3i{7),wm±XAÛÇÓ" "

�çr,�1�.�b��" "

r,�1�.�±��c�Ú W$$ ÿL�aÞÚÈÂKG^bÏбcÛÇÓ" "

"! �v,5��5�wi°��cÛÇÓ" "

!  ¡¢e���vg.i�`ØZÈr,�1�.�ܤ¥±stÜ!ÛÇÓðYb W$$ ±QÇÈ ¡

¢e��b����b¦§�GQ_�]°ª«cÞd�(ÚÓ" "

! f`±pHÞG{*7in{¤G}u.3�Gn|�?»b�v,5��5�wi°��cÛÇÓ" "

"! r,�1�.�°jkcÛÇÓ" "

! Ç[±���ÚÂK�G��r,�1�.�°=>cÛÇÓ" "

! z<=±¦cÚÂK�GÏAQR()�r,�1�.�°jkÇÈÑ�UÜ!ÛÇÓ" "

! ¼�g?br,�1�.��Gðñb��Û�� ¡¢e��bÚÁ)�°ª«cÛÇÓc�ÿaÞG

jkc���±ÝÚÞ\]ÇÈÏбcÞd�(ÚÓ" "

! ®��x¯.m°r,�1�.�±4�ÈÑ�UÜ!ÛÇÓ" "

"! r,�1�.�±»Çȧ¨°��cÛÇÓ" "

! r,�1�.�Ü ¡¢e��GÔ½.iGÒb»bºv­7i°#.$.ÿlmn/{«ÇÈÑ�°

^8ÇÈ�?Ð�°ó�cÛÇÓW$$#.$.�Gyzb¤[{*.i)uvwixXÜ��5�wi

°ÚÝÜU=>ÇÈÑ�ÿÜ!G#.$.ÿ2¤xÆ.�67v*3Ü=>c���5�wi°NÒÇ

ÈÑ�UÜ!ÛÇÓ" "

! ¨W$$ §¨b��©bßà±ÕaÞ W$$ §¨°��cÛÇÓ" "

aK"

��r,�1�.�" "

��r,�1�.�" "

��r,�1�.�j7°stcÞr,�1�.�°qrdjkÇÈÑ�ÿÜ!ÛÇÓÑbj7����q1.j7Üjk()GÚdÝ�b´51.3°��cÛÇÓÏAQR()�r,�1�.�ÿf`�ÂK�G���j7°sÐf`ÿ`AÛÇÓ_G��j7���j7°ËA`ëÈÑ��Ü!ÛMgÓ" "

��r,�1�.�°jkÇȱ�Gq5123r,�1�.�º)un°stÇÈGÛ��zLb z<=��°=>cÛÇÓ" "

q5123r,�1�.�º)un" "

q5123r,�1�.�º)un°stcÞ��r,�1�.�°=>cÛÇÓ��±G#$%&'("âZã bûı`È2w�67­01.°��cÛÇÓ" "

"

^±Gq5123r,�1�.�º)unbßà±ÕÚÛÇÓÄ5Ü=>c�-h3°�[,|ª27�ª�+,¤cÞGÄ�û÷±~�ÇÑ�ÿÜ!ÛÇÓ" "

z<=��" "

q5123r,�1�.�º)un°stÇÈÑ��dG��r,�1�.� z<=°�H¿sÛ��=>ÇÈÑ�UÜ!ÛÇÓr,�1�.�°¿sÛ��=>Çȱ�^bÏбcÛÇ?" "

"! #$%&'(ST" "

! ST±å~ÇÈÓ" "

! q1.°wx,wÓ" "

! �ç�n7°��cÞ�çq1.°=>ÇÈGÛ��GI¡br,�1�.�°wx,wcÞ¿scÛ

ÇÓ" "

! �çq1.õ.5bßà±ÕÚG�×Ü5ûÈ}~./,iÜ z<=°|}cÛÇÓ" "

"! 4,wº7�" "

! stÇÈ z<=°�H}µ{3�m¹o°saÞ W$$ ±f¶.cÛÇÓ" "

aE"

! stÇÈr,�1�.�b z<=}µ{3ÿ

$SPLUNK_HOME/etc/apps/<app_name>/default/data/ui/views/±`ÈÑ�°�.cÞd�

(ÚÓ" "

a:" r,�1�.�n|°ü�cG[*3°��cÞr,�1�.�°��cÛÇÓ[*3� #$%&'("âZã b�+,¤r®7­01.±ÔÕ()ÛÇÓ" "

<dashboard> <label>My dashboard</label> </dashboard>

Ñ)±ÏAG·¸ #$%&'( ö,r.G�q¬.�67­01.GùÏú¨<O"\¸YRãN¸P\©b[*3ÿíÚ�abr,�1�.�õ.5ÿ=>()ÛÇÓ"

@:" ÑÑÜGþ°��cÞ-h3°r,�1�.�±��cÛÇÓ" "

<dashboard> <label>My dashboard</label> <row> </row> </dashboard>

Ñ)±ÏAGaÝÛ��G3b-h3°bc89� aÝbþÿ=>()ÛÇÓ" "

<:" f7¹7Í°þ±��cÛÇÓÎëìGd·O"ZPPNPYd�ÚР¡¢e���Øb���±²¹.�3°=>cÛÇÓ" "

<dashboard> <label>My dashboard</label> <row> <table> <searchName>my errors</searchName> </table> </row> </dashboard>

'2?" YZ¸PVR"¸·Z ܪ«()È ¡¢e���GW$$ b)}~3i+.l3)uvwixÛ��+.l3)uvwixb Y¸[Z\YZ¸PVRZY:VN'� ±¡ôÇÈGÛ��|+.43�cÞ��()ÞÚÈf`ÿ`AÛÇÓ" "

9:" üHþ±��b-h3°��cÛÇÓÑbÎ� <Ýb-h3°/ûÞÔÕcÛÇÓ" "

<dashboard> <label>My dashboard</label> <row> <table> <searchName>my errors</searchName> </table> <table> <searchName>your possible errors</searchName> </table> <table> <searchName>their definite errors</searchName> </table> </row> </dashboard>

K:" Û��G-h3°G3þ±L�aÞe�cÛÇÓÑbÎ�GaÝb-h3°zLbþ±G@Ýb-h3°ñb aþ

a©"

±ß!ÛÇÓ" "

<dashboard> <label>My dashboard</label> <row> <table> <searchName>my errors</searchName> </table> </row> <row> <table> <searchName>your possible errors</searchName> </table> <table> <searchName>their definite errors</searchName> </table> </row> </dashboard>

E:" üHö,)u7|ÜêÝbþbæ±-h3°|3.¤xcÛÇÓ|3.¤xf&°Òbþbg.�±��ÇÈ�Gaþbæ±G3b-h3°|3.¤xÇÈÑ�ÿÜ!ÛÇÓ^bÎ�G89&b`Ⱥ[.G�Òb��º[.°üH|3.¤ö,)u7|±ßÚÞÚÛÇÓ"

<dashboard> <label>My dashboard</label> <row> <table> <searchName>my errors</searchName> </table> </row> <row grouping="2"> <table> <searchName>your possible errors</searchName> </table> <table> <searchName>their definite errors</searchName> </table> </row> </dashboard>

©:" (رGaþÜ-h3°ûhÛ��÷h±|3.¤xÇÈÑ�ÿÜ!ÛÇÓ^�G<Ýb¹.�3°ûh|3.¤±G@Ýb¹.�3°÷h±ÊßÇÈ-h3° aþ±=>cÛÇÓ" "

<dashboard> <label>My dashboard</label> <row grouping="3,2"> <table> <searchName>my errors</searchName> </table> <table> <searchName>your possible errors</searchName> </table> <table> <searchName>their definite errors</searchName> </table> <table> <searchName>known unknown errors</searchName> </table>

aC"

<table> <searchName>unknown unknown errors</searchName> </table> </row> </dashboard>

���¤�67" "

I5bÎ�ÇûÞ aÝb¹.�3-h3� aÝb ¡¢e��°stcÛÇÓc�cG-h3±���°ü�ÇÈ��b�¤�67ÿ»±U`AÛÇÓ" "

a:" {7[{7��°ü�ÇÈÓÎëìG"

<table> <searchString>search foo this | timechart that</searchString> <earliestTime>-20h</earliestTime> <latestTime>-2h</latestTime> </table>

@:"  ¡¢e��bP}°}u.3�ܬ¨ÇÈ" "

<table> <searchName>Errors in the last 24 hours</searchName> <fields>host, source, errorNumber</fields> </table>

<:" n{i3°-h3±��ÇÈ" "

<table> <title>Look here for errors that you need to care about</title> <searchName>Errors in the last 24 hours</searchName> <fields>host, source, errorNumber</fields> </table>

9:" -h3bÔÕ�¤�67°��ÇÈÓÎëìG"

<table> <title>Look here for errors that you need to care about</title> <searchName>Errors in the last 24 hours</searchName> <fields>host, source, errorNumber</fields> <option name="count">25</option> <option name="displayRowNumbers">true</option> </table>

-h3" "

¹.�3b¼�±UG��±²°P}ÇÈ}~./,i�»±U`AÛÇÓ^±G��� z<=Ü¥tÜ!È�¤�67°��cÛÇÓ" "

S¸ã%Z" "

¹.�3-h3�GÔÖ×Ü��).n°ÔÕcÛÇÓ^b�¤�67°.g.icÛÇÓ" "

"! VN&'S8á3" "! ÔÕÇÈþbÁé3°ü�cÛÇ" "

"! \!Y$%¸OXNø"&·ãZPY8"SP&Z"i"�¸%YZ" "

aA"

! þ3°±²þbûh±ÔÕÇÈ�?Ð�°ü�cÛÇ" "

"! YRNøÙ¸QZP8"SP&Z"i"�¸%YZ" "

! õ.57|f7i+.3°-h3±��ÇÈ�?Ð�°ü�cÛÇ" "<table> <title>Look here for errors that you need to care about</title> <searchName>Errors in the last 24 hours</searchName> <option name="count">25</option> <option name="displayRowNumbers">true</option> </table>

VR¸PS" "

Ô½.i-h3�GjÖ×Ü��).n°ÔÕcÛÇÓ-h3ÿ YZ¸PVR"¸·Zg.�±ÏA ¡vg.i�õ2±()�ÂKG·¸vg.iq3r.{7n}�.m±ÏAk>()�I¡b}~./,i�¤�67°+.�cÏÐ�cÛÇÓ" "

'2?" ¡vg.i�Ô½.i}~./,i-[­.n°4gÜÚÛÇÓR�G ¡¢e���Ò)°4eÛMgÓ¦§�G#.$./0123b¨vg.ib ¡�NÒ©°ª«cÞd�(ÚÓ" "

Ô½.i}~./,i��¤�67g.�ÏA{7[{7ÜÄj!ÇÈÑ�ÿÜ!ÛÇÓÔ½.i-h3�^b�¤�67°.g.icÛÇÓ" "

"! RZ!QRS"G"M## )u­7567" "! Ô½.i��5�wiblT£�(°ü�cÛÇÓ" "

"! VR¸PS!'Q:VR¸PS"G"ã¸P"i"%!'Z"i"VN%&·'"i"¸PZ¸"i"$!Z"i"YV¸SSZP"i"ã&ãã%Z" "

! Ô½.in{¤°ü�cÛÇÓ" "

"! VR¸PS!'Q:%ZQZ'\:$%¸VZ·Z'S"G"SN$"i"%Z�S"i"ãNSSN·"i"P!QRS"i"'N'Z" "

! mÎbÂä°cÛÇÓ" "

"! VR¸PS!'Q:n"G"Ô½.i�¤�67" "! Ô½.i}~./,i�¤�67�ÇûÞÑÑÜ.g.i()ÛÇÓÔ½.iv}µv7m°ª«cÞ

d�(ÚÓ" "<chart> <searchString>index=_internal metrics group="pipeline" NOT sendout | head 1000 | timechart per_second(cpu_seconds) by processor</searchString> <earliestTime>-30h</earliestTime> <latestTime>-10h</latestTime> <option name="charting.chart">line</option> <option name="charting.primaryAxisTitle.text">Time</option> <option name="charting.secondaryAxisTitle.text">Load (%)</option> </chart>

Z[Z'S" "

{*7i-h3���±²°ÔÕcÛÇÓÑb-h3�^b�¤�67°.g.icÛÇÓ" "

"! VN&'S"Gá3" "! ÔÕÇÈþbÁé3°ü�cÛÇ" "

@;"

"! \!Y$%¸OXNø"&·ãZPY"G"SP&Z"i"�¸%YZ" "

! þ3°±²þbûh±ÔÕÇÈ�?Ð�°ü�cÛÇ" "

"! Z'S!SO"¸·Z"G"Z[Z'SY"i"PZY&%SY" "

! {*7iÛ��±²°ÔÕÇÈ�?Ð�°ËA`ëÛÇÓ" "

! )}~3i� PZY&%SYä±²åÓ" "

"! YZQ·Z'S¸S!N'"G"'N'Z"i"!''ZP"i"N&SZP"i"�&%%" "

! þ{*7ib£|­7¹.�67´.�" "

"! ·¸Ð=!'ZY8á3" "! ±²��±ÔÕÇÈþbÁé3" "

"! YRNøÙ¸QZP8"SP&Z"i"�¸%YZ" "

! õ.57|f7i+.3°-h3±��ÇÈ�?Ð�°ü�cÛÇÓ" "<event> <title>Event view</title> <searchString>changelist | head 1000 | dedup changelist</searchString> <fields>added deleted changed</fields> <option name="showPager">true</option> <option name="count">20</option> <option name="displayRowNumbers">false</option> </event>

Y!'Q%Z" "

�7|3-h3�G��).n�Ø aÝboäÁpbþ{Ápb0å°ÔÕcÛÇÓ).n£,ibKq.{«±QLØÁGaÝbobe°ÔÕcÛÇÓr()È��±ÏAG-h3bs°²³ÇÈÑ�ÿÜ!ÛÇÓÑb-h3�^b�¤�67°.g.icÛÇÓ" "

"! ¸\\!S!N'¸%M%¸YY"G"VYY w[mù" "! ±²f7¹�±��ÇÈ12b VYY w[mù" "

! �¤�67" "

"! %!'(#!Zø" "

! x7w()ÞÚÈ��°ýþÇÈq1.°ü�cÛÇÓ" "

! )}~3i� \¸YRãN¸P\"är,�1�.�åÓ"

"! �!Z%\" "

! ÔÕÇÈ}u.3�" "

! )}~3i�Áp±r()È}u.3�" "

"! %!'(°!Z%\Y" "

! ±²°x7wÇÈ�G[*3U4�È�°ü�cÛÇÓ" "

! ±²�t�b[*3°x7wÇȱ�GuPZY&%STãZ�NPZ=¸ãZ%T¸�SZP=¸ãZ%u°ü�cÛÇÓ" "

! )}~3i� PZY&%Sä±²åÓ" "

"! V%¸YY°!Z%\" "

@a"

! Ápb±²b V%¸YY°!Z%\ bo°G±²f7¹�±��ÇÈ VYY w[m�cÞ��cÛÇÓ" "

! `Ø�H���()�w[m�GdYZ[ZPZdGdZ%Z[¸SZ\dGd%NødùÏúd"N'Zdä)}~3iåÓ" "

"! ãZ�NPZ=¸ãZ%" "

! ±²bI±ÔÕÇÈ[*3Ó" "

"! ¸�SZP=¸ãZ%" "

! ±²b4±ÔÕÇÈ[*3Ó" "

"! %!'(#Z¸PVR" "

! ±²°wx,w89x7w±²ëÈ��bÒÓ�67��wºx°ü�cÛÇÓ" "<single> <searchString>| metadata type="sources" | stats count</searchString> <option name="afterLabel">sources</option> </single>

a Ýbs°²³ÇÈÂKGv75/,¤Ü��°��cÛÇÓ" "

<single> <searchString>index=_internal 404 source="*web_access.log" earliest=-1h | stats count | rangemap field=count low=0-0 elevated=1-100 default=severe</searchString> <title>404s this hour</title> <option name="classField">range</option> </single>

:;<=" "

:;<=-h3�{7[{7 :;<=°ÔÕcÛÇÓ:;<=n|´bf7¹7Í�ÇûÞ78¾Aòv()Gõ.5±ÔÕ()ÛÇÓ¥¹�?0bª«x7w�G³»£±óôbq1.bJß±Q_wPØ)ÈÑ�±'2cÞd�(ÚÓ" "

<html> This lists all of the data you have loaded into <strong>your</strong> default indexes over all time. </html>

%!YS" "

xmi-h3�).n°R�ÔÕcÛÇÓÑ)�G ¡¢e��ùÏú��±²�?b)*bÔÕ±st()ÛÇÓÑb-h3�^b�¤�67°.g.icÛÇÓ" "

"! !'!S!¸%#NPS!!P"G"¸YV"i"\ZYV" "

! !'!S!¸%#NPS }u.3�±ÜwÚÞ±²°¯.iÇÈx!Ó" "

! �¤�67" "

"! %¸ãZ%°!Z%\#Z¸PVR"G" ��780" "! #.$.ÿ[*3}u.3�°wx,wc�Û±k>()È��780Ó" "

! %¸ãZ%°!Z%\;¸PQZS °ÒÓ�q1.±ü�ÇÈf`ÿ`AÛÇÓ" "

! [*3}u.3�bo�z~£±Òb��±��()ÛÇÓ" "

"! [¸%&Z°!Z%\" "

! ±²}u.3�bùIÜGÒbo�Gx7wxmib[*3ÊL±ÔÕ()ÛÇÓ" "

@@"

! x7wxmi�RÞ£±Gßà[*3�38l®7iÒb»äoå}u.3�bVeKLMÜÇÓ" "

! fE" "

"! %¸ãZ%°!Z%\;¸PQZS" "

! [*3}u.3�±G��°)um-,ÔÇÈwx,w89x7wbk>ÿ£,i2,¤()ÞÚÈÂ

K±G]·�ÇÈq1.Ó" "

! �¤�67" "

"! !'!S!¸%#NPS" "

! ±²b}u.3��x7wxmiÿÁp±ÔÕ()ÈJ±¯.i()ÛÇÓ" "

! �¤�67" "

���r,�1�.���" "

���r,�1�.���" "

��r,�1�.���Ü�ÇûÞb´51.3°¥tÇÈÑ��Ü!ÛMgÓÏAQR()�r,�1�.�°=>ÇÈÂKG��r,�1�.���Ü�¥tÜ!�Ú´51.3°stÇÈG��b/D±ÕÚÛÇÓ" "

��" "

^±r,�1�.�bjk��b_`°ßàcÛÇÓ" "

a:").nb¡¢xùÏúÔÕ��°ó�cÛÇÓÎëìG��±²°|[}ÜÔÕc�AG��±²0bx7w°xmiÜÔÕÇÈ�?ÜÇÓ" "

@:"��°j>cÛÇÓ" "

<:"í��±ÝÚÞ-h3°jkcÛÇÓ" "

9:"jkc�-h3�Ør,�1�.�°j>cÛÇÓ" "

Á4±Gr,�1�.�-h3°v{2®icÛÇÓr,�1�.�bjk��b¦§�G r,�1�.�v{2®i©°ª«cÞd�(ÚÓ" "

).nb¡¢x��°ó�ÇÈ" "

ÛÁ��±G¥t89´51.3Ü).n°?bÏбÔÕÇÈ�°ó�cÛÇÓ±²´51.3�G��±²°r,�1�.�ÜÔÕÇÈb±ÁU¤¥�´51.3ÜÇÓ" "

��°j>ÇÈ" "

^b @Ýb��Ü��°r,�1�.�-h3±4�ÈÑ�ÿÜ!ÛÇÓ" "

a:" ��°k>cGÒ)° ¡cGmÆ51.3ÜýþcÛÇÓ^±G:!\\Z'#¸[Z\#Z¸PVR ´51.3±ÏAGr,�1�.��Ø��±²°ª«cÛÇÓ*db#.$.ÿr,�1�.�±2w£mÇÈÂKGÛ����ÿ±²°rÇb±J´ÿ��ÈÂK�GÑ)ÿÁyb��ÜÇÓ" "

@<"

@:" :!\\Z'#Z¸PVR ´51.3±ÏAG��780°�Hr,�1�.�-h3ܪ«cÛÇÓ:!\\Z'#Z¸PVR ´51.3�Gr,�1�.�ÿ+.�ÇÈ�ú±��°ýþcÛÇÓc�ÿaÞG��ÿ±²°qrdrcG�3b#.$.ÿ`ÈzëØ)�J´±r,�1�.�±2w£mÇÈÂK±�GÁUÒÓ±c9cÛÇÓ" "

-h3bjk" "

-h3�r,�1�.�ÜÔÕ()ȱ²b£,iÜÇÓr,�1�.��-h3°ÚdÝÜU4ÀÑ�ÿÜ!ÛÇÓí-h3�¾2G:!\\Z'#Z¸PVR Û�� :!\\Z'#¸[Z\#Z¸PVR ´51.3°¾HGÒ)±Q_ÇÈ��° aÝ�PÒcÛÇÓÔ½.iùÏúx7wxmi�?b±²´51.3Ü���ر²°ÔÕcÛÇÓ" "

^�GÔ1.ix23r,�1�.��Øb-h3bÎÜÇÓ" "

"

Ñb-h3bý4±`È z<=�^b�ùAÜÇÓ" "

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Messages per minute last hour" autoRun="True"> <param name="search">search index=_internal eps group=per_source_thruput NOT filetracker Metrics | eval events=eps*kb/kbps | timechart sum(events)</param> <param name="earliest">-1h</param> <module name="ResultsHeader"> <param name="entityName">scanned</param> <param name="entityLabel">Events</param> <module name="FlashChart"> <param name="height">180px</param> <param name="width">100%</param> </module> </module> </module>

Ñb-h3±�-h3ÿ <be`ÈÑ�±'2cÞd�(ÚÓ<Ýb-h3��ÝÛAG:!\\Z'#Z¸PVRGXZY&%SY:Z¸\ZPùÏú °%¸YRMR¸PS ÜÇÓ:!\\Z'#Z¸PVR �ÇûÞb��±²°k>cG°%¸YRMR¸PS �Ò)Ø°ÔÕcÛÇÓXZY&%SY:Z¸\ZP �G:!\\Z'#Z¸PVR ÿ��c�{*7i3�N±ö,r.°ÔÕcÛÇÓ" "

:!\\Z'#Z¸PVR �{´51.3Ü`È��G%¸ON&SÙ¸'Z%GQPN&$G¸&SNX&' �?»b��°ÚdÝ�stcÛÇÓ=¸ON&SÙ¸'Z% �Gr,�1�.�Xb?ѱ-h3°ßd�°ÕcÛÇÓ@PN&$ �G-h3bi,¤±ÔÕÇÈö,r

@9"

.ÜÇÓ¸&SNX&' �G-h3b��ÿGõ.5b+.�bÛ±ýþ()ÈÑ�°ÕcÛÇÓ¾2G¸&SNX&'"G"SP&Z ±��cÛÇÓ" "

r,�1�.�bj>" "

�ÄÜG��±²°ÔÕÇÈ-h3bÚdÝ�ÿÜ!Ûc�ÓÑ)Øb-h3° aÝbr,�1�.�±ÊßcÛÇÓ^±Gr,�1�.�°j>ÇÈ/D°D°�aÞßàcÛÇÓ" "

a:" r,�1�.�b z<=}µ{3°=>cÛÇÓ" "

@:" ÔÕÇÈD|Ü-h3°v{2®icÛÇÓ" "

r,�1�.�b z<=}µ{3b=>" "

r,�1�.�°$SPLUNK_HOME/etc/apps/<your_app>/default/ui/views/±��cÛÇÓ^±G¿sÇÈz<=}µ{3°�!ÛÇÓÛÁG^bþ°��cÛÇÓ"

<view template="dashboard.html">

Ñ)�Gr,�1�.�¹7¤v.ibst°ü�cÛÇÓr,�1�.�q1.�G��q1.ÿstÇÈ)}~3i¹7¤v.i��B�È <¸(N ¹7¤v.i°stcÛÇÓc�ÿaÞGr,�1�.�b z<=}µ{3bÁp±Ñb¹7¤v.i°ü�ÇÈf`ÿ`AÛÇÓ" "

PZ�PZYRG&}Ñ°��ÇÈÑ�±ÏAGx}v,�1b~�°ÑÑÜ��ÇÈÑ�UÜ!ÛÇÓÑ)� :!\\Z'#Z¸PVRZY°rÇGÛ���ç:!\\Z'#¸[Z\#Z¸PVR±²°=>cÛÇÓ" "

ÑbÎ�Gr,�1�.�ÿ <;}��±z~£±x}v,�1ÇÈÏб��cÛÇÓ^bÏбGf`�I¡ z<=°¿scÛÇÓ"

<view template="dashboard.html">

PZ�PZYRGu<;u°4�ȱ�G" "

<view refresh="30" template="dashboard.html">

^±w+.o°��cÛÇÓÑ)���q1.�Ûa�dü+±c9cÛÇÓ" "

<label>Tutorial Dashboard</label> <module name="AccountBar" layoutPanel="navigationHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module>

�¤�67Ü��4.°��Ü!ÛÇÓÑ)±ÏAGr,�1�.��Ø��°ýþÜ!ÈÏб�AÛÇÓ" "

<module name="SearchBar" layoutPanel="mainSearchControls"> <param name="useAssistant">true</param> <param name="useTypeahead">true</param> <module name="TimeRangePicker"> <param name="selected">This month</param> <module name="ViewRedirector"> <param name="viewTarget">simple_search_view</param>

@K"

</module> </module> </module>

'2?"B�Èq1.Ü��°ýþÇȱ�G#!ZøXZ\!PZVSNP ´51.3°��cÛÇÓ" "

-h3bv{2®i"

^±G-h3°õ.5Ü?bÏбÔÕÇÈ�°ó�cÛÇÓ-h3�G-h3b{´51.3Ü %¸ON&SÙ¸'Z% -[­.n°��ÇÈÑ�±ÏAG�·�ÜÊ0()ÛÇÓÒb�·��G-h3bþ�0°ü�cÛÇÓÎëì?"layoutPanel=panel_rowX_colYÓþ��þÜUstÇÈÑ�ÿÜ!ÛÇÿG<Û�� 9þ±¬¨ÇÈÑ�ÿ�úÜÇä@�).nÔÕb·¸åÓ"

'2? r,�1�.��G��q1.°�B�È %¸ON&SÙ¸'Z%Y °stcÛÇÓ��q1.�GùIí! %¸ON&SÙ¸'Z%Y°stcGr,�1�.���·�°stcÛÇÓ"

ÎëìG^bÏбGÔ1.ix23br,�1�.�±�G@Ýb-h3{´51.3ÿ`AÛÇÓ"

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Messages per minute last hour" autoRun="True"> ... <module name="HiddenSearch" layoutPanel="panel_row1_col2" group="KBps indexed per hour last 2 hours" autoRun="True">

Û�GÏAé!�-h3XÜ-h3|3.¤°��ÇÈÑ�UÜ!ÛÇÓ^bÏб�AÛÇ?" "

Ñ)°��Çȱ�GaÝb{´51.3°ü�cÛÇÓÑbÎ�G#S¸S!VMN'SZ'S#¸·$%Z °stcÞG-h3|3.¤7tbö,r.°��cÛÇÓí-h3�GÒb|3.¤XÜßïÇÈ��b QP$ n|±��cÞG%¸ON&SÙ¸'Z% °ü�ÇÈ aÝb{´51.3°F�ÛÇÓ" "

<module name="StaticContentSample" layoutPanel="panel_row2_col1" group="All Indexed Data" autoRun="True"> <param name="text">This will show you all of the data you have loaded into index=main over all time.</param> <module name="GenericHeader" layoutPanel="panel_row2_col1_grp1"> <param name="label">Sources</param> ... <module name="GenericHeader" layoutPanel="panel_row2_col1_grp2"> <param name="label">Sourcetypes</param> ... <module name="GenericHeader" layoutPanel="panel_row2_col1_grp3"> <param name="label">Hosts</param>

@E"

}~.o��bjk"

}~.o������" "

}~.o������" "

}~.o���G��xc���{7n}�.m°ÔÕÇÈ #$%&'("âZã bõ.5ÜÇÓc�ÿaÞG��°þÐ�ú±#.$.±��780°ÇûÞ|}(MÈCLA±G}~.o��°saÞGüH#.$.Ü;aÞÚÈ��bRÊ°#.$.±º{x2mÇÈÑ�ÿÜ!ÛÇÓ" "

W$$ q3r±� <Ýb}~.o��bÎÿ`AÛÇ"ÒbÐ�b��Ý�GYZ'\·¸!% {*7ibu�PN·u}u.3�±jk()�Üi��ÜÇÓ»b @ÝbÎ�~£±W|ÇÈ[5��n7��+,¤r®7°4eÛÇÓÑb @Ýb}~.o��q1.�G).n±pHÞG[5��n7��+,¤r®7bB�È�¤�67°��cÛÇÓÑ)ØbΰsaÞGístÆ.m±�tcÞd�(ÚÓ" "

}~.o��jk��b_`" "

}~.o���G}u.3�ÄÛ��Òb»b).nblñ89�ÊL±jk()ÛÇÓÛÁ��±GðYb).n�stto±�c���°jkcÛÇÓ^±GÑb��b?bÊL°º{x2mcG#.$.�Ø�Ç�°%�cÛÇÓÁ4±G}~.o��q1.°jkcÛÇÓ" "

��r,�1�.��üH��x z<=±jk()���}~.o��°jkÇÈÑ�ÿÜ!ÛÇÓW$$ q3rbÎ�GÇûÞÑb��x z<=}~./,i°stcÛÇÓ��x z<=b�Ú�±ÝÚÞ�G¨r,�1�.�bjk��©°ª«cÞd�(ÚÓ~£±W|()È[5��n7n�+,¤r®7°FÝ}~.o��°jkÇÈÂK�G r{��,w}~.o��©°ª«cÞd�(ÚÓ" "

Û��G��q1.XÜÏA��� ZÐSZ'\Z\°!Z%\#Z¸PVR ´51.3°stÇÈÑ�ÿÜ!ÛÇÓ?�ØÿÚÚ�L�Ø�ÚÂK�G��}~.o��°ÛÁstcGÒbıjkcÛÇÓW$$ q3rbΰðYb).n±�tÇÈÑ�ÿÜ!ÈÑ�°F)�ÚÜd�(ÚÓ" "

��}~.o��" "

��}~.o��" "

��}~.o���G��r,�1�.��üH��x z<=±jk()ÛÇÓr,�1�.�ÿ}~.o�� z<=ÜstÇÈb�üH z<=��°stÇÈÑ�ÿÜ!ÛÇÓ" "

��" "

}~.o��z<=�ºv­7i°ÚdÝ�r,�1�.�z<=±��cÛÇÓÑ)غv­7i�}~.o°k>cG�tÇÈ}~.oº7ix.b��°jkcÛÇÓ^bÎ�G&YZP'¸·Z bo°=>ÇÈ}~.o°=>cÛÇÓ_G}~.oÜß!ïëØ)ÈÊL°/.wÇȨAG?g���780ÜU|}ÇÈÑ�ÿÜ!ÛÇÓ" "

@©"

<form> <label>My form search</label> <searchTemplate>$username$</searchTemplate> <fieldset> <input type="text" token="username" /> </fieldset> <row> <table> <title>Top filePaths</title> <option name="showPager">true</option> </table> </row> </form>

"! YZ¸PVR;Z·$%¸SZ" "

! ��7807t°Ñѱ|}cÛÇÓ" "

! Ñѱ�`ØZÈèéb��°ßdÑ�ÿÜ!ÛÇÓ��cG}~.oÜßïc�Ú��°$ÜvÀf

`ÿ`AÛÇÓ" "

"! �!Z%\YZS" "

! 67���780°Ö>ÇÈ��±YZ¸PVR;Z·$%¸SZÜ�Kc�ÚaÝÛ��G3b#.$.|}}u.3�°��cÛÇÓ" "

! i.w7f&�GYZ¸PVR;Z·$%¸SZ �Øbßï��°R�(MÈf`ÿ`AÛÇÓ" "

}~.o±[*3°íPÈ" "

}~.obI±[*3°ÔÕÇÈÏÐ}~.o��°��cÛÇÓÑbÎ�G}~.obI± Z'SZP"¸"&YZP"'¸·Z °��cÛÇÓ" "

<input type="text" token="username"> <label>Enter a user name</label> </input>

)}~3io°��ÇÈ" "

)}~3iÜ�G#.$.ÿG¹�mi�,wm±|}cÞo°��c�ÚÂKGi.w7ÿab780Üßï()ÛÇÓ)}~3io°��Çȱ�G^bÏб��cÛÇÓ" "

<input type="text" token="username"> <default>some_user_name</default> </input>

)}~3iobI±^°��cÛÇÓ" "

<input type="text" token="username"> <default>some_user_name</default> <prefix>os_username=</prefix> </input>

Û��)}~3io±�t�°ÝPÛÇÓ" "

<input type="text" token="username"> <default>some_user_name</default> <prefix>os_username="</prefix>

@C"

<suffix>"</suffix> </input>

õ.5b+.�J±}~.o±o°W|Çȱ�GYZZ\"g.�°stcÛÇÓ" "

<input type="text" token="username"> <default>some_user_name</default> <prefix>os_username="</prefix> <suffix>"</suffix> <seed>johnvey</seed> </input>

}~.oP}v{2®i" "

}~.o��bP}�G¼�g?bÂKr,�1�.�bÂK�üHÜÇÓ��cGYZ¸PVR;Z·$%¸SZg.��VeKL()��!b~=beÿB�AÛÇÓ¾2GP}-h3���°�êcÛMgÓ^bÎ�G¹7¤v.i��±R�ÇÈ{*7i°ÔÕÇÈ��}~.o��°k>cÛÇÓ"

<form> <label>My form search</label> <searchTemplate>sourcetype=p4change $username$ $filePath$</searchTemplate> <fieldset> <input type="text" token="username" /> <input type="text" token="filePath"> <prefix>filePath="</prefix> <seed>//current</seed> <suffix>"</suffix> </fieldset> </fieldset> <row> <event> <option name="count">100</option> </event> </row> </form>

/3Ô��}~.ov{2®i" "

}~.o���GG3P}-h3�N¾|}£,i°õ2±c�ÂK±G�È�±¤¥±�ÈÂKÿ`AÛÇÓYZ¸PVR;Z·$%¸SZg.�°i,¤v*3ëì�ØíP}-h3±å~ÇÈÑ�±ÏAGGK}~.o��°=>ÇÈÑ�ÿÜ!ÛÇÓ! !

<form> <label>Form search example 3 - inverted flow, panel-defined search</label> <fieldset> <!-- define a common form search input that will be used by all panels below that implement a searchTemplate node --> <input type="text" token="username"> <label>Global username</label> <default>NON_EXISTENT</default> <seed>johnvey*</seed> </input> <input type="time" />

@A"

</fieldset> <row> <chart> <title>Commits over time</title> <searchTemplate>sourcetype=p4change OR sourcetype=jira user="$username$" | timechart count</searchTemplate> <option name="charting.chart">area</option> </chart> <table> <title>Top files touched by the user</title> <searchTemplate>sourcetype=p4change OR sourcetype=jira user="$username$" | top filePath</searchTemplate> </table> </row> <row> <table> <title>Users vs changetype</title> <searchTemplate>sourcetype=p4change OR sourcetype=jira user="$username$" | ctable user changetype maxcols=4</searchTemplate> <option name="count">20</option> </table> <chart> <title>Average lines added by the user</title> <searchTemplate>sourcetype=p4change OR sourcetype=jira user="$username$" | timechart avg(added)</searchTemplate> <option name="charting.chart">line</option> <option name="charting.legend.placement">none</option> </chart> </row> </form>

Äb}~.o��� 9ÝbB�È��°)um-,ÔcG�ù�ÝGí��� fieldset£w�67Ü#.$.ÿ|}c�o°stcÛÇÓú�Gí��bi.w7f&�GfieldsetXÜ��()�|}g.�b��d�U a Ý�/,ÔÇÈf`ÿ`AÛÇÓ" "

�7|3��GG34ÖT"

Á4±G}~.o��b%�ßï�cÞGaÝb��°�P=AG4ÖTÜGÒb��bB�Èh¦°ÔÕcÛÇÓÎëìGI5bÎb 9Ýb���GaÝb��±�KÇÈÑ�ÿÜ!ÛÇÓ" "

<form> <label>Form search example 4 - inverted flow, panel-defined post-process</label> <!-- define a search that returns, in one result set, all of the data that is needed by the subsequent panels --> <searchTemplate>sourcetype=p4change OR sourcetype=jira user="$username$" | head 10000</searchTemplate> <fieldset> <input type="text" token="username"> <label>Global username</label> <default>NON_EXISTENT</default> <seed>johnvey*</seed> </input> <input type="time" /> </fieldset> <row> <chart> <title>Commits over time</title>

<;"

<searchPostProcess>timechart count</searchPostProcess> <option name="charting.chart">area</option> </chart> <table> <title>Top files touched by the user</title> <searchPostProcess>top filePath</searchPostProcess> </table> </row> <row> <table> <title>Users vs changetype</title> <searchPostProcess>ctable user changetype maxcols=4</searchPostProcess> <option name="count">20</option> </table> <chart> <title>Average lines added by the user</title> <searchPostProcess>timechart avg(added)</searchPostProcess> <option name="charting.chart">line</option> <option name="charting.legend.placement">none</option> </chart> </row> </form>

í-h3Xhb YZ¸PVRÙNYSÙPNVZYYg.��GÁÂ��±²°�P=AGñYb��-{¤[{7°¾HÞÒ)Ø°rÇÏб}~.o��±��cÛÇÓÜi´)3�GYZ¸PVR;Z·$%¸SZg.�Ü��()��²ï��°þÚGYZ¸PVRÙNYSÙPNVZYYg.�ܲï��°�tcÛÇÓ" "

r{��,w}~.o��" "

r{��,w}~.o��" "

}~.o��b[5��n7Û���+,¤r®7°��±ÏÈoÜz~W|cÛÇÓ" "

�+,¤r®7"

|}}~.o¨�+,¤r®7©�G��89��¤�67°�+,¤r®7xmiÜÔÕcÛÇÓ�+,¤r®7b�¤�67�GXÊ��Û��#.$.ÿ��ÇÈo±ÏAk>ÇÈÑ�ÿÜ!ÛÇÓÑb´51.3�GÄ5bÜi{7),wmb SO$ZGuSZÐSu��}u.3�Ü��()�¤+-¹u°�!��ÛÇÓ" "

"! %¸ãZ%äfE?°¸%YZå" k>()��+,¤r®7b�±ßd[*3Ó" ""! \Z�¸&%SäfE?°¸%YZå" ��Çû!)}~3i�¤�67Ó")}~3i�¤�67ÿOÝ�Ø�ÚÂKGÁpb�¤�67ÿ��()ÛÇÓ" "

"! $PZ�!ÐäfE?°¸%YZå" |}b SO$ZGuSZÐSubßà°ª«Ó" ""! Y&��!Ð"äfE?°¸%YZå" |}b SO$ZGuSZÐSubßà°ª«Ó" ""! VRN!VZ"äfE?°¸%YZå" of&ÿf`ÓÎ?uã¸PuÓ#.$.ÿ�êc��+,¤r®7�¤�67ÓÑ)Ø�G��c�D|ÜG��±ÏAk>()��¤�67bI±ÔÕ()ÛÇÓ" "

"! $N$&%¸S!'Q#Z¸PVR"äfE?°¸%YZå" �+,¤r®7b}u.3�k>±st()È��Óf&u�!Z%\°NP#¸%&ZuùÏúu�!Z%\°NP=¸ãZ%u°f`�ÇÈÓ�!Z%\°NP#¸%&Z � $N$&%¸S!'Q#Z¸PVR �Ø�P()�()�}u.3�

<a"

ÜGk>()��+,¤r®7�¤�67bo±ß�)ÈÓ�!Z%\°NP=¸ãZ% � $N$&%¸S!'Q#Z¸PVR �Ø�P()�}u.3�ÜGk>()��+,¤r®7b[*3±ß�)ÈÓ�!Z%\°NP=¸ãZ% � N$&%¸S!'Q#Z¸PVR �Ø�P()�}u.3�ÜGk>()��+,¤r®7b[*3±ß�)ÈÓ"

<input type="dropdown" token="username"> <label>Select Name</label> <populatingSearch fieldForValue="suser" fieldForLabel="suser"><![CDATA[sourcetype=p4change | rex "user=(?<suser>¥w+)@" | stats count by suser]]></populatingSearch> <default>nagrin</default> <choice value="*">Any</choice> </input>

[5�"

|}}~.o¨P¸\!N©�G[5��n7bxmi°ÔÕcÛÇÓ[5��¤�67�GXÊ��Û��#.$.ÿ��ÇÈo±ÏAk>ÇÈÑ�ÿÜ!ÛÇÓÑb´51.3�GÄ5bÜi{7),wmb SO$ZGuSZÐSu��}u.3�Ü��()�¤+-¹u°�!��ÛÇÓ" "

"! %¸ãZ%äfE?°¸%YZå" k>()�[5��n7b£,ibi,¤ÜßïÇÈ[*3Ó" ""! \Z�¸&%SäfE?°¸%YZå" ��Çû!)}~3i[5��n7Ó)}~3i�n7ÿOÝ�Ø�Úì`ÚG�U��()ÛMgÓ" "

"! $PZ�!ÐäfE?°¸%YZå" |}b SO$ZGuSZÐSubßà°ª«Ó" ""! Y&��!Ð"äfE?°¸%YZå" |}b SO$ZGuSZÐSubßà°ª«Ó" ""! VRN!VZ"äfE?°¸%YZå" of&ÿf`Ó"Î?uã¸PuÓ"#.$.ÿ�êc�[5��n7Ó"Ñ)Ø�G��c�D|ÜG��±ÏAk>()�[5��n7bI±ÔÕ()ÛÇÓ" "

"! $N$&%¸S!'Q#Z¸PVR"äfE?°¸%YZå" [5��n7°k>ÇÈ��±stÇÈ��Óu�!Z%\°NP#¸%&Zu" ùÏú"u�!Z%\°NP=¸ãZ%uÿf`Ó�!Z%\°NP#¸%&Z � $N$&%¸S!'Q#Z¸PVR �Ø�P()�()�}u.3�°��cGk>()�[5��n7bo±ß�)ÛÇÓ�!Z%\°NP=¸ãZ% � $N$&%¸S!'Q#Z¸PVR �Ø�P()�()�}u.3�°��cGk>()�[5��n7b[*3±ß�)ÛÇÓ" "

Î?" "

<input type="radio" token="username"> <label>Select Name</label> <populatingSearch fieldForValue="suser" fieldForLabel="suser"><![CDATA[sourcetype=p4change | rex "user=(?<suser>¥w+)@" | stats count by suser]]></populatingSearch> <choice value="*">Any</choice> </input>

���}~.o��" "

���}~.o��" "

ÏAQR()�}~.o��°=>ÇÈÂKG��q1.±`È ZÐSZ'\Z\°!Z%\#Z¸PVR ´51.3°stÇÈÑ�ÿÜ!ÛÇ"��q1.±QÇȦ§�G¨��q1.©°ª«cÞd�(ÚÓ" "

<@"

��" "

��q1.°��cÛÇÓ" "

<view onunloadCancelJobs="False" autoCancelInterval="100"> <!-- autoCancelInterval is set here to 100 --> <label>Sample search</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module>

^±G=>c�Ú}~.o��bèé°ó�cG^b��° aÝÛ��G3��cÛÇÓ" "

Üi��ßïbÎ" " <module name="HiddenSearch" layoutPanel="mainSearchControls"> <param name="search">sourcetype=$st$</param> <module name="ExtendedFieldSearch"> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="st"> <param name="default">apache_error</param> </param> </param> </param> <param name="replacementMap"> <param name="arg"> <param name="st"> <param name="value"></param> </param> </param> </param> <param name="field">Sourcetype</param> <module name="EventsViewer" layoutPanel="resultsAreaLeft"> <param name="segmentation">full</param> </module> </module> </module>

ô{3�l.�bst" "... <module name="HiddenSearch" layoutPanel="mainSearchControls"> <param name="search">sourcetype=apache_error *$target$*</param> <module name="ExtendedFieldSearch"> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="target"> <param name="default">500</param> </param> </param> </param> <param name="replacementMap">

<<"

<param name="arg"> <param name="target"> <param name="value"></param> </param> </param> </param> <param name="field">Wildcard search</param> <module name="EventsViewer" layoutPanel="resultsAreaLeft"> <param name="segmentation">full</param> </module> </module> </module>

@ Ýb²3°st" " <module name="HiddenSearch" layoutPanel="mainSearchControls"> <param name="search">sourcetype=apache_error $error$ $hours_ago$</param> <module name="ExtendedFieldSearch"> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="error"> <param name="fillOnEmpty">True</param> </param> </param> </param> <param name="replacementMap"> <param name="arg"> <param name="error"> <param name="value"></param> </param> </param> </param> <param name="field">Multiple replace (apache search)</param> <module name="ExtendedFieldSearch"> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="hours_ago"> <param name="fillOnEmpty">True</param> <param name="prefix">starthoursago=</param> </param> </param> </param> <param name="replacementMap"> <param name="arg"> <param name="hours_ago"> <param name="value"></param> </param> </param> </param> <param name="field">Multiple replace (starthoursago)</param> <module name="EventsViewer" layoutPanel="resultsAreaLeft"> <param name="segmentation">full</param> </module> </module> </module> </module>

<9"

%Xbst" "

�ÛcÚ��780�^bÏб�AÛÇ?! eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" OR user="$User$"

780ßï°ÕÇ"H��"�"H��"-[­.n°stcÞÑ)°_�cÛÇÓ! eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" $User$

ÑÑÜG$pYZP$�Gd%X"&YZPGuÿ��±í!Gdudÿ��±í!ÛÇÓ" "

<module name="HiddenSearch" layoutPanel="mainSearchControls"> <param name="search">eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" $User$</param> <module name="ExtendedFieldSearch"> <param name="field">SourceIP</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="SourceIP"> <param name="fillOnEmpty">True</param> <param name="value"></param> </param> </param> </param> <param name="replacementMap"> <param name="arg"> <param name="SourceIP"> <param name="value"></param> </param> </param> </param> <module name="ExtendedFieldSearch"> <param name="field">User</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="User"> <param name="fillOnEmpty">True</param> <param name="prefix">OR user="</param> <param name="suffix">"</param> </param> </param> </param> <param name="replacementMap"> <param name="arg"> <param name="User"> <param name="value"></param> </param> </param> </param> <module name="EventsViewer" layoutPanel="resultsAreaLeft"> <param name="segmentation">full</param> </module> </module> </module> </module>

<K"

üH²3bæst" "... <module name="HiddenSearch" layoutPanel="mainSearchControls"> <param name="search">eventtypetag=config_file source=$File$ OR $File$</param> <module name="ExtendedFieldSearch"> <param name="field">File</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="File"> <param name="value"></param> </param> </param> </param> <param name="replacementMap"> <param name="arg"> <param name="File"> <param name="value"></param> </param> </param> </param> <module name="EventsViewer" layoutPanel="resultsAreaLeft"> <param name="segmentation">full</param> </module> </module> </module> ... <module name="HiddenSearch" layoutPanel="mainSearchControls"> <param name="search">* | stats count by $st$</param> <module name="ExtendedFieldSearch"> <param name="field">Count by field</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="st"> <param name="value"></param> </param> </param> </param> <param name="replacementMap"> <param name="arg"> <param name="st"> <param name="value"></param> </param> </param> </param> <module name="EventsViewer" layoutPanel="resultsAreaLeft"> <param name="segmentation">full</param> </module> </module> </module> </view>

<E"

��q1.bjk"

��q1." "

��q1." "

#$%&'("âZã bõ.5�ÇûÞq1.ÜÇÓq1.bc9±QÇÈÏAÜ�£����G lmnopU bjk©°ª«cÞd�(ÚÓ��q1.�G°%¸YR J´µ�?bõ.5ÜÇÓ^bßà±ÕaÞG�ç��q1.°=>cÛÇÓ" "

Ñ)�Gq1.°��ÇÈ��bÜi_ÝbRÞ_`ÜÇÓ��q1.b����±QÇȦ§�G ��q1.°��ÇÈ©°ª«cÞd�(ÚÓr,�1�.�b=>±ÝÚÞ�G¨r,�1�.�b��©bõ.5°ª«cÞd�(ÚÓ" "

stcÞÚÈ W$$ b��q1.°��Çȱ�G^bm¹,¤±ÕÚÛÇÓ" "

a:" q1.±4��Ú´51.3°ó�cÛÇÓùÒØd¼�g?ÂKG��´51.3°stcÛÇÓ" "

@:" &[!Zø¯'¸·ZÑ:з% Üí´51.3°��cÛÇÓ" "

<:" W$$ )uvwix?$SPLUNK_HOME/etc/apps/<app_name>/data/ui/views/±`Èq1.)uvwix±<view_name>.xml°ß!ÛÇÓ" "

9:" W$$ ±G3bq1.ÿ`ÈÂKG q1.fvw�67b=>©±`Èßà±ÕaÞpU ÜÒ)Ø°2v75cÛÇÓ" "

��q1.b��" "

��q1.b��" "

Ñbõ.5Ü�G����q1.bjk��±ÝÚÞßàcÛÇÓÑbq1.°+.�Çȱ�GÑbõ.5bΣw�67�ØÁ±²°Gjkc�^b RZ%%NøNP%\"¸$$ ±f¶.cÛÇÓ"$SPLUNK_HOME/etc/apps/helloworld/default/data/ui/views/simple_search_view.xml:" ^±G bõ.5±å~cÛÇÓ" "

http://localhost:8000/en-US/app/helloworld/simple_search_view

äîmiùÏúg.i°GstÇÈ{7mi.3îmi�g.iÜß!ïëÞd�(ÚÓå" "

q1.b��" "

W$$ bq1.)uvwix± [!Zø:з% }µ{3°=>cÛÇÓ" "

¿sÇÈ}µ{3°�!GÌvb [!Zø n|°��cÛÇ?" "

<view> </view>

<©"

��4.b��" "

ÁUÜi£���q1.�Gq1.±2w£mÇÈ��±��4.°ÔÕÇÈ�PbUbÜÇÓ" "

"

Ñbq1.°jkÇȱ�G#Z¸PVR°!Z%\ ´51.3ÿf`ÜÇÓ" "

Ñb´51.3°��4Ü`Ø�H�W|ÇÈÑ�ÿÜ!ÛÇÿG���a�±cÞù!ÛÇÓ" "

<view> <!-- This module renders the search box --> <module name="SearchField" layoutPanel="mainSearchControls"> </view>

%¸ON&SÙ¸'Z% °��cÞGÑbq1.bÔÕÂä° #$%&'( ±üÕcÛÇÓ¦§�G¨´51.3_`©b %¸ON&SÙ¸'Z%Y°ª«cÞd�(ÚÓ" "

±²ÔÕºx2b��" "

��±²°ÔÕcÞ³I=tÇÈf`ÿ`ÈÂKÿ`AÛÇÓÒbÂK�GZ[Z'SY#!ZøZP ´51.3°��cÛÇÓ" "

<view> <!-- This module renders the search box --> <module name="SearchField" layoutPanel="mainSearchControls"> <!-- This module renders the resulting events from your search --> <module name="EventsViewer"/> </module> </view>

´51.3��" "

#Z¸PVR°!Z%\ ´51.3n|�GZ[Z'SY#!ZøZP ´51.3b4ÛÜ�H�ÚÑ�±'2cÞd�(ÚÓÒbT��GZ[Z'SY#!ZøZP � #Z¸PVR°!Z%\ b���ØÜÇÓÝÛAGZ[Z'SY#!ZøZP �G���,wm±|}()���°�!��ÛÇÓ��Û�Gv{2®i-h3��U�!��ÛÇÓ" "

�°��c�4G;Ab´51.3°�HÈÑ�°F)�ÚÜd�(ÚÓ" "

VRPN·Z b��" "

�ÄÜGÑbq1.bÜi£�jyÿÜ!Ûc�Óc�cGõ.5°mo.«±k>ÇÈ��±�G��ÇÈf`ÿ`È´51.3ÿ(رÚdÝ�`AÛÇÓÛÁGVRPN·Z °��ÇÈf`ÿ`AÛÇÓ%±Gi,¤b�q´51.3Ü`ÈWVVN&'SɸP � W$$ɸP ÜÇÓÑ)Øÿi,¤�q±ÔÕ()ÈÏбü�Çȱ�G%¸ON&SÙ¸'Z%Gu'¸[!Q¸S!N':Z¸\ZPu°��cÛÇÓ" "

<view> <!-- top nav chrome --> <module name="AccountBar" layoutPanel="navigationHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <!-- This module renders the search box --> <module name="SearchField" layoutPanel="mainSearchControls">

<C"

<!-- This module renders the resulting events from your search --> <module name="EventsViewer"/> </module> </view>

-[­.nbü�" "

^±G#.$.ÿ±²bõ.5°mo.«±OÈ��b��ÿf`±�AÛÇÓ%±G��±²ÿ aõ.5±ºÛØ�ÚÂK±f`ÜÇÓÑbÂK�GÙ¸Q!'¸SNP ´51.3°��cÛÇÓ" "

<module name="Paginator"> <param name="entityName">events</param>

$¸Q!'¸SNP Ü� Z'S!SO"¸·Z -[­.n°ü�cÞÚÈÑ�±'2cÞd�(ÚÓÑb-[­.n�fEÜÇÓÙ¸Q!'¸SNP�»±UG3b-[­.n°�ÈÑ�ÿÜ!ÛÇÿGfEÜ�`AÛMgÓc�ÿaÞGiÎÜ�stcÛMgÓ" "

ÑbÂKGq1.z<=�^bÏб�AÛÇÓ" "

<view> <module name="AccountBar" layoutPanel="navigationHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="SearchField" layoutPanel="mainSearchControls"> <module name="Paginator"> <param name="entityName">events</param> <module name="EventsViewer"/> </module> </module> </view> </pre>

q1.±ùI°íPÈ" "

q1.b=>ÿÂLÈ�GÒ)±L�AnÇÚùI°íPÛÇÓùI°íPȱ�GÁpbÊL±`È&[!ZøÑn|bÇ[4±&%¸ãZ%Ñn|°��cÛÇÓ" "

<view> <label>Basic Search View</label>

Î" "

��±q1.��b7t°ÕcÛÇÓ_G{7)7i��`Ü�`AÛMgÿG��ÿL�AnÇÚÏбstÇÈÑ�ÿÜ!ÛÇÓ" "

<view> <label>Basic Search View</label> <!-- Top nav chrome --> <module name="AccountBar" layoutPanel="navigationHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <!-- This module renders the search box --> <module name="SearchField" layoutPanel="mainSearchControls"> <!-- You need paginator to page through all the results from the search --> <module name="Paginator"> <param name="entityName">events</param> <!-- This module renders the resulting events from your search --> <module name="EventsViewer"/> </module> </module>

<A"

</view>

pt" "

�ÄÜGÜi£���q1.b��ÿÂLAÛc�Óyzb��q1.°jkÇȱ�G»b��´51.3°��cÛÇÓ$SPLUNK_HOME/etc/apps/search/default/data/ui/views/flashtimeline.xml±2w£mcÞ)}~3i��q1.°ÚÝÜUª«ÇÈÑ�ÿÜ!ÛÇÓÑbq1.°+.�Çȱ�G^±2w£mcÛÇÓ" "

RSS$8{{%NV¸%RNYS8C;;;{Z'Lp#{¸$${YZ¸PVR{�%¸YRS!·Z%!'Z" "

äîmiùÏúg.i°GstÇÈ{7mi.3îmi�g.iÜß!ïëÞd�(ÚÓå" "

9;"

����v,5��5�wib��"

���b��b����v,5��5�wi�{�" "

���b��b����v,5��5�wi�{�" "

W$$ ô.wmõ.mbjkÿÂLÈ�GstÇÈ W$$ b).nv{Ù°��ÇÈ��b��°��ÇÈÑ�ÿÜ!ÛÇÓÒbÛ±�G��5�wi° W$$ ±��cÞGW$$ bÔÕv{Ù°��cÛÇÓ�v,5��5�wiùÏúf7}u|v.�67° W$$ ±��ÇÈÂK�G#$%&'(STÛ��#$%&'(..4.47wº7�±`È��}µ{3�m¹o±ÏAþÐÑ�ÿÜ!ÛÇÓ" "

Ñb£w�67Ü�G¥tÜ!Èá����¤�67b_`°ßàcÛÇÓ��±QÇÈÒb»b���GST/0123±×Ø()ÞÚÛÇÓ�v,5��5�wib��±QÇÈÒb»b���G�v,5/h.5½/0123°ª«cÞd�(ÚÓ" "

lmno��b��ÿÂLÈ�GQ_b W$$ ��°GstÇÈ W$$ °��ÇÈ#.$.ÿ��ÇÈÑ�ÿÜ!ÈÏбGW$$ £,i2,¤¥¦b��ÿf`ÜÇÓ" "

��" "

W$$ ���GstÇÈ W$$ b).nv{Ù°��cÛÇÓW$$ b).nv{Ù�).n|}�Òb»G#$%&'( ÿ).n°=A�Ð��°ü�ÇÈ��b��°4gÜÚÛÇÓÑ)±ÏAGW$$ ÿ¥tÜ!È).nbèéG#$%&'( {7mn7m0b2w£m��GùÏú #$%&'( ÿÒ)° ¡ÇÈ��°lmn/{«ÇÈÑ�ÿÜ!ÛÇÓ" "

ÇûÞÜ�`AÛMgÿ #$%&'( b*db W$$ �47wº7���°4gÜÚÛÇÓST/0123b��}µ{3v}µv7mõ.5±`È��}µ{3xmi�Ø��°stÇÈÑ�ÿÜ!ÛÇÓ¦§�GST/0123b¨��}µ{3bc9©°ª«cÞd�(ÚÓ" "

_G���ÇûÞ|+.43ÜÇÓÝÛAG)}~3iÜÇûÞb W$$ ÿ¥tÇÈÑ�ÿÜ!ÛÇÓÒ)Ø��° W$$b)uvwix±ßdÑ�±ÏAG��°LYÇÈÑ�ÿÜ!ÛÇÓ��cGW$$ ÿ{7),wmÇÈ).n�ÇûÞ2±»b W$$U¥tÇÈÑ�ÿÜ!ÛÇÓ" "

U'$&SY" "

W$$ b|}°��cÛÇÓ%�bèéb).n°{7),wmÇÈf`ÿ`ÈÂKÿ`AÛÇÓÒbÂK�GST/0123b¨|}b��©°ª«cÞd�(ÚÓ" "

U'\ZÐZY" "

W$$ b).n° ¡ÇÈ��±Glmno{7),wm°��cÛÇÓfEÜ�`AÛMgÿG).nÿ»b|}� Kc�ÚÏбGÑ)°þÐÑ�ÿÜ!ÛÇÓ" "

9a"

$PN$Y � SP¸'Y�NP·Y" "

lmno).nÖTb3.3°��cÛÇÓ%��).nÿ`ÈÂKGÒ)°ÖTÇÈ��b3.3° $PN$Y:VN'� ±=>cGSP¸'Y�NP·Y:VN'� ±ÏAÒ)°).n±x7wcÛÇÓW$$ b#.$.ÿ W$$ °L¡��±{7mi.3ÇÈÂK�GÒ)Ø#.$.ÿ $PN$Y:VN'� b ¡Âä°kaÞÚÈÑ�°�.cÞd�(ÚÓ" "

XZYS·¸$" "

Ñ)�lmnoº7�g{7ib��bUbÜÇÓ9:; Ü�Û�.g.i()ÞÚÛMgÓ" "

W&SRNP!¢Z" "

��f/7�bc9°��ÇÈ��bUbÜÇÓ_GW$$#.$.�GstÇÈc9°G�m¹o±I±¡ôcÞÚÈ,-±-AúÞÈGÛ��G�m¹o±I±¡ôcÞÚÈ#.$.±stÇÈ,-°-AúÞÈf`ÿ`AÛÇÓ" "

pYZP"$PZ�Y" "

&YZP"$PZ�Y ±ÏA)}~3i W$$ °��cÛÇÓ¦§�Gijb¨)}~3iW$$ b����©°ª«cÞd�(ÚÓ" "

�v,5��5�wi" "

�v,5��5�wi�GstÇÈ W$$ bÔÕv{ÙÜ¥tÜ!ÈÇûÞb��5�wiÜÇÓÑ)�G?b).n°?bÏбlmn/{«cÞ W$$#.$.±ÔÕÇÈ�°��cÛÇÓ§¨b��Xd±ÏAÛÇÿGW$$#.$.� W$$ ±4Û)È�v,5��5�wi�{7n[wicGÒ)°ã�ÇÈÑ�ÿÜ!ÛÇÓ" "

 ¡¢e���vg.i" "

 ¡¢e���vg.i�G¼�g?b #$%&'("W$$ ±Ow()ÞÚÛÇÓ ¡¢e���vg.i°stcÞG�`�).n°~£±=APcÛÇÓf`±pHÞGÒ)Ø°r,�1�.�±ÔÕc�AGýþÇÈ #$%&'("âZã b ¡¢e���+,¤r®7±��cÛÇÓ ¡¢e��°stÇÈ�GW$$ ±+.�c�).n±»cÞf`���ÿ��±þëÛÇÓ" "

W$$ Üb ¡¢e��ùÏúvg.ibst���G¨ ¡¢e��©°ª«cÞd�(ÚÓ" "

q1.�r,�1�.�" "

q1.�r,�1�.��GW$$ Üjkc��v,5��5�wi°ÔÕcÛÇÓr,�1�.��¾2GQ_ÇÈ��0bx7wGùÏú W$$ °+.�ÇÈÛ±ÔÕÇÈvg.i0bx7w°4gÜÚÛÇÓ��q1.�Gðñ±��°ýþÜ!ÛÇÓ" "

{*7in{¤" "

{*7in{¤°��cÞGW$$ b�v,5°=>cNÒÜ!ÈÏбcÛÇÓ" "

9@"

}u.3�" "

n|" "

f/7�" "

lmno��f/7�°��cÛÇÓ�cÚ��f/7�bÒ)])bc9°F)Á±��cÞd�(ÚÓ" "

��5�wi±»ÇÈ^8" "

W$$ b��5�wi±»ÇÈ)}~3i§¨�G\Z�¸&%S:·ZS¸ Ü��ÇÈGÛ�� #$%&'(STÜí��5�wib§¨°ã�ÇÈÑ�±ÏA��cÛÇÓ" "

W$$:VN'�" "

W$$:VN'�" "

¸$$:VN'� °��cÞGW$$ ÿ #$%&'("âZã ±ÔÕ()ÈÏбcÛÇÓW$$ q3r°stÇÈÂKGq3rÿCLA±Ñ)°��cÛÇÓ! !

��" "

W$$ °ÒÓ±cG#$%&'("âZã Ü=>Çȱ�G^bmn7$°$#Ù=p"ï:%<Z{ZSV{¸$$Y{&¸$$¯'¸·ZÑ{\Z�¸&%S{¸$$:VN'� ±��cÛÇÓ" "

[ui] is_visible = true label = <name>

"! mn7$±�?uiAö,r.ÿf`ÜÇÓ" ""! W$$ ÿ #$%&'("âZã b�+,¤r®7­01.±ÔÕ()ÈÏбÇȱ�Gis_visible° SP&Z ±��cÛÇÓ" "

"! label±stÇÈ W$$ bùI°��cÛÇÓ" "

W$$ ° ¸$$"%¸&'VRZP ±��ÇÈ" "

^bmn7$° ¸$$:VN'� ±��cGstÇÈ W$$ ÿ ¸$$"%¸&'VRZP ±��Ü!ÈÏбcÛÇÓíf&°^b�ùA|}cÛÇÓ" "

[launcher] author=<author of app> description=<textual description of app> version=<version of app>

^b¥¹°GstÇÈ W$$ b../appserver/static/)uvwix±�ý±��cÞd�(ÚÓ" "

"! appIcon_<appname>.png:" Ñb2{f7�G=¸&'VRZP bstÇÈ W$$ bùIbûh±ÔÕ()ÛÇÓ" "

9<"

"! screenshot_<appname>.png:" Ñbmwx.7�6,i�G=¸&'VRZP bstÇÈ W$$ bßàbıÔÕ()ÛÇÓ" "

'�f7¹7Íb³�" "

#$%&'( b ¸$$YZP[ZP �GstÇÈ W$$ b££2£,i䥹GM##G>¸[¸#VP!$S �?å°ÇûÞ=>cÛÇÓW$$ b�ç4.567°xx.mÇÈÂKGapp.conf°��cÞ³�c�2£,i°#.$.ÿ¥tÜ!ÈÏбÇÈÑ�ÿÜ!ÛÇÓinstallmn7$f&° ¸$$:VN'� }µ{3±��cGq3��74.°ü�cÛÇÓÎëì?" "

[install] build = 2

"! mn7$±�[install]ö,r.ÿf`ÜÇÓ" ""! q3��74.±'Òb U!°��cÛÇÓÑÐÇÈ�Gb�ÿ W$$ b�ç4.567°{7mi.3c��!GW$$ ±-,Æ.5()��ç2£,i°ÇûÞ=>Ü!ÈÏб�AÛÇÓ" "

W$$ Ü=ïæ± W$$ b'�f7¹7Í°æ+.�cG�[®$b�½,�1°wx2c�d�ÚÂK�G^bpXU °|}cGÒѱ`È�n7°wx,wcÛÇÓ" "

RSS$8{{%NV¸%RNYS8C;;;{¯ã&·$" "

ästcÞÚÈ #$%&'( b RNYS8$NPS Üß!ïëÈÓå" "

 ¡¢e��" "

 ¡¢e��" "

 ¡¢e���GÁURÞ£�)*+,-.��ÜÇÓÑ)±ÏAN¾��b�|ÿde±�AÛÇÓr,�1�.��}~.o���ÇûÞ ¡¢e��ıjk()ÛÇÓc�ÿaÞG#$%&'( b��ê�±¤)G).nb�`�%&°àØ�±Ü!È��°ÚdÝ�=>cG^±Ò)Ø°r,�1�.�±Ve¿eÛÇÓ" "

r,�1�.��GÔ½.iG|[}Gx7w�?bÖÜ ¡¢e��°L�AnÇdÔócÛÇÓc�ÿaÞGW$$#.$.ÿ�°cÏÐ�cÞÚÈb�GÒcÞG ¡¢e��°stcÞ?bÏбÒb]£°¥¦ÇÈÑ�ÿÜ!È�°\]ÇÈf`ÿ`AÛÇÓÒcÞG ¡¢e��°r,�1�.��q1.fvw�67±��cÛÇÓ" "

Î?"stcÞÚÈ.{ib®��i[}u,w°à�±ÇÈ��bW$$°jkÇÈ�cÛÇÓª«pXU°}~+.cGr®7+.��q°�NcGÛ�G®��+|Ü¥tÜ!È).n°¥tcÞ ¡¢e��°=>ÇÈÑ�ÿÜ!ÛÇÓ" "

��bjk" "

Ñ)Ûܱ #$%&'( b��ê�°=A�a�Ñ�ÿ�ÚÂK�G#.$./0123b¨��ùÏúà§b��©°¨gÜd�(ÚÓ).nbÁU�`�%&°à�±cGW$$#.$.bÁÂ]£°¥¦Ü!ÈÏÐG��°jkcÛÇÓc�ÿaÞGÎëìö3¤)mw W$$ °jkcÏÐ�ÇÈÂKGÒbÔ.oÿ W$$ �Ø�°>�Úb�°\]ÇÈf`ÿ`AÛÇÓÒcÞGÑb)*°ºsÇÈ��°jkcG¤¥���ÜÒ)°��cÛÇÓ" "

99"

��b ¡" "

jkÇÈ��bjVÿóÛa�ØGÒ)° ¡cÞGæýþÜ!ÈÏбcÛÇÓ���G#$%&'("âZã �ØGÛ��#$%&'(STXÜ ¡ÇÈÑ�ÿÜ!ÛÇÓÛ��GstÇÈ W$$ b)uvwix±`È Y¸[Z\YZ¸PVRZY:VN'� °=>ÇÈÑ�ÿÜ!ÛÇÓW$$ ���ÿ ¡¢e��°=>ÇÈ��bÁyb���G#$%&'(ST°GstÇÈ W$$ bf7¹�miXÜ¥tÇÈÑ�ÜÇÓ" "

a:" #$%&'("âZã bûı`È�+,¤r®7�Ø W$$ °��cÛÇÓ" "

@:" ^±G÷ı`ÈSTx7w°wx,wcÛÇÓ" "

<:" W$$ ��n�°��cÛÇÓÑ)Ø�ÇûÞ aÝb W$$ °»©±ÇÈ��ÜÇÓ ¡¢e��Û��{*7in{¤°=>ÇÈÑ�ÿÜ!ÛÇÓÛ��Gq1.G�qG��f/7�°¿scÛÇÓ" "

9:" �ç ¡¢e��°jkcÞ ¡cÛÇÓÒ)ÿ W$$ ±QÇÈ ¡¢e��õ.5± ¡()G bÂä�Ø2w£mÜ!ÛÇÓ" "

http://localhost:8000/en-US/manager/<app_name>/saved/searches

ä%NV¸%RNYS8C;;; °stcÞÚÈ #$%&'(îmiùÏú{7mi.3g.iÜß!ïëÞd�(ÚÓå" "

��° W$$ ±�KÇÈ" "

 ¡¢e��° #$%&'(STäÛ�� #$%&'("âZãåÜÁp±=>ÇÈ�G$SPLUNK_HOME/etc/users/b#.$.)uvwix±��()ÛÇÓ ¡¢e���GÒb W$$ b)uvwixG%±$SPLUNK_HOME/etc/apps/<app_name>/default/savedsearches.conf±`ÈÂKGW$$ ±fcÛÇÓ ¡¢e��° W$$#.$.7ªÜNÒÇÈÂKGÛ�� W$$ùImõ.m±��ÇÈÂK�GÒb��±§¨°��cÛÇÓ" "

1.! #$%&'(STÜGstcÞÚÈ W$$ b ¡¢e��õ.5±2w£mcÛÇÓ! !

2.! xmiq1.Ü ¡¢e��°«cGÒb¬±`ȧ¨x7w°wx,wcÛÇÓ! !

3.!  ¡¢e��bNÒ�,wm°wx,wcÛÇÓÑ)±ÏAGÒb���G#.$.)uvwix�ØÒb W$$ b)uvwix±å~cÛÇÓ! !

4.! �¤�67ÜG#.$.b¨e¿e{j!¿e§¨°2w£mf7i+.3xmiÜ��cÛÇÓ! !

W$$ £,i2,¤¥¦b��" "

W$$ £,i2,¤¥¦b��" "

Ñbõ.5Ü�GstcÞÚÈ W$$ b£,i2,¤¥¦°=>ÇÈ��°ßàcÛÇÓÑb¥¦°stcÞGW$$ST�ÿ��ÇÈf`ÿ`Èlmno��°ÔÕcGW$$ °¥t89±cÛÇÓÎëìGW$$ °jkÇÈ|}°ü�c�AG ¡¢e��b%�bf&°£,i2,¤cÛÇÓ" "

=ïbÜi�J�&!'$&SÑÜÇÓÑ)� <�]äº7�g{7iGº7¹u¹uG}u.3�åÒb»G).nn{¤G�

9K"

­)*GùI{[*3�?b).nb´)x7|±stÇÈ)*°»©±ÇÈUbÜÇÓäº7�g{7iGº7¹u¹uG}u.3�f&å�G|}ÿ¨e¿e{j!¿e°þÐ��5�wi°%�cÛÇÓÎëìGäZ'\$N!'SG¸\·!{Y¸[Z\YZ¸PVR"Z'S!SOGY¸[Z\LYZ¸PVRL'¸·Z"�!Z%\GVPN'¯YVRZ\&%Zå"L" º7�g{7i{º7¹u¹u���()È W$$ ±»cÞ³»£ÜÇÓº7�g{7i{º7¹u¹u�»b�+,w�Ø�!�[Ñ�ÿÜ!ÛÇÓ" "

|}� aÝb|3.¤±Û��G&ã%NV(Ñ°=>ÇÈÑ�ÿÜ!ÛÇÓÑb�+,w�^b]£°F�ÛÇÓ" "

a:" üRb��5�wi|3.¤�Øb)*°4ÀÂKGÒb�+,wÿ4ÀÇûÞb|}{�+,w±ÏA�!�ÿ)È�¤�67bäº7�g{7iÛ��º7¹u¹uG`ÈÚ�Òbt�åf&°4ÀÑ�ÿÜ!ÛÇÓ" "

@:" n.¬,iÿ�çÔóbÂKG®¯_Ý°��cÛÇL�çÔó�XZ#;º7¹u¹ubùI±R�cÛÇÓ" "

<:" é°c����]°|3.¤xcÛÇÓ" "

9:" I±¡ôÇȺ7ix.°¿sÇÈCLA±G�çº7ix.°=>cGº7¹u¹uù°u¯'Zøu±��cÛÇÓ"'2?"f`�}u.3�uùu°|}�cÞ�ý±��cÞd�(ÚÓ" "

d&!'$&SÑdXbg.��G$�!Z%\¯'¸·Z$b×5°saÞGÒ)ÿfÇȺ7¹u¹uXb}u.3�o°ª«ÇÈÑ�ÿÜ!ÛÇÓÑ)�Gßà{[*3bj>±¤¥ÜÇÓ" "

g.�f&?" "

"! Z'\$N!'S8" �+,w{|}ÿ2�vmü�ÇȺ7¹u¹u{��5�wibGhttps://hostname:port/servicesNS/nobody/<app-name>/±»Çȳ» XZ#;º7�g{7iÓ" "

"! Z'S!SO8" 2�vm°ü�ÇȺ7¹u¹ubùIÓ" ""! �!Z%\8" ��ÇÈ}u.3�ä|}v*3ÜbeÒÓåÓ" ""! ·N\Z8"äã&%(i!SZP¸SZå" º7¹u¹uf&ÿ�çÔóbÂKG43w³��cÞ=A�ÐGÛ��7R�º7¹u¹u±®¯cGí}u.3�±ÝÚÞ|}°`±ÇÈÓ)}~3i� !SZP¸SZÓ" "

<setup> <block title="Basic stuff" endpoint="admin/savedsearch" entity="foobar"> <text> some description here </text> <input field="is_scheduled"> <label>Enable Schedule for foobar</label> <type>bool</type> </input> <input field="cron_scheduled"> <label>Cron Schedule</label> <type>text</type> </input> <input field="actions"> <label>Select Active Actions</label> <type>list</type> </input> <!-- bulk update --> <input entity="*" field="is_scheduled" mode="bulk"> <label>Enable Schedule For All</label> <type>bool</type> </input> </block>

9E"

<block title="configure the inputs" endpoint="properties/inputs/"> <block entity="*" mode="iter"> <input field="disabled"> <label>disable $name$</label> <type>bool</type> </input> </block> <block title="create a new input" entity="_new"> <input target="name"> <label>Input stanza</label> <type>text</type> </input> <input target="disabled"> <label>Disabled</label> <type>bool</type> </input> </block> </block> <!-- example config for "Windows setup" defined: http://twiki/twiki/bin/view/Main/AppSetup --> <block title="Collect Your Event Logs" endpoint="properties/inputs/" > <text> some description here </text> <block entity="WinEventLog:(Setup|System|Security|Application|ForwardedEvents)" mode="iter"> <input field="disabled"> <label>$disabled_label$</label> <type>bool</type> </input> </block> </block> <block title="Index Your Local Registry" endpoint="properties/regmon-filters/"> <text> some description here </text> <block entity="(User|Machine) keys"> <input field="disabled"> <label>$disabled_label$</label> <type>bool</type> </input> <input field="baseline"> <label>$baseline_label$</label> <type>bool</type> </input> </block> </block> <block title="Collect Local Statistics" endpoint="properties/wmi/" > <text> some description here </text> <block entity="WMI:CPUTime|WMI:Memory|WMI:LocalDisk|WMI:FreeDiskSpace">

9©"

<input field="disabled"> <label>$disabled_label$</label> <type>bool</type> </input> <input field="interval"> <label>Poll Every (seconds)</label> <type>text</type> <validation>¥d+</validation> </input> </block> </block> </setup>

W$$ §¨b��" "

W$$ §¨b��" "

W$$ b��5�wi±�,-±ÏA��()È2w£mf7i+.3ÿ`AÛÇÓ2w£mf7i+.3°stcÞG?b#.$.ÿ?b��5�wi±»c¨e¿eÛ��j!¿e°ÇÈÑ�ÿÜ!È�°��cÛÇÓóJ²ÜG��5�win{¤±�^bUbÿ`AÛÇÓ"

"!  ¡¢e��" ""! {*7in{¤" ""! ��f/7�" ""! q1." ""! #$%&'(STbõ.5" ""! r,�1�.�" ""! q1.fvw�67" "

#$%&'(STb§¨b��" "

#$%&'(STb��5�wi��±§¨°��ÇÈÑ�ÿÜ!ÛÇÓ^b/D±ÕÚÛÇÓ" "

a:" #$%&'(ST±å~cÛÇÓ" "

@:" ÷h±`È��5�wiõ.5b aÝ°wx,wcÛÇÓÎëìG ¡¢e��°wx,wcÛÇÓÛ�GzëØ)� W$$ b7��±§¨°��ÇÈÂK�GÇûÞb��°��ÇÈÑ�UÜ!ÛÇÓ" "

<:" §¨x7w°wx,wcÛÇÓ" "

9:" xmiÔÕ()�ÇûÞb,-±»cÞ¨e¿e{j!¿eb§¨°��cÛÇÓ" "

K:"  ¡°wx,wcÛÇÓ" "

47wº7�b§¨b��" "

\Z�¸&%S:·ZS¸ °stcÞGstcÞÚÈ W$$ bÇûÞb��5�wi±»cÞ¨e¿e{j!¿e§¨°��cÛÇÓ

9C"

^b/D±ÕÚÛÇÓ" "

a:" \Z�¸&%S:·ZS¸ °GstcÞÚÈ W$$ b)}~3i)uvwix?$#Ù=p"ï:%<Z{ZSV{¸$$Y{&¸$$¯'¸·ZÑ{·ZS¸\¸S¸{\Z�¸&%S:·ZS¸ ±��cÛÇÓ" "

@:" ^±GÑb}µ{3°¿scÞGW$$ b��5�wib§¨°��cÛÇÓ" "

<:" í��5�wibº7ix.GÛ��`Èn{¤b7��5�wi°��cÛÇ?" "

[/<owner>/<App>/<object_type>/<object_name>] access = read : [ <comma-separated list of roles>], write : [ comma-separated list of roles>]

"! Nø'ZP ���5�wi°=>c�#.$.ÜÇÓ)}~3iùÏú|+.43��5�wiÜ�Gé³ÿu'NãN\Ou��AÛÇÓ" "

"! W$$ �G��5�wiÿ¡ôÇÈ W$$ )uvwixÜÇÓ" ""! %ã´ZVS"SO$Z �GÄ×±xmiÔÕ()�n{¤b aÝÜÇä ¡¢e��G{*7in{¤Gq1.�?åÓ" ""! Nã´ZVS"'¸·Z �G ¡¢e��Gq1.G{*7in{¤�?±zëÈùIÜÇÓ" "

��5�wiñb§¨b��" "

��5�wi±ùI°íPÈÑ�±ÏAG��5�wiñ±§¨°��ÇÈÑ�ÿÜ!ÛÇÓÎëìGÑbº7ix.�Gu#$%&'("ZPPNPY"!'"SRZ"%¸YS"@9"RN&PYub ¡¢e��±»cÞGST�b,-GÝÛAG¨e¿e{j!¿e§¨°zëÛÇÓ" "

[/nobody/search/savedsearches/Splunk%20errors%20last%2024%20hours] access = read : [ admin ], write : [ admin ]

`Èn{¤b7��5�wi±»Çȧ¨b��" "

n{¤°ü�cÞGÒbÇûÞb��5�wi±§¨°��ÇÈÑ�ÿÜ!ÛÇÓÑbº7ix.�G¨e¿e§¨°7ª±Gj!¿e§¨°ST�ùÏú W$$ b7{*7in{¤b-ô.#.$.±zëÛÇÓ" "

[/nobody/search/eventtypes] access = read : [ * ], write : [ admin, power ]

��5�wib|+.43��" "

)}~3iÜ�G��5�wi�GÒ)°=>c� W$$XÜbeOÈÑ�ÿÜ!ÛÇÓc�ÿaÞGRZ%%NøNP%\"W$$ b{*7in{¤°=>ÇÈÂKGÒb W$$ ÜbeÔÕ()ÛÇÓ��5�wi°ÇûÞb W$$ Ü¥tÜ!ÈÏбÇȱ�G^bþ° \Z�¸&%S:·ZS¸ b��5�wibº7ix.±��cÛÇÓ" "

export = system

Îëì?" "

[/nobody/helloworld/eventtypes] access = read : [ * ], write : [ admin, power ] export = system

Ñ)±ÏAGRZ%%NøNP%\ bÇûÞb{*7in{¤�GstcÞÚÈ #$%&'( {7mi.3XbÇûÞb W$$ ÜOÈÑ�ÿÜ!ÈÏб�AÛÇÓ" "

9A"

W$$ b3,wª27�ª}u.3blmn/{«"

W$$ b3,wª27�ª}u.3blmn/{«" "

W$$ b3,wª27�ª}u.3blmn/{«" "

�q¬.�67­01.blmn/{«" "

�q¬.�67­01.blmn/{«" "

ÑÑÛÜÜGW$$ bq1.°ÇûÞjkÜ!Ûc�Ó^bm¹,¤Ü�G#$%&'("âZã ÜÔÕÇÈ��±2v75cÛÇÓ#$%&'("âZã b W$$ 4.b�+,¤r®7­01.±-AúÞÈfvw�67±q1.°2v75cÛÇÓq1.°ÔÕÇÈD|GùÏúÒ)Ø°ÔÕÇÈ­01.°ü�cÛÇÓ" "

Ñbõ.5bm¹,¤±ÕaÞGW$$ ±`ÈÇûÞbq1.G��ùÏúvg.i° aݱÛ��ÛÇÓÛ�GÑbm¹,¤±ÏAG)}~3iq1.°ü�cÛÇÓ)}~3iq1.�GW$$ °��c�Û±Áp±ÔÕ()G#.$.ÿûĵ±`È+õ°wx,wc�J±+.�()Èq1.ÜÇÓ" "

��" "

#$%&'(STÛ��}µ{3�m¹o°stcÞG�q¬.�67­01.°=>ùÏú¿scÛÇÓ" "

a:" stcÞÚÈ W$$ b�q)uvwix?$#Ù=p"ï:%<Z{ZSV{¸$$Y{&W$$'¸·ZÑ{\Z�¸&%S{\¸S¸{&!{'¸[{\Z�¸&%S:з% ±u\Z�¸&%S:з%u�Mì)È}µ{3°=>cÛÇÓ" "

'2?" W$$ q3r°saÞ W$$ °=>ÇÈ�GÑb}µ{3�z~>()ÛÇÓ#$%&'(STbâÊÜ¿sÇÈÂK�G�[®$Ü^bpX=±2w£mÇÈÑ�±ÏA�q°x}v,�1ÇÈÑ�ÿÜ!ÛÇÓ" "

https://<splunkserver>:<splunkmgmtport>/servicesNS/admin/<appname>/data/ui/nav?refresh=1

@:"#$%&'(STÜ�q¬.�67­01.°wx,wcÞÑb}µ{3°¿sÇÈÑ�ÿÜ!ÛÇÓwx,wÇÈ���±2w£mcÛÇÓ" "

http://localhost:8000/en-US/manager/<appname>/data/ui/nav

'2?"îmiùÏúg.i�GstÇÈ{7mi.3îmiùÏúg.iÜß!ïëÞd�(ÚÓ¸$$'¸·Z °GstcÞÚÈ W$$ù±ß!ïëÞd�(ÚÓ" "

<:" ^±G�q¬.�67­01.°��cÛÇÓÑ)�G#$%&'(âZã b W$$ b�+,¤r®7­01.±-AúÞØ)ÛÇÓ" "

<nav> <collection label="Dashboards"> <view name="mydashboard" /> </collection> <collection label="Search views"> <view name="mysearchview" />

K;"

</collection> </nav>

ÑbÎ�Gu·O\¸YRãN¸P\u�ÚÐùIbq1.° aÝG#$%&'("âZã br,�1�.��+,¤r®7±��cGuVR¸PSu�ÚÐñbq1.°���+,¤r®7±��cÛÇÓ" "

­01.blmn/{«" "

�+,¤r®7­01.bn{i3�z�±²³Ü!ÛÇÓÎëìGr,�1�.�­01.°ÙN'!ZY ±²³Çȱ�^bÏбcÛÇÓ" "

<nav> <collection label="Ponies"> <view name="mydashboard" /> </collection> <collection label="Search views"> <view name="mysearchview" /> </collection> </nav>

)}~3iq1.b��" "

)}~3iq1.°ü�cÛÇÓÑbq1.�G#.$.ÿ W$$ °+.�c�Û±ÔÕ()Èq1.ÜÇÓÑ)�Û�G#.$.ÿûĵb+õ°wx,wc�Û±ÔÕ()Èq1.ÜÇÓ" "

q1.°)}~3i±ü�Çȱ�G\Z�¸&%SGuSP&Zun|°��cÛÇÓ" "

<nav> <collection label="Ponies"> <view name="mydashboard" /> </collection> <collection label="Search views"> <view name="mysearchview" default="true" /> </collection> </nav>

)}~3i±ü�()�q1.ÿ�ÚÂKG\Z�¸&%S:з% ±×Ø()�Ápbq1.ÿ)}~3i±�AÛÇÓ\Z�¸&%S:з% ±q1.ÿ×Ø()ÞÚ�ÚÂKG§¨°¨e¿g�Ápbq1.ä23}µ*,iDåÿÔÕ()ÛÇÓ" "

ÇûÞbq1.°~£±4�È" "

q1.fvw�67±×Ø()ÞÚ�ÚÇûÞbq1.°GàÕ£±×5MÁ±4�ÛÇÓYN&PVZGu&'V%¸YY!�!Z\un�bq1.°stcÛÇÓ" "

<nav> <collection label="Dashboard"> <view name="mydashboard" /> </collection> <collection label="Search views"> <view name="mysearchview" default="true" /> <view name="anothersearchview" default="true" /> </collection> <collection label="Others"> <view source="unclassified" /> </collection>

Ka"

</nav>

�ÄÜG\Z�¸&%S:з% ±àÕ£±×Ø()ÞÚ��a�q1.ÿÇûÞG#$%&'("âZã b¨Òb»©�+,¤r®7±ÔÕ()ÛÇÓ" "

¥t89�ÇûÞbq1.ä×Ø()ÞÚÈU4�Èå°4�ȱ�G^bÏбü�cÛÇÓ" "

<view source="all" />

hmi¶­01." "

hmi¶­01.°=>Çȱ�Gq1.fvw�67°��cÞI¡bq1.±��cÛÇÓ" "

<nav> <collection label="Dashboard"> <view name="helloworlddash" /> </collection> <collection label="Views"> <view name="helloworldview" default="true" /> <collection label="Others"> <view source="unclassified" /> </collection> </collection> </nav>

q1.±�Hx7wÇÈ" "

�q¬.�67­01.�Øq1.±�Hx7wcÛÇÓÑbq1.�G�+,¤r®7­01.±ÔÕ()ÈCLA±G�q¬.�67­01.±x7w�cÞÔÕ()ÛÇÓ'¸[ b��± [!Zø"'¸·ZG·OVR¸PSu°��cÛÇÓ" "

<nav> <view name="mychart" /> <collection label="Dashboard"> <view name="mydashboard" /> </collection> <collection label="Searches"> <view name="mysearchview" default="true" /> </collection> <collection label="Others"> <view source="unclassified" /> </collection> </nav>

q1.°�Ç" "

q1.°�cÞ�q¬.�67­01.Ü��Ü!�ÚÏбÇȱ�Gq1.b z<=°¿scÛÇÓ"

<view isVisible="false"> ... </view>

 ¡¢e���vg.ib��" "

 ¡¢e��ùÏúvg.i°�q¬.�67­01.±��cÛÇÓÑbÎ� ¡¢e��° ¡¢e���+,¤r®7­01.±��cÛÇÓ" "

K@"

<saved name="MySavedSearch" /> <nav> <collection label="Dashboard"> <view name="mydashboard" /> </collection> <collection label="Searches"> <view name="mysearchview" default="true" /> </collection> <collection label="Others"> <view source="unclassified" /> </collection> <collection label="Saved Searches"> <saved name="mysavedsearch" /> </collection> </nav>

�ÄÜG ¡¢e��·OY¸[Z\YZ¸PVR ÿ ¡¢e���+,¤r®7±ÔÕ()ÛÇÓ" "

[!ZøG" n|° Y¸[Z\ n|±��ÇÈÑ�±ÏAG ¡¢e��°+.�ÇÈq1.°ü�ÇÈÑ�ÿÜ!ÛÇÓ" "

<nav> ... <collection label="Saved Searches"> <saved name="mysavedsearch" view="mychart" /> </collection> </nav>

#$%&'( �GY¸[Z\YZ¸PVRZY:VN'� mn7$±`Èd[!Zød¤+-¹u°Ô�,wcÛÇÓ�Uü�c�ÚÂKG�� W$$bd�%¸YRS!·Z%!'Zdq1.ÿst()ÛÇÓ" "

 ¡¢e���Û�Gq1.�ü+±hmiÇÈÑ�ÿÜ!ÛÇÓ" "

<nav> ... <collection label="Saved Searches"> <saved name="Daily indexing volume by server" view="charting" /> <collection label="Errors"> <saved source="unclassified" match="error" /> </collection> <saved source="unclassified" /> </collection> </nav>

 ¡¢e��°~£±4�È" "

q1.b~£����ü+±GÆùb ¡¢e��°z~£±4�ÈÑ�ÿÜ!ÛÇÓÑ)±�GY¸[Z\"YN&PVZGu&'V%¸YY!�!Z\u°��cÛÇÓ" "

<nav> <collection label="Dashboard"> <view name="mydashboard" /> </collection> <collection label="Searches"> <view name="mysearchview" default="true" /> </collection> <collection label="Others"> <view source="unclassified" /> </collection>

K<"

<collection label="Saved Searches"> <saved source="unclassified" /> </collection> </nav>

ÑbÎ�GW$$ ±`ÈöLéb ¡¢e��°ÇûÞ ¡¢e��­01.±+.�cG23}µ*,iD±¯.icÛÇÓ" "

.�mix7|bR�Üz~xmi°¬¨ÇÈ" "

z~xmi�.�mix7|bR�±ÏA¬¨ÇÈÑ�ÿÜ!ÛÇÓÎëìGu·¸SVRu�ÚÐ��°4ÀùIböLé��°ÇûÞfvw�67±ÔÕÇÈÏбÇȱ�GY¸[Z\"YN&PVZGu&'V%¸YY!�!Z\u"·¸SVRGu&SZP·Ñu°stcÛÇÓ" "

R�GW$$ ÿ¥tÜ!È���vg.i°ÇûÞ4Àz~xmi°%�b��Ü��Çȱ�GY¸[Z\"YN&PVZGu¸%%u"·¸SVRGu&SZP·Ñu°stcÛÇÓ" "

780b·¸Ü�Gé78�-78°¹ñcÛMgÓ" "

<nav> ... <collection label="Errors"> <saved source="all" match="error" /> </collection> </nav>

ÑbÎ�GuZPPNPYu��fvw�67°k>cÛÇÓÑ)�GuZPPNPu�ÚÐ.�mix7|°ÒbùI±saÞG ¡¢e��°ÇûÞz~£±xmiÔÕcÛÇÓÒb��±�G�q­01.b»bÂä±I±ÔÕ()�Ub°4ÀÂKÿ`AÛÇÓ"

®��x¯.m°q1.±��" "

®��x¯.m°q1.±��" "

#$%&'( b®��x¯.m´51.3°saÞGU°P¸·ZY Û�� :;<=°q1.±��ÇÈÑ�ÿÜ!ÛÇÓ" "

:;<=b��" "

#ZP[ZP#!\ZU'V%&\Z ´51.3°stcÞG:;<=°q1.±��cÛÇÓ" "

a:" :;<=}µ{3GÎëì �NN:RS·% °G$SPLUNK_HOME/etc/apps/<appname>/appserver/static±=>cÛÇÓ" "

@:" ®��f7¹7ÍbÇûÞ°Òb}µ{3±��cÛÇÓ" "

<:" q1.z<=°³�cÞG#ZP[ZP#!\ZU'V%&\Z ´51.3°4�ÛÇÓ" "

<view> <module name="ServerSideInclude"> <param name="src">foo.html</param> </module> </view>

K9"

'2?"q1.�Ò)])b$#Ù=p"ï:%<Z{ZSV{¸$$Y{&¸$$'¸·ZÑ{\Z�¸&%S{\¸S¸{&!{[!ZøY{&[!ZøÑ:з% ±`Èf`ÿ`AÛÇÓ" "

9:" �[®$ÜÔÕcÛÇÓ" "

http://<hostname>:<port>/app/<appname>/<view>

¥¹b��" "

¥¹°��Çȱ�G<¸(N ¹7¤v.i#.¹ux¹uc9 ·¸(Z¯&P% ° :;<= X±stcÛÇÓ" "

<img src="${make_url('/static/app/<app_name>/<image>.png')}" />

x7wb��" "

#ZP[ZP#!\ZU'V%&\Z Ü4�� :;<=¹7¤v.i�Øx7w°=>ÇÈÂK±�G��b @ÝbÖ×ÿ`AÛÇÓ" "

"! mn¹u,w?" "

<a href=”/manager/foo/bar”>click me</a>

"! r{��,w?" "

<a href=”${make_url(‘/manager/foo/bar’)}”>click me</a>

ÒbºÚ�Gr{��,w4.567Ü�»·¸(Z¯&P%¼­¯,�°stÇÈÑ�ÜÇÓÑ)�GpX=±óôbÂä°�K(MGmn¹u,wf7¹7ÍÛ��¤+��{7mn7m±Q_ÇÈ´)u}µ{2°½|cÛÇÓ·¸(Z¯&P% °stcÞGW$$ùbÏÐ�[7n{o)*°½|ÇÈÑ�UÜ!ÛÇÓ" "

<a href=”${make_url([‘manager’, APP[‘id’], ‘foo’, ‘bar’])}”>click me</a>

_GÑb¾Ý]bÖ×�Gxmi°¿ a�3�cÞÀcG·¸780�cÞÀcÛMgÓ" "

:;<=¹7¤v.i�m¹oXÜ¥tÜ!ÈN¾²3bÚdÝ�°^±`ÅÛÇÓ" "

"! óôbh.omõ.m?" "

APP[‘id’]

"! óôb W$$ bL�AnÇÚ[*3?" "

" " APP[‘label’]

"! óôbq1.!\äpXU ±ÔÕå?" "

VIEW[‘id’]

"! óôbq1.[*3?" "

VIEW[‘label’]

õ.5bmn{3��" "

M## °stcÞõ.5bmn{3°��cÛÇÓ:;<=õ.5°=>c�ØG»pÇÈM##}µ{3°=>cÞGõ.5bmn{3°��ÇÈÑ�ÿÜ!ÛÇÓ" "

'2?" #$%&'( b M##�mf.¤()ÛMgÓc�ÿaÞGM##°õ.5±��ÇÈÂKGw[mù°�ý±mf.

KK"

¤cÞd�(ÚÓmn{3°|+.43£vwn±�tc�ÚÜd�(ÚäÎ?ãN\O"Áã¸V(QPN&'\8$!'(ÂÃåÓCLA±Gw[m£vwn°stcÞGmf.¤�fx567°¬ÄcÛÇäÎ?:·OV%¸YY"Áã¸V(QPN&'\8$!'(ÂÃåÓ" "

a:" M## ±ÝÚÞTò°Å�Þd�(ÚÓM##ÿÏdL�Ø�ÚÂK�GRSS$8{{øøø:ø<YVRNN%Y:VN·{MYY{VYY¯YO'S¸Ð:¸Y$ b M##x¯.mÜ�.cÞd�(ÚÓ%±GM##w[m£vwnbc9±ÝÚÞTòcÞd�(ÚÓ:;<=��1­7iÜ�Gw[m£vwn�GM##Ümn{3��ÇÈ z:;<=`qÜÇÓÎëì?" "

<div class="bar"> w00t! </div>

w[m£vwn�GM##Üu:u�GÒ)±�dw[mf&o°saÞ��()ÛÇäu:u�w[mùb´�mõ.m�cåÓ"Îëì?" "

.bar { background:pink;

Ã"

Ýb z:;<=��1­7iXÜüHw[mù°G3�stÇÈÑ�ÿÜ!ÛÇÓ" "

@:" M##}µ{3GÎëì �NN:VYY°G$SPLUNK_HOME/etc/apps/<appname>/appserver/static±=>cÛÇÓ" "

<:" M## 3.3°Òb}µ{3±��cÛÇÓ" "

.bar { background:pink; }

ÇÈ�Guã¸Pu±R�ÇÈw[mf&°FÝ`qÿ¶7w±�AÛÇÓ" "

<div class="bar"> <h1>I have a pink background now!</h1> </div>

U°P¸·Z b��" "

U°P¸·ZU'V%&\Z ´51.3°saÞGU°P¸·Z °q1.±��cÛÇÓ" "

a:" x7wÆbpXU °��ÛÇÓ" "

@:" q1.z<=°³�cÞG^bpXU ±x7wÇÈ U°P¸·ZU'V%&\Z ´51.3°4�ÛÇÓ" "

<view> <module name="IFrameInclude"> <param name="src">myawesomewebsite.com</param> </module> </view>

<:" �¤�67ÜG�(U��Ü!ÛÇÓÑbÎÜ�G�(° 9@ ¶w£3±��cÛÇÓ" "

<view> <module name="IFrameInclude"> <param name="src">myawesomewebsite.com</param> <param name="height">42/param> </module>

KE"

</view>

9:" �¤�67ÜÜGpXU ÿ¡ôÇÈ�?Ð�°ÛÁÔ�,wÜ!ÛÇÓ" "

<view> <module name="IFrameInclude"> <param name="src">myawesomewebsite.com</param> <param name="check_exists">True</param> </module> </view>

W$$ bmn{3b²³" "

W$$ bmn{3b²³" "

M## °³�ÇÈ�PÜ #$%&'("âZã bÔÕ°(ÛÈÛ±²³Ü!ÛÇÓí2¤xÆ.�67�G2¤xÆ.�677tbM##°��ÇÈapplication.css}µ{3°aÝ4ÀÑ�ÿÜ!ÛÇÓapplication.css}µ{3�G#$%&'(b»bM##}µ{3ÏAU�ÚÇÆ�°FaÞÚÛÇÓc�ÿaÞGapplication.css±��()����)}~3i��°Äj!cÛÇÓÝÛAGí´51.3ÿðYbM##}µ{3°ÒcÞÚÞUGapplication.cssÜRȱG3b´51.3°Äj!ÇÈÑ�ÿÜ!ÛÇÓ" "

M## v}µv7m"

'2?"õ.5±ÔÕ()È��5�wi°²³ÇÈÂKGÎëìG�+,¤r®7�¤�67°²³c�AGJ´µ°��c�AÇÈÂK�?�G´51.3°q1.±��cÛÇÓ" "

��" "

¸$$%!V¸S!N':VYY °$SPLUNK_HOME/etc/apps/<appname>/appserver/static/±=>cÛÇÓÑb aÝb}µ{3°stcÞG#$%&'("âZã b}µ{3bÇûÞbmn{3��°Äj!cÛÇÓÎëìG)}~3i}~7i°Äj!c�AG´51.3b4,w|[®7�s°²³ÇÈÑ�ÿÜ!ÛÇÓ+õnv{2®iGÒb» #$%&'( b(ÛÈÛ�M##}µ{3Ü��()�mn{3°²³cÛÇÓ" "

¥¹°��Çȱ�G¥¹° application.css}µ{3��U±G../appserver/static/)uvwix±ß!ÛÇÓ" "

*mi¤[w¹um" "

°!PZ�NÐb °!PZã&Q °stÇÈÑ�°ÄÅcÛÇÓ°!PZã&Q ±ÏAGõ.5bºv­7i°�§cG²³c�Úmn{3bw[m°üÉÇÈÑ�ÿ89±�AÛÇÓÛ�G¸$$%!V¸S!N':VYY ±²³°�ëÈI±G(ÛÈÛ�M##��°ÊÇÑ�ÿÜ!ÛÇÓ" "

Î" "

Ñb.7¤3 W$$ �GXÚ()�M##°^b ¸$$%!V¸S!N':VYY ÜÄj!cÛÇÓ" "

/* * Top app banner section */

K©"

.AccountBar { background-image: url(/static/app/samples/samples_header.png); background-repeat: no-repeat; background-color: #79a60b; height: 140px; } .AccountBar .appLogo, .AccountBar p.appName { display: none; } .AccountBar .accountBarItems { background-color: #000; opacity: .5; filter: alpha(opacity=50); } /* * view menu system */ .AppBar { font-family: Arial Black, Arial, sans-serif; font-size: 18px; font-variant: small-caps; } .AppBar a { color: #f3df00 !important; } .AppBar a:hover { color: #6ad7ff !important; } /* * Body content */ body { background-image: url(/static/app/samples/body_bg.png); background-repeat: repeat-x repeat-y; }

´51.3bcde" "

´51.3bcde" "

#$%&'("âZã bõ.5±ÔÕ()È`q�G��4.�Ø��±²±5ÈÛÜGÇûÞ´51.3ÜÇÓÔÕ()�Úºv­7iGÎëìG±²´51.3°W|ÇÈ��±4,w|[®7�Üýþ()ÞÚÈ���?Uü+±´51.3ÜÇÓ" "

ÔÕc�Ú´51.3ùÏúÒ)±x7wc�Ú´51.3°��cÞq1.°��cÛÇÓq1.b��±stÜ!È´51.3��d(g`AÛÇÓÑbõ.5°¥tcÞG 51.3°õ.5±�tÇÈ��±ÝÚÞRޣˢ°>Þd�(ÚÓÑ)�G´.51.3°Ä/±ÌtÇÈ��±G´51.3bl¹õx.ùÏú��°R�c�UbÜÇÓ7´51.3bxmi�G¨´51.3v}µv7m©°ª«ÇÈGÛ���[®$Ü^b.{i±2w£mcÞd�(ÚÓ" "

http://<splunkserver>:<splunkwebport>/modules

KC"

��q1.��r,�1�.�" "

q1.°R_b´51.3ÜjkÇÈÂKG��q1.Û��r,�1�.�°=>ÇÈÑ�ÿÜ!ÛÇÓ��q1.�GR_b��´51.3Ü=>()ÛÇä�ת«åÓýþc����Gü�()� aÝÛ��G3b´51.3°¾cÞ±²ÿÀ()GaÝÛ��G3b±²´51.3±ÏAÔÕ()ÛÇä�ת«åÓr,�1�.��G+Y����Øb±²°G¼?g?bÂK±²´51.3°¾HÞÔÕcÛÇÓf`±pHÞG��q1.ùÏúr,�1�.�q1.±»b´51.3°��ÇÈÑ�UÜ!ÛÇÓ" "

´51.3b��" "

q1.b´51.3�GÍx.jyÜÇÓc�ÿaÞG��q1.°jkÇÈÂKG��)*�´51.3�ØÒb�´51.3±À()ÛÇÓ�´51.3�G��ÿ{*7i°rÇGÛ��±²±²ï()ÈÛÜb��°�Ø�b��Üã�cÛÇÓr,�1�.�q1.°jkÇÈÂKGí-h3�Gñb���ØjkcÛÇÓr,�1�.�q1.�G��q1.±·ûGÍÚÿ3b*ÚÍx.jy±�aÞÚÛÇÓ" "

$¸P¸·Y" "

´51.3bæ±� $¸P¸·Y �Mì)È��ÿ`AÛÇÓÎëì?" "

<module name="Message"> <param name="filter">*</param>

Ù¸P¸·Y �G|[}ùÏúÔ½.ib.{«Gaõ.5`�A±ÔÕÇÈ{*7i3�?G´51.3'Òb��°¬ÄcÛÇÓÙ¸P¸·Y �´51.3v}µv7mõ.5Û��´51.3b VN'� }µ{3±×Ø()ÞÚÛÇÓ" "

$¸P¸·Y ±�GfE��¤�67b�]ÿ`AÛÇÓ$¸P¸·Y bæ±�G)}~3i��U`AÛÇÓÑ)Ø�v}µv7mõ.5±×Ø()ÞÚÛÇÓ$¸P¸·ÿfEbÂKGÒb´51.3± $¸P¸·°4�Èf`ÿ`AÛÇÓ$¸P¸·ÿ�¤�67bÂKG´51.3±4�ÈÑ�UÜ!ÛÇÿGfÁcUf`Ü�`AÛMgÓ)}~3iÿ×Ø()ÞÚÈÂKGÒ)ÿÒb-[­.nb)}~3ioÜ`AG��°þL�Ú��AÒ)ÿst()ÛÇÓÙ¸P¸·Y �G$SPLUNK_HOME/share/splunk/search_mrsparkle/modulesb´51.3b)uvwix±`Èí´51.3b VN'� }µ{3±×Ø()ÛÇÓ!

%¸ON&SÙ¸'Z%" "

´51.3ÿõ.5b?ѱÔÕ()È�°ü�Çȱ�G´51.3n|Ü %¸ON&SÙ¸'Z%f&°��cÛÇÓ"Îëì?" "

<module name="SearchBar" layoutPanel="mainSearchControls">

'2?" "

"! ��q1.ùÏúr,�1�.��GB�È %¸ON&SÙ¸'Z%Y °stcÛÇÓ��q1.�G¨��q1.v{2®i©±×Øb %¸ON&SÙ¸'Z%Y °stcÛÇÓR�Gr,�1�.��G¨r,�1�.�b��©±×Øb�·�°stcÛÇÓ" "

KA"

"! ëìbÄJv*3±`È´51.3±�GfÁ layoutPanel°ü�cÛÇÓlayoutPanel��°F��ÚÍx.XbÒb»b´51.3�ÇûÞGÒ)])b{�Ø�!��ÛÇÓõ.5°B�Èv{2®i-h3±å~ÇÈ�GÒb-h3bÁpb´51.3bv{2®i-h3°��ÇÈf`ÿ`AÛÇÓ" "

��q1.Ü¥tÜ!È %¸ON&SÙ¸'Z%Y ±���ÿ`AÛÇÓ"

'¸[!Q¸S!N':Z¸\ZP"

"

·ZYY¸Q!'Q"

"

·¸!'#Z¸PVRMN'SPN%Y"

"

QP¸$RWPZ¸"

"

Y!\ZɸP"

"

$¸QZMN'SPN%Y"i"$¸QZMN'SPN%Y@"

"

PZY&%SYWPZ¸=Z�S"i"PZY&%SYWPZ¸X!QRS"

E;"

"

PZY&%SY:Z¸\ZPÙ¸'Z%"

�&%%â!\SRMN'SPN%Y"

´51.3_`" " "

$SPLUNK_HOME/share/splunk/search_mrsparkle/modules

)uvwixb.�)uvwix±|3.¤x()�Ûb´51.3b_`°��±×ØcÛÇÓ 51.3�GÒbc9±ÜwÚÞ|3.¤x()ÛÇÓÑÑÜ�Gü�()�´51.3±?b %¸ON&SÙ¸'Z%Y °ßd�±QÇÈÎ7i°×ØcÞÚÛÇÓ¥t89�´51.3�Òb $¸P¸·Y ±QÇȦ§�G¨´51.3v}µv7m©õ.5°ª«cÞd�(ÚÓ"

'¸[!Q¸S!N':Z¸\ZP"

'¸[!Q¸S!N':Z¸\ZP ±´51.3°ßd�Gi,¤�q4.±ÔÕ()ÛÇÓ"

"! WVVN&'SɸP""! W$$ɸP""! ;!S%ZɸP""! ÉPZ¸\MP&·ã"

·ZYY¸Q!'Q"

·ZYY¸Q!'Q"%¸ON&SÙ¸'Z% �G­,£.5´51.3Übest()ÛÇÓ"

YS¸S!V"

QZ'ZP!V:Z¸\ZP �Ñb)uvwix±`ÈÏRb´51.3ÜÇÓRÞ£ö,r.° %¸ON&SÙ¸'Z% bö,r.�cÞstcÛÇÓ"¾2GzëØ)�v{2®i-h3b{´51.3��AÛÇÓõ.5bÒbÊLbö,r.�cÞÔÕ()ÛÇÓ"

YZ¸PVR"

#Z¸PVR ´51.3�G��q1.b=>±st()ÛÇÓÒ)±���ÿ`AÛÇÓ"

"! ZÐSZ'\Z\°!Z%\#Z¸PVR""! °!Z%\Ù!V(ZP""! °!Z%\#Z¸PVR""! :!\\Z'°!Z%\Ù!V(ZP""! :!\\Z'U'SZ'S!N'""! :!\\Z'#¸[Z\#Z¸PVR"

Ea"

"! :!\\Z'#Z¸PVR""! ÙNYSÙPNVZYYɸP"ÐÐ""! X¸\!NÉ&SSN'#Z¸PVR""! #Z¸PVRɸP""! #&ã·!SÉ&SSN'"ÐÐ""! ;!·ZX¸'QZÙ!V(ZP""! #!ZøXZ\!PZVSNP"

XZY&%SY"

XZY&%SY ´51.3�Gr,�1�.�b=>GÛ����q1.ܱ²bÔÕ±st()ÛÇÓ"��q1.Ü�GÑ)Øb´51.3° PZY&%SYWPZ¸ ÜÔÕÇÈÑ�ÿÜ!ÛÇÓ"

��ÿ`AÛÇÓ"

"! VR¸PS"VN'SPN%Y"ä%!YSZ\"ãZ%Nøå""! �%¸YR"ä%!YSZ\"ãZ%Nøå""! $¸QZ"VN'SPN%Y"ä%!YSZ\"ãZ%Nøå""! Z[Z'SY#!ZøZP""! °!Z%\#!ZøZP""! =!'(=!YS""! <&%S!°!Z%\#!ZøZP""! XZY&%SY:Z¸\ZP""! #¸[Z\#Z¸PVRZY""! #!·$%ZXZY&%SY;¸ã%Z""! #!'Q%Z#¸%&Z"

VR¸PS"VN'SPN%Y"

Ô½.iùÏú|[}°}~./,i°��Çȱ� VR¸PS"VN'SPN%Y °stcÛÇÓ"

"! WÐ!Y#V¸%Z°NP·¸SSZP""! ɸYZMR¸PS°NP·¸SSZP""! MR¸PS;!S%Z°NP·¸SSZP""! MR¸PS;O$Z°NP·¸SSZP""! :!\\Z'MR¸PS°NP·¸SSZP""! =ZQZ'\°NP·¸SSZP""! =!'Z<¸P(ZP°NP·¸SSZP""! "&%%#¸%&Z°NP·¸SSZP""! #S¸V(<N\Z°NP·¸SSZP""! zWÐ!Y;!S%Z°NP·¸SSZP""! ÑWÐ!YX¸'QZ<¸Ð!·&·°NP·¸SSZP"

E@"

"! ÑWÐ!Y;!S%Z°NP·¸SSZP"

�%¸YR"·N\&%ZY"

"! °%¸YRMR¸PS""! °%¸YR;!·Z%!'Z""! °%¸YRâP¸$$ZP"

$¸QZ"VN'SPN%Y"

Ù¸QZ �G{*7iÔÕ°¬ÄÇÈ´51.3°¬ÄcÛÇÓ"

"! MN&'S""! <¸Ð=!'ZY""! #ZQ·Z'S¸S!N'""! #Z%ZVSNP""! #N�SâP¸$""! ;ZÐS#ZSS!'Q"

Yø!SVRZPY"

"

#ø!SVRZP ´51.3�%ñ�´51.3ÜGG3bÒk´51.3£,i°FÝÑ�ÿÜ!GÒ)Ø°ËA`ëÛÇÓ"

"! É&SSN'#ø!SVRZP""! =!'(#ø!SVRZP""! Ù&%%\Nø'#ø!SVRZP""! ;¸ã#ø!SVRZP"

#ø!SVRZP ´51.3�G@ÝbB�È´.�°(==cÛÇäÓÔ� <ÝåÓ"

"! !'\Z$Z'\Z'S8"Íx.�TÕ�ùA±c9ÇÈÑ�°2ÖcÛÇÓ.�Íx.W�.�Íx.ɱ�³IQ×�`AÛMgÓ"

"! YZP!¸%!¢ZW%%8"��ÇûÞÜi£± aÝbSÚÔ�.7±mv,�c�()ÛÇÓÔÕh�ØOÈ�GÒ)Ø�|3.¤�cÞÔÕ{�ÔÕ()ÛÇÓ"

��cG��)*ùÏú}~./,i)*GùÏú#.$.|}o°ÀǨAGÒ)Ø�ÇûÞGtoGJ´uvG��²³G}~./,¹u7|�?°ÀÇÅÚÍx.±`ÈÏбc9cÛÇÓÒ)Ø°?bÏбstÇÈ�°ØëÈ�!ÏR2Ö°�Çb�GYø!SVRZP bÁ4b�Íx.ÿ YZP!¸%!¢ZW%% ´.�bÂKGÙ»±�ÔÕ±�ÈÑ�ÿ�dGÝÛAGvg.iq3rÜG�%¸YRVR¸PS ÿ?bÏбcÞ¨ín�X©±¡ôÇÈ�äýÛ±�Á4bn�Ü`Èå°ßàcÞÚÛÇÓ"

67&°� ÇÈ��±GdYZP!¸%!¢ZWVS![ZdÿÛU�dxx.m()ÛÇÓÝÛAG"b�ÿ`ÈÂKG"|]b��2±Òb?Ñ�±`ÈÑ�°Üi£±2ÖcGYø!SVRZP �Ga|]b��Ø "La|]b�bÐ�b?)°ËA`ëÈ�°

E<"

��cÛÇÓ"

!'V%&\Z"

!'V%&\Z )uvwix±`È´51.3°stcÞG®��x¯.m°q1.±��cÛÇÓ¾2GÑ)Øb´51.3� %¸ON&SÙ¸'Z%?�&%%â!\SRMN'SPN%Y ±ÔÕ()ÛÇÓ"

"! W´¸ÐU'V%&\Z""! U°P¸·ZU'V%&\Z""! #ZP[ZP#!\ZU'V%&\Z"

Q¸'\¸%�"

Q¸'\¸%� ±`È´51.3�stc�ÚÜd�(ÚÓÒ)Ø�vg.iq3r.°.g.icÛÇÓ"

"

´51.3v}µv7m" "

´51.3v}µv7m" "

´51.3bst��±QÇÈRÞ£�ßà�G¨´51.3b_`©°ª«cÞd�(ÚÓ" "

��±Gq1.bjk±f`��ÈÇûÞb´51.3±ÝÚÞ×ØcÛÇÓ´51.3�Gc9l¹õx.ñ±áT()ÞÚÛÇÓ" "

#$%&'( {7mn7mb7´51.3b~£×5°+.�Çȱ�G^bpXU °wx,wcÛÇÓ" "

RSS$8{{%NV¸%RNYS8C;;;{Z'Lp#{·N\&%ZY" "

'2?"îmiùÏúg.i°GstcÞÚÈ{7mi.3Ã+Üß!ïëÞd�(ÚÓ" "

"¸[" "

õ.5v{2®iùÏúRÞ£õ.5¤+-¹u±QÇÈÜi£´51.3� 9Ý`AÛÇÓ" "

WVVN&'SɸP" "

¼�g?bq1.bÁÄʱ`È4.ÜG&#.$.Ñ�cÞ+|{7G�ÚÐ+õ�G+|2®iùÏúST�x7wÿ`AÛÇÓ" "

W$$ɸP" "

Ñ)�G¼�g?bq1.ÜGÄ�Ø @|]±`È4.ÜÇÓÄJv*3q1.l¹õx.ä)}~3iÜ�Gr,�

E9"

1�.�q1. ¡¢e��åGùÏúÚhx7w£w�67äö3¤i"$PZ�ZPZ'VZY"i"¸ãN&Såÿ`AÛÇÓ" "

;!S%ZɸP" "

f7i+.3­01.{2w�67­01.Ó" "

Ñb´51.3�2ÛcGr,�1�.�bùIGq1.bùIGÛ��q1.ùÏúQ_ÇÈ ¡¢e��bùI°4eÛÇÓS!S%Zã¸P �7ÜΡ2w�67bÂä�cÞc9cÛÇÓÎëìGq1.°+.�c�4ýþ()��ç��b ¡�?Ó" "

-[­.n" "

fE" "

�cÓ" "

�¤�67" "

"! YRNøWVS!N'Y<Z'&"G";P&Z"i"°¸%YZ" "

! 2w�67­01.°ÔÕÇÈ�?Ð�°ü�Ó" "

! )}~3i� SP&ZÓ" "

­,£.57|" "

Ñb´51.3�G#.$.±ÇûÞb­,£.5°#.$.±ÔÕcÛÇÓÛ��G%�bw[mb­,£.5be°ÔÕÇÈÏб��ÇÈÑ�ÿÜ!ÛÇÓ­,£.5±�G��G2[.iGº[.G{7)��7|m¹.nm±QÇÈ)*�?ÿ`AÛÇÓíq1.�G4,wº7��Ø­,£.5°�P=È��±G��d�U a Ýb­,£.5´51.3°FÝf`ÿ`AÛÇÓ" "

<ZYY¸QZ" "

Ñb´51.3�G#.$.±ÇûÞb­,£.5°#.$.±ÔÕcÛÇÓÛ��G%�bw[mb­,£.5be°ÔÕÇÈÏб��ÇÈÑ�ÿÜ!ÛÇÓ­,£.5±�G��G2[.i�ÝG4,wº7�b��´ºÚG{7)��7|m¹.nm±QÇÈ)*�?ÿ`AÛÇÓ" "

ÁU������G}u3n°dnd±��c� aÝb <ZYY¸QZ {7mn7mÜÇÓÑ)�G­,£.5�+.��½mi°ÇûÞÔÕÇÈÑ�°2ÖcÛÇÓ��cGq1.±`ÈñYbv{2®i-h3±ÔÕ()ÈGB�Èd�!%SZPd"$¸P¸·Y °FÝG3b <ZYY¸QZ ´51.3°stÇÈÑ�ÿÜ!ÛÇÓ" "

­,£.5�GY$%&'(:YZ¸PVR:ZPPNP �?b��w[m��U±À()ÛÇÓÝÛAG@Ýb <ZYY¸QZ {7mn7mÿ`AGR�b}u3n°dnd±��cG»�b}u3n° Y$%&'(:YZ¸PVR ±��ÇÈ�G4�� Y$%&'(:YZ¸PVR:ZPPNP {*7i°�P=AGunub{7mn7m��P=AÛMgÓ��cGUTMÞ­,£.5ÿGY$%&'(:!'\ZÐ!'Q:ø¸P' bw[mÜÀ()�ÂKGY$%&'(:YZ¸PVR {7mn7m�Ò)°ÔÕcÛMgÿGdnd�ÔÕcÛÇÓ" "

EK"

-[­.n" "

fE" "

"! �!%SZP"G"780" "! fE"

! %�b­,£.5w[mbe°x,m7ÇÈÏб}u3n°ü�Ó" "

! XÝ()�­,£.5°ÇûÞx,m7Çȱ�Ga�°ü�Ó"

"! V%Z¸P%'>Nã!!Y$¸SVR"G";P&Z"i"°¸%YZ" "

! fE"

! ;P&Z" ±��ÇÈ�G�cÚ��ÿ)um-,Ô()��!±G­,£.5ÿwx2()ÛÇ" "

"! ·¸Ð#!¢Z"G"á3" "! fE"

! ÁU<Ú­,£.5°ßÞÈI±ÔÕÇÈ­,£.5b3Ó" "

�¤�67" "

"! \Z�¸&%S"G"780" "! 12" "

! ÔÕÇÈ)}~3i­,£.5°ü�Ó" "

Î" "<module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module>

��" "

��2w�67t´51.3Ó" "

Òk´51.3�G{�ØÀ()�)*°=>cÛÇÓc�ÿaÞGíÒk��´51.3�zØb�¤�67°àb��±��cÛÇÓ��°áA¿À±�G}u.3�nJ´uv�?b}u3n°��ÇÈ�´51.3°4�ÛÇÓ" "

#Z¸PVRɸP" "

SearchBar´51.3�G�½7£3�n7�ýþ�n7°FÝ��4.°=>cÛÇÓ" "

"

-[­.n" "

fE" "

�cÓ" "

EE"

�¤�67" "

"! â"G" ��780" "! ���,wm±W|ÇÈ)}~3i��°ü�Ó" "

"! &YZWYY!YS¸'S"G"SP&Z"i"�¸%YZ" "

! ��2�mn7i°ÒÓÇÈ�?Ð�°��Ó" "

"! &YZ;O$Z¸RZ¸\"G"SP&Z"i"�¸%YZ" "

! Æþ|}°{7),wmi.w7ÜÒÓ±ÇÈ�?Ð�°��Ó" "

Î" "<module name="SearchBar" layoutPanel="main_search_controls"> <param name="q">host=*</param> <param name="autoRun">True</param>

ÑbÎ�G��4.±o°W|cÞG��°z~)um-,ÔcÛÇÓ" "

host=*

°!Z%\#Z¸PVR" "

%�b}u.3�Ü��°¬¨cÛÇÓÑb´51.3°stcÞGaÝ}~.o}u.3�c�F��Ú}~.o��°��cÛÇÓG3b}~.o°FÝ}~.o��°��Çȱ�GZÐSZ'\Z\°!Z%\#Z¸PVR °stcÛÇä45åÓ" "

"

-[­.n" "

fE" "

"! �!Z%\"G" }u.3�" "! ±²buv°ü�ÇÈ��b}u.3�äYN&PVZSO$ZGV%!Z'S!$ Òb»bÒÓ�}u.3��?å°ü�Ó" "

�¤�67" "

"! â"G" ��780" "! õ.5b+.�J±ÔÕÇÈ)}~3i��°ü�Ó" "

"! %¸ãZ%"G"780" "! |}}u.3�b�±ÔÕÇÈC`¹�mi°��Ó" "

! ã�c�ÂKG)}~3i� �!Z%\"$¸P¸·Ó" "

Î" "<module name="FieldSearch"> <param name="field">sourcetype</param>

E©"

ZÐSZ'\Z\°!Z%\#Z¸PVR" "

%�b}u.3�Ü��°¬¨cÛÇÓÑb´51.3°stcÞGG3b}~.o}u.3�°FÝ}~.o��°��cÛÇÓaÝb}u.3�c�F��Ú}~.o��°��Çȱ�G°!Z%\#Z¸PVR °stcÛÇäI5åÓ" "

-[­.n" "

fE" "

"! �!Z%\"G"780" "! ±²buv°ü�ÇÈ��b}u.3�äYN&PVZSO$ZGV%!Z'S!$ Òb»bÒÓ�}u.3��?å°ü�Ó" "

�¤�67" "

"! !'SZ'S!N'"G" to" "

! ��f7¹�mi��5�wi±��ÇÈ]£Ó" "

"! PZ$%¸VZ·Z'S<¸$"G"780" "! #.$.ÿ��c�oÜß!ïëÈf`ÿ`ÈtoXbo0bÁÍ-mb/,¤Ó" "

"! \Z�¸&%S"G"780" "! ¹�mi}u.3�±ó)È)}~3ioÓ" "

"! %¸ãZ%"G"780" "! |}}u.3�b�±ÔÕÇÈC`¹�mi°��Óã�c�ÂKG)}~3i� �!Z%\"$¸P¸·Ó" "

Î" " <module name="HiddenSearch" layoutPanel="mainSearchControls"> <param name="search">sourcetype=$st$</param> <module name="ExtendedFieldSearch"> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="st"> <param name="default">apache_error</param> </param> </param> </param> <param name="replacementMap"> <param name="arg"> <param name="st"> <param name="value"></param> </param> </param> </param> <param name="field">Sourcetype</param> </module> </module>

EC"

#!ZøXZ\!PZVSNP" "

Ñb´51.3�Gf7¹�miùÏú��)*ÜGÒbäÆ�Ø��()�Ub°=>cGÒb��°)um-,ÔcG#.$.°xr{vwicÞGü�()�q1.ÜÒb��°ÔÕÇÈÏбcÛÇÓ#!ZøXZ\!PZVSNP ÿ�cÚf7¹�mi°�P=AGN'MN'SZÐSMR¸'QZäåÿMúP()�ÂKGü�()�q1.±xr{vwicÛÇÓ! !

-[­.n" "

fE" "

"! [!Zø;¸PQZS"G" q1." "! ´51.3ÿ#.$.b��°xr{vwiÇÈÏбq1.°��Ó" "

�¤�67" "

"! ·N\Z"G"¸&SN·¸S!V"i"%!'("i"ã&SSN'" "

! ¸&SN·¸S!V ´.�Ü�G�UÔÕ()ÁGf7¹�mi²³�xr{vwi°ix�cÛÇÓ%!'( ùÏ

ú ã&SSN' ´.�Ü�G#.$.�Gxr{vwi°��ÇÈ��±�G´51.3°wx,wÇÈf

`ÿ`AÛÇÓ" "

! )}~3i� ¸&SN·¸S!VÓ" "

"! %¸ãZ%"G"[*3" "! %!'( ùÏú�n7´.�Ü�Gx7wÛ���n7b[*3±�AÛÇÓ" "

! )}~3i� @NäýþåÓ" "

"! $N$&$"G"SP&Z"i"�¸%YZ" "

! g,¤2,¤®{7�®Üq1.°��ÇÈGÛ��üH®{7�®°sÐ�°��Ó" "

! ø!'\Nø"$PZ�ZPZ'VZY ±��Çȱ�GSP&Z ùÏú �¸%YZ�âbo°��cÛÇÓ" "

! )}~3i� �¸%YZäüH®u7�®åÓ" "

"! %!'(;O$Z"G"Y!\"i"$ZP·¸%!'(" "

! x7w°�� U!±xPÈGÛ��-./x7w�ÇÈ�°ü�Ó" "

! )}~3i� Y!\äU!åÓ" "

"! YZ'\ɸYZ#U!"G"SP&Z"i"�¸%YZ" "

! *.m�� U!°XÈ�?Ð�bËA`ëÓ" "

! )}~3i� �¸%YZäXØ�ÚåÓ" "

"! \!Y$¸SVRÉZ�NPZXZ\!PZVS"G"SP&Z"i"�¸%YZ" "

! xr{vwibI±��°)um-,ÔÇÈ�?Ð�b��Ó" "

! )}~3i� �¸%YZäc�ÚåÓ" "

Î" "<module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param>

EA"

</module>

#!ZøXZ\!PZVSNP=!'(" "

Ñb´51.3�GzëØ)�[*3°FÝq1.±x7w°íPÛÇÓÑ)°wx,wÇÈ�GÒbäÆÿ��ÇÈf7¹�mi)*°=>cGÒb��°)um-,ÔcG#.$.°xr{vwicÞGü�()�q1.ÜÒb��°ÔÕÇÈÏбcÛÇÓ" "

-[­.n" "

#!ZøXZ\!PZVSNP=!'( � #!ZøXZ\!PZVSNPäÄ5åb $¸P¸·Y °ÇûÞ��cÛÇÓ" "

fE" "

�cÓ" "

�¤�67" "

"! %¸ãZ%"G" x7w[*3" "! Ñ)�G%!'( ùÏú�n7´.�ÜGx7wÛ���n7b[*3±�AÛÇÓ" "

! ã�c�ÂKGÒbx7wÛ���n7[*3�¨q1.±²©��AÛÇÓ" "

:!\\Z'#Z¸PVR" "

4,w|[®7�Ü��°ý cÛÇÓ±²°�±ÀcÛÇÓ" "

'2?" "

"! :!\\Z'#Z¸PVR �G=!'(=!YS ùÏú ;¸ã#ø!SVRZP �?G*db�ì´51.3Üf`ÜÇÓ��±²bÔձΡÇÈ´51.3�¼�g?ÿ :!\\Z'#Z¸PVR °{�cÞFaÞÚÛÇÓ" "

"! ��°ýÛ±ýþÇȱ�GautoRun = true°��ÇÈf`ÿ`AÛÇÓ" "

-[­.n" "

fE" "

"! YZ¸PVR"G" ��780" "! x¹[3���780Ü`È :!\\Z'#Z¸PVR �Òb�±ÀcÛÇÓ" "

! '2?":!\\Z'#Z¸PVR °j>ÇÈÛ±GJ´´)u}µ{2�Á<�Á�±��cG��zt±��

�c�ÚÏбcÛÇÓ" "

�¤�67" "

"! Z¸P%!ZYS"G" J´780" "! Jåuvb��b��±stÓ��bJ´uvb�²°��Ó" "

! d%¸SZYSdÿ��()ÈÂKGÑ)°��ÇÈf`ÿ`ÈÓ" "

©;"

"! %¸SZYS"G" J´780" "! JåuvbÂæb��±stÓ��bJ´uvb²°��Ó" "

! dZ¸P%!ZYSd°��ÇÈÂKGÑ)U��ÇÈf`ÿ`ÈÓ" "

'2?"¨ÒÓ�J´780b��©°ª«cÞd�(ÚÓ" "

Î" "<module name="HiddenSearch"> <param name="searchClass">search</param> <param name="searchObject">| metadata type=sources | sort -totalCount</param>

:!\\Z'#¸[Z\#Z¸PVR" "

Y¸[Z\YZ¸PVRZY:VN'� Ü��()� ¡¢e���ر²°+.�cÛÇÓ+.�J± ¡¢e��°ýþÇÈGÛ��Á4±ýþc� ¡¢e��b±²°ÔÕcÛÇÓ" "

-[­.n" "

fE" "

"! Y¸[Z\#Z¸PVR"G"  ¡¢e��ù" "!  ¡¢e��bçèÜ��°àûÈ�!GÛ���ç��°)um-,ÔÇÈÛ±stÇÈ ¡¢e�

�bùIÓ" "

�¤�67" "

"! &YZ:!YSNPO"G""N'Z"i";P&Z"i"°¸%YZ" "

! )}~3i� "N'ZÓ"

! )um-,ÔÇÈ ¡¢e��b´51.3b=A�Ú°��cÛÇÓ)}~3i� "N'ZÓÝÛAG

´51.3�G ¡¢e��bçè�Ø¥t89��Ibýþ56�°stcÛÇÓÒ)�â�G�ç

56�°)um-,ÔcG�ç56�b Y!\ °rÇÑ�°2ÖcÛÇÓ" &YZ:!YSNPO ÿ ;P&Z bÂKG

Y¸[Z\#Z¸PVR �G ¡¢e��ÿ)um-,Ôc��Ibýþ56�be°«cÛÇÓ�¸%YZ ±��c

�ÂKG´51.3�G56�ÿ ¡¢e��bçè±`È�?Ð�±QLØÁG��()� ¡¢e

��±ÜwÚÞG�ç56�°)um-,ÔcÛÇÓ!

Î" "

ÑbÎ�G¨W%%"%NV¸%"YN&PVZY©�ÚÐùIb ¡¢e��°stcÛÇÓ" "

<module name="HiddenSavedSearch" layoutPanel="mainSearchControls" autoRun="true"> <param name="savedSearch">All local sources</param>

:!\\Z'U'SZ'S!N'" "

�ÝÇÈ��bto°��cÛÇÓ" "

©a"

-[­.n" "

fE" "

"! !'SZ'S!N'"G"780" "! Üi��bi,¤±`Èto°ëìxcÛÇÓ" "

�¤�67" "

�cÓ" "

Î" "

:!\\Z'°!Z%\Ù!V(ZP" "

Ñb´51.3�G#.$.±ÔÕ()È}u.3�ùÏúÒb}u.3�ÿ`ÈDé°Ve¿ÀOë�Úf7i+.3°ýOcÛÇÓÒ)ØÿÑb´51.3bÒkÜ`ÈÂKG{*7i�./x.)*°ÔÕÇÈ»b´51.3�GÑÑÜü�()�}u.3�xmi°=>cÛÇÓ" "

-[­.n" "

fE" "

"! �!Z%\Y"G" }u.3�bxmi" "! õ.5b+.�J±)}~3iÜ{*7i��U±ÔÕ()È}u.3�bxmiêmõ.m¹ËAë" "

�¤�67" "

�cÓ" "

Î" "<module name="HiddenFieldPicker"> <param name="fields">clientip host uri</param>

X¸\!NÉ&SSN'#Z¸PVR" "

Ñb´51.3�GXÝùÏú�½7£3�n7°FÝR_b[5��n7°k>cÛÇÓ" "

'2?":!\\Z'#Z¸PVR ÿ{äÛ��äÆå�cÞf`ÜÇÓ" "

-[­.n" "

fE" "

"! %¸ãZ%"G"780" "! [5��n7b�±ÔÕÇÈ[*3°��Ó" "

"! N$S!N'Y"G" xmi" "

©@"

! @ Ýb�]?SZÐS � [¸%&Z bxmiÓ" "

! SZÐSG[5��n7b�±ÔÕÇȹ�miÓ" "

! [¸%&ZG[5��n7°wx,wc��!±��()ÈoÓ" "

! �¤�67ÜGYZ%ZVSZ\ °��cÞGõ.5+.�J±Ô�,w()È�n7°ü�Ü!ÛÇÓ" "

�¤�67" "

"! �!Z%\"G"[5��n7bo" "! `ÈÂKG 51.3�G�.o YZ¸PVR;ZP·Y °<field>=<radioButtonValue>bÖ×Ü��cÛ

ÇÓ�ÚÂKG´51.3��±<radioButtonValue>°��±��cÛÇÓ" "

Î" "<module name="RadioButtonSearchField"> <param name="options"> <list> <param name="selected">true</param> <param name="value">save</param> <param name="text">Saves</param> </list> <list> <param name="value">edit</param> <param name="text">Edits</param> </list> <list> <param name="value">upload</param> <param name="text">Uploads</param> </list> <list> <param name="value">view</param> <param name="text">Views</param> </list> <list> <param name="value"></param> <param name="text">All</param> </list> </param> <param name="label">Show only</param>

;!·ZX¸'QZÙ!V(ZP" "

Ñb´51.3�G#.$.ÿJ´uvb²³±stÜ!È�+,¤r®7­01.°k>cÛÇÓJ´uvboùÏú[*3�GS!·ZY:VN'� b���Ø=A¿Û)ÛÇÓ" "

"

-[­.n" "

fE" "

�cÓ" "

©<"

�¤�67" "

"! YZ%ZVSZ\"G" J´uv[*3" "! S!·ZY:VN'� bJ´uv[*3b aݱ��c�ÂKGõ.5b+.�J±ÒbJ´uv�¤�67ÿ�

�()ÛÇÓ" "

! �ìÇÈÿF�c�ÚÓ" "

�¤�67" "

"! YZ¸PVRâRZ'MR¸'QZ\"G";P&Z"i"°¸%YZ" "

! J´uvÿ²³()�J±��°ÿ~Ó" "

"! %¸ãZ%"G"780" "

PZâ&!PZ\"G"°¸%YZ"%¸ãZ%"G" J´uv¶,l.bıÔÕÇÈ�¤�67[*3Ó" "

Î" "<module name="TimeRangePicker" layoutPanel="main_search_controls"> <param name="selected">This month</param>

°!Z%\Ù!V(ZP" "

Ñb´51.3�G#.$.ÿÔÕÇÈ}u.3�°��Ü!ÈÇûÞb¥t89�}u.3�bR�°ÔÕÇÈ}u.3�¶,l.°ÿ~cÛÇÓ{*7iùÏú./x.)*°ÔÕÇÈÑb´51.3bÒk�GÑÑÜü�Û����()�}u.3�xmi°=>cÛÇÓ" "

-[­.n" "

fE" "

"! �!Z%\Y"G" }u.3�bxmi" "! õ.5+.�J±G)}~3iÜ��()È}u.3�bxmiêmõ.m¹ËAëÓ" "

! �ì&ÿ`AF�ÇÈÓ" "

�¤�67" "

�cÓ" "

Î" "<module name="FieldPicker" layoutPanel="side_bar"> <param name="fields">host sourcetype source</param>

#ø!SVRZPY" "

#ø!SVRZP ´51.3�G±²ÔÕùÏú�´51.3bñ|3.¤�?b�¤�67°Gq1.°ËA`ëÁ±ËA`ëÛÇÓ�´51.3� aÝb|3.¤beÿR�±ÔÕ()ÛÇÓ#ø!SVRZP ´51.3��G�n7G¤3r®7­01.Gx7wGn�ÜÇÓ" "

©9"

#ø!SVRZP ´51.3�ÇûÞÑ)Øb $¸P¸·Y °NÒcÛÇÓ" "

fE" "

"! ·N\Z"G"!'\Z$Z'\Z'S"i"YZP!¸%!¢ZW%%" "

! <N\Z �óôb�ѶGd!'\Z$Z'\Z'SdÛ��dYZP!¸%!¢ZW%%dbÚÁ)�bo°�AÛÇÓ" nn"!'\Z$Z'\Z'S

ÿÁURÞ£���ÜÇÓ!'\Z$Z'\Z'S ´.�Ü�G 51.3b "ðb.�Íx.�ÇûÞ¹ñ()G

ðñb��[7ÔÜÇÓ" "

! YZP!¸%!¢ZW%% �GaÝbNÒ��Û��vg.ibB�È%&°ËA`ëÛÇÓÑb´.�Ü�G¸å" Á

4b�´51.3�Gm{,Ô½b�¤�67ÜÔÕ()�ÚGÛ��" ãå" Á4b�Íx.�2±ÔÕ

()ÛÇÓ" "

�¤�67" "

"! YZ%ZVSZ\"G" |3.¤ù" "! õ.5+.�J±��()È�b|3.¤°ü�Ó" ä|3.¤ù�G{´51.3b QPN&$"G"'¸·Zf&��å" "

! ¡ôc�ÚÂKGÁpb�´51.3�ÒbÆäÍx.ÿp�±ÔÕ()ÛÇÓ" "

Ù&%%\Nø'#ø!SVRZP" "

�b±²ÿW|()�¤3r®7­01.°k>cÛÇÓR�± a£,ib�´51.3°ÔÕcÛÇÓ��G±²°��ÇÈä�x2[{«åGÛ��yí(MÈÑ�ÿÜ!ÛÇÓ! !

-[­.n" "

)}~3ib Yø!SVRZP -[­.n�Ä5b�ùAÓ" "

fE" "

"! %¸ãZ%"G"780" "! ¤3r®7bû±ÔÕÇȹ�mi[*3°ü�Ó" "

Î" "<module name="PulldownSwitcher" layoutPanel="main_search_controls"> <param name="mode">independent</param> <param name="selected">Messages per minute last hour</param> <param name="label">Show: </param>

;¸ã#ø!SVRZP" "

Ù&%%\Nø'#ø!SVRZP �ü+±GÑb´51.3�R�±êÝb�°ÔÕcÛÇÓn�£,iÜ�´51.3b±²°ÔÕcÛÇÓB�Èn�°#.$.ÿwx,wc�ÂKGÒ)±»pÇÈ��ÒbÒk´51.3ÿ¥¦±ÔÕ()G»b�´51.3äùÏúÒbÒkå�ÇûÞ�()ÛÇÓ" "

©K"

-[­.n" "

)}~3ib Yø!SVRZP -[­.n�Ä5b�ùAÓ" "

Î" "<module name="TabSwitcher" layoutPanel="main_search_controls"> <param name="mode">independent</param>

É&SSN'#ø!SVRZP" "

2{f7bwx,w±ÜwÚÞÔÕ°ËA`ëÛÇÓá±G{*7iq1.Û��¹.�3q1.b±²ÔÕ°ËA`ëÛÇÓ�n7mn{3�G$¸P¸·Y bw[m��Üü�cÛÇÓ" "

B�È�n7°#.$.ÿwx,wc�ÂKGÒ)±»pÇÈ��ÒbÒk´51.3ÿ¥¦±ÔÕ()G»b�´51.3äùÏúÒbÒkå�ÇûÞ�()ÛÇÓ" "

-[­.n" "

)}~3ib Yø!SVRZP -[­.n�Ä5b�ùAÓ" "

=!'(#ø!SVRZP" "

B�Èx7w°#.$.ÿwx,wc�ÂKGÒ)±»pÇÈ��ÒbÒk´51.3ÿ¥¦±ÔÕ()G»b�´51.3äùÏúÒbÒkå�ÇûÞ�()ÛÇÓ" "

-[­.n" "

)}~3ib Yø!SVRZP -[­.n�Ä5b�ùAÓ" "

fE" "

"! %¸ãZ%"G"780" "! Ñ)�Gx7wbû±ÔÕÇȹ�mi[*3°ü�cÛÇÓ" "

Î" "<module name="LinkSwitcher" layoutPanel="panel_row4_col2"> <param name="mode">serializeAll</param> <param name="label">Format options:</param>

±²" "

��°±²�cÞÀDZ�GIb��´51.3b��cÞ±²´51.3°}~./,icÛÇÓ" "

@Z'ZP!V:Z¸\ZP" "

ö,r.°ÔÕcÛÇÓ~î± #ø!SRVZP ´51.3ä;¸ã#ø!SVRZPGÙ&%%\Nø'#ø!SVRZP �?å�ït()G�´51.3b[*3°ÔÕcÛÇÓ" "

©E"

-[­.n" "

fE" "

"! Yø!SVRZP;!S%Z"G"780" "! ÔÕÇÈn{i3Ó" "

! Ñb´51.3ÿ#ø!SVRZP´51.3äÙ&%%\Nø'#ø!SVRZPÛ��;¸ã#ø!SVRZPåbÁpb�Ü`ÈÂK±

bef`Ó" "

"! %¸ãZ%"G"780" "! ¤3r®7bû±ÔÕÇȹ�mi[*3°ü�Ó" "

�¤�67" "

�cÓ" "

Î" "<module name="GenericHeader"> <param name="switcherTitle">General Options</param> <param name="label">General Options</param>

XZY&%SY:Z¸\ZP" "

XZY&%SY:Z¸\ZP ´51.3�±²[*3°k>cÛÇÓÑb´51.3°stcÞ»b´51.3äXZY&%SY:Z¸\ZP b�Ü`ÈÑ�åbö,r.k>cÛÇÓÑb´51.3�GÎëìG@<T9@;"Z[Z'SYG�?bö,r.°ÔÕcÛÇÓ¾2G°%¸YR;!·Z%!'Z bÄGÛ��õ.57|f7i+.3°ýOÇÈ´51.3£,ibıß!ÛÇÓ" "

"

-[­.n" "

fE" "

"! Z'S!SO=¸ãZ%"G"780" "! #0,i±[*3°íPÛÇÓ" "

! ¾2GZ[Z'SY Û�� PZY&%SY ±��ÇÈÑ�ÿÜ!ÛÇÓ" "! »bUb±U��ÇÈÑ�UÜ!ÛÇÿGí±²±»c2Öb[*3±cÞd�(ÚÓ" "

"! Z'S!SO"¸·Z"G"Z[Z'SY"i"PZY&%SY"i"YV¸''Z\" "

! ÔÕÇÈ3ob=>Âä°ü�Ó" "

�¤�67" "

"! $PZ�!Ð"G"780" "! `ÈÂKGÑb�.bo�GÔÕ()È3obI±ÔÕ()ÛÇÓ" "

! ÎëìGd°N&'\d±��ÇÈ�G7tbÔÕ�d°N&'\"@<T9@;"Z[Z'SYd±�AÛÇÓ" "

©©"

"! %!'("G" q1.0bx7w" "! `ÈÂKGq1.0bx7w°ÔÕcÛÇÓ" "

! wx,wÇÈ�GÒbq1.°Gd"i"SN$"&�!Z%\Ñd��±ÀcÛÇÓÑ)�G»pÇÈÔ½.i°k>cÛ

ÇÓ" "

! o��.?d[!Zø;¸PQZSdGd%¸ãZ%db�jÜÇÓ" "

Ñ)�G 51.3ÿÔÕÇÈx7wb~=°ü�ÇÈ��ob�jÜÇÓÑb��±²ÿCLA±ÔÕ()Èñbq1.±#.$.°�!ÛÇÓx7wb¹�miÜ`Èd%¸ãZ%d�.GùÏú#.$.ÿ��)ÈÆbq1.Ü`Èd[!Zø;¸PQZSd�.°4eÛÇÓÛ�Gd$N$&$d�.�G;P&Z b�!Gx7wÿ�cÚg,¤2,¤®{7�®°�dÏбcÛÇÓ" "

Î" "<module name="ResultsHeader" layoutPanel="results_area_1"> <param name="entityName">events</param> <param name="prefix">Timeline</param> <param name="entityLabel">Events</param> <module name="ResultsHeader" layoutPanel="results_area_1"> <param name="entityLabel">Events</param> <param name="link"> <param name="popup">True</param> <param name="viewTarget">report_wizard</param> <param name="label">Report on results</param> </param> <param name="prefix">Timeline</param> <param name="entityName">events</param>

Z[Z'SY#!ZøZP" "

Z[Z'SY#!ZøZP ´51.3�GäÆ´51.3��KcÞü�ÇÈ���ØkHÈ{*7i°ÔÕcÛÇÓÑb´51.3� #!·$%ZZ[Z'SY#!ZøZP �é°cÞÚÛÈ��GÑb @Ýb´51.3� aݱ�K()ÈU�ÜÇÓ" "

-[­.n" "

fE" "

�cÓ" "

�¤�67" "

"! 'ZQ¸SZ<N\!�!ZP"G"YR!�SÃZO"i"¸%SÃZO"i"VSP%ÃZO"i"·ZS¸ÃZO" "

! �.�.�b�.°ø�ÇÈÏÐ��cGwx,wÇÈ�G���Ø��°ðñcÛÇÓ" "

! )}~3i� ¸%SÃZOÓ" "

"! YVPN%%ZPZ'¸ã%Z"G";P&Z"i"°¸%YZ" "

! mw+.[.°ÒÓ±cÛÇÓ" "

"! YVPN%%ZP<¸Ð:Z!QRS"G"á3" "! YVPN%%ZPZ'¸ã%Z ÿ ;P&Z bÂKGmw+.[.Áé¶w£3�(¬¨°¬ÄcÛÇÓ" "

©C"

! )}~3i� a;;;;Ó" "

"! YVPN%%ZP<!':Z!QRS"G"á3" "! YVPN%%ZPZ'¸ã%Z ÿ ;P&Z bÂKGmw+.[.Á-¶w£3�(¬¨°¬ÄcÛÇÓ" "

! )}~3i� ;Ó" "

"! \!Y$%¸OXNø"&·ãZPY"G"SP&Z"i"�¸%YZ" "

! Ñ)�þ|ò°ÔÕ{�ÔÕ°ó�cÛÇ" "

! )}~3i� SP&ZÓ" "

Î" "

<module name="EventsViewer" layoutPanel="main_search_controls"/>

#!'Q%Z#¸%&Z" "

Ñb´51.3�G��b6æ°Õ�GÒb4G±²bÁpbþ�Ø aÝb}u.3�°ÔÕäv7rx7|åcÛÇÓ" "

-[­.n" "

fE" "

�cÓ" "

�¤�67" "

"! %¸ãZ%"G"[*3" "! ±²l®7i��U±ÔÕÇÈ[*3Ó" "

"! %¸ãZ%ÙNY!S!N'"G"ãZ�NPZ"i"¸�SZP" "

! ÔÕ()�}u.3�bIÛ��4±[*3°ÊßcÛÇÓ" "

! )}~3i� ¸�SZPä4åÓ" "

"! ãZ�NPZ=¸ãZ%"G"[*3" "! ±²bI±ÔÕÇÈ[*3" "

"! ¸�SZP=¸ãZ%"G"[*3" "! ±²b4±ÔÕÇÈ[*3" "

"! �!Z%\"G" }u.3�" "! ÔÕÇÈ}u.3�Ó" "

! )}~3i�Áp±r()È}u.3�" "

"! ¸\\!S!N'¸%M%¸YY"G"M## w[m" "! �¤�67ÜGM##w[m°��cÞ�n7bmn{3°��cÛÇÓ" "

! ¸$$%!V¸S!N':VYY Üw[m°mn{3��cÛÇÓ" "

"! V%¸YY°!Z%\"G" }u.3�" "! Ápb±²b V%¸YY°!Z%\ bo°G±²f7¹�±��ÇÈ VYY w[m�cÞ��cÛÇÓ" "

©A"

! `Ø�H���()�w[m�GdYZ[ZPZdGdZ%Z[¸SZ\dGd%NødùÏúd"N'Zdä)}~3iåÓ" "

"! %!'(#Z¸PVR"G" ���" "! ±²°wx,w89x7w±²ëÈ��bÒÓ�67��°ü�cÛÇÓ" "

"! %!'(#!Zø"G" q1." "! %!'(#Z¸PVR °ÔÕÇÈq1.°ü�Ó" "

! )}~3i� \¸YRãN¸P\är,�1�.�åÓ"

"! %!'(°!Z%\Y"G" }u.3�" "! ±²°x7wÇÈGÛ��[*3U4�È�°ü�cÛÇÓ" "

! ±²�t�b[*3°x7wÇȱ�GuPZY&%STãZ�NPZ=¸ãZ%T¸�SZP=¸ãZ%u°ü�cÛÇÓ" "

! )}~3i� PZY&%SYä±²beåÓ" "

"! �NP·¸S"G"'&·ãZP"i"\ZV!·¸%"i"$ZPVZ'S"i"'N'Z" "

! o±��ÇÈ).n}~./,i��°ü�cÛÇÓ" "

! +Æ.3±Î¡cÛÇÓ" "

! )}~3i� 'N'Zä�cåÓ"

#!·$%Z°!Z%\#!ZøZP" "

Ñb´51.3�GzëØ)�}u.3�bÄ�Ø "ðbo°ÔÕcÛÇÓüJ±GÒbzëØ)�o°FÝ{*7ib3UÔÕcÛÇÓ" "

-[­.n" "

fE" "

"! �!Z%\"G" }u.3�" "! ÔÕÇÈÄJob}u.3�°ü�Ó" "

"! VN&'S"Gá3" "

! ´51.3ÿÔÕÇÈÁURÞ£�ob3ÜÇÓ" "

�¤�67" "

"! %!'("G" q1.0bx7w" "

! `ÈÂKGq1.0bx7w°ÔÕcÛÇÓ" "

! wx,wÇÈ�GÒbq1.°Gd"i"SN$"&�!Z%\Ñd��±ÀcÛÇÓÑ)�G»pÇÈÔ½.i°k>cÛ

ÇÓ" "

! o��.?d[!ZødGd%¸ãZ%db�jÜÇÓ" "

! Ñb�.�j�G 51.3ÿÔÕÇÈx7wb~=°ü�cÛÇÓÑb��±²ÿCLA±ÔÕ()

Èñbq1.±#.$.°�!ÛÇÓx7wb¹�miÜ`Èd%¸ãZ%d�.GùÏú#.$.ÿ��)È

Æbq1.Ü`Èd[!Zø;¸PQZSd�.°4gÜÚÛÇÓÛ�Gd$N$&$d�.�G;P&Z b�!Gx7wÿ�c

dg,¤2,¤®{7�®°�dÏбcÛÇÓ" "

C;"

Î" "<module name="SimpleFieldViewer" layoutPanel="side_bar"> <param name="count">5</param> <param name="field">twikiuser</param> </module>

<&%S!°!Z%\#!ZøZP" "

G3}u.3�bÄJ ÐðboÓ" "

R_b}u.3�ù°ÔÕcGüJ±Òb�±óôÜðñl®7i°ÔÕcÛÇÓ#.$.ÿ}u.3�ù°wx,wÇÈ�Gg,¤2,¤v{Ùÿ�!GÒb}u.3�bÄJ a; ðbo°ÔÕcÛÇÓÒbÐ�b aÝ°wx,wÇÈ�GõúÇÈ �!Z%\G[¸%&Z��°��cG��°æýþcÛÇÓ" "

-[­.n" "

fE" "

�cÓ" "

�¤�67" "

"! %¸ãZ%"G"780" "! }u.3�q1.2b�±ÔÕÇÈ[*3°�¤�67Ü��cÛÇÓ" "

"! �!Z%\"G" }u.3�" "! }u.3�ÿ{w[mb-[­.nÜc�ÿGÑbw[mÜ�ö`ÜÇÓ" "

"! VN&'S"Gá3" "! Ñ)�G´51.3ÿÔÕÇÈÁURÞ£�ob3ÜÇÓ" "

"! %!'("G" q1.0bx7w" "

! `ÈÂKGq1.0bx7w°ÔÕcÛÇÓ" "

! wx,wÇÈ�GÒbq1.°Gd"i"SN$"&�!Z%\Ñd��±ÀcÛÇÓÑ)�G»pÇÈÔ½.i°k>cÛ

ÇÓ" "

! o��.?d[!ZødGd%¸ãZ%db�jÜÇÓ" "

o 51.3ÿÔÕÇÈx7wb~=°ü�ÇÈ��ob�jÜÇÓÑb��±²ÿCLA±ÔÕ()Èñbq1.±#.$.°�!ÛÇÓx7wb¹�miÜ`Èd%¸ãZ%d�.GùÏú#.$.ÿ��)ÈÆbq1.Ü`Èd[!Zød�.°4eÛÇÓÛ�Gd$N$&$d�.�G;P&Z b�!Gx7wÿ�cdg,¤2,¤®{7�®°�dÏбcÛÇÓ" "

Î" "<module name="MultiFieldViewer"> <param name="count">10</param> <param name="link"> <param name="view">report_wizard</param> <param name="label">Report on this field</param> </param>

Ca"

=!'(=!YS" "

x7wbxmi°ÔÕäv7rx7|åcÛÇÓx7wxmi�¾2Gá}u.3�ä%¸ãZ%°!Z%\å�G¿ @ bßà}u.3�ä[¸%&Z°!Z%\åbVeKLMÛÇÓ�¤�67ÜGÔÕ $¸P¸·Y °ü�cÛÇÓ" "

'2?":!\\Z'#Z¸PVR ÿ{±f`ÜÇÓ" "

"

-[­.n" "

fE" "

"! %¸ãZ%°!Z%\"G" }u.3�" "! x7wxmiÜÔÕÇÈ}u.3�ù°��Ó}u.3�bo°ÔÕÓ" "

"! [¸%&Z°!Z%\"G" }u.3�" "! xmiÜÔÕÇÈ}u.3�o°��ÓÑ)�¼�g?bÂKGx7wxmibu%¸ãZ%uÊL±Q_ÇÈ

l®7iÛ��3oÜÇÓ" "

�¤�67" "

"! !'!S!¸%#NPS!!P"G"\ZYV"i"¸YV" "

! !'!S!¸%#NPS" }u.3�±ÜwÚÞ±²°/û`ëÈx!Ó" "

! )}~3i� ¸YVÓ" "

"! !'!S!¸%#NPS"G"RÝb}u.3�" "! ±²b}u.3��x7wxmiÿÁp±ÔÕ()ÈJ±¯.i()ÛÇÓ" "

"! %¸ãZ%°!Z%\#Z¸PVR"G" ��" "! #.$.ÿ[*3}u.3�°wx,wc�Û±k>()È��780Ó%¸ãZ%°!Z%\;¸PQZS °ÒÓ�q

1.±ü�ÇÈf`ÿ`AÛÇÓ[*3}u.3�bo�z~£±Òb��±��()ÛÇÓ" "

"! %¸ãZ%°!Z%\;¸PQZS"G" q1." "! [*3}u.3�ÿG��°)um-,ÔÇÈwx,w89x7w°k>ÇÈÏб£,i2,¤()

ÞÚÈÂK±G]·�ÇÈq1.Ó" "

Î" "<module name="LinkList"> <param name="initialSortDir">desc</param> <param name="labelFieldSearch">*</param> <param name="valueField">totalCount</param> <param name="labelField">source</param> <param name="labelFieldTarget">searchview</param> <param name="initialSort">totalCount</param>

C@"

Ô½.if7i+.3" "

±²°Ô½.iÜÔÕÇÈÂKGÑ)Øb´51.3°stcÛÇÓ" "

°%¸YRMR¸PS" "

Ñb´51.3�G#$%&'( 4,wº7�Ük>89���±²b¼�g?°Ô½.i±Ü!È °%¸YR ��5�wi°4eÛÇÓ" "

°%¸YRMR¸PS ´51.3�±²°Ô½.iÜÔÕcÛÇÓ"

"

"

-[­.n" "

fE" "

"! ø!\SR"G".{«" "! ´51.3b6°ü�Ó" "

! -.£7iÛ��¶w£33Üü�89Ó" "

! ¾2Gua;;÷u±��()G¥t89�mõ.mÚaøÚ±ÔÕcÛÇÓ" nnuK;;$Ðu�?bo°saÞ¶

w£33°��ÇÈÑ�UÜ!ÛÇÓ" "

"! RZ!QRS"G".{«" "

C<"

! ´51.3b�(°ü�Ó" "

! -.£7iÛ��¶w£33Üü�89Ó" "

�¤�67" "

"! Yø�°!%Z"G" -m" "! Yø�0b-m°��Ó" "

! -m�G$#Ù=p"ï:%<Z{YR¸PZ{Y$%&'({YZ¸PVR¯·PY$¸P(%Z{ZÐ$NYZ\{�%¸YR ±»Çȳ»-mÜ`ÈÑ�Ó" "

! Yø� �GâÊst()�ÚGùcd¬¨cGÑ)ÛÜ7jx()ÞÚ�ÚÃ+±ÕÐÑ�Ó" "

! )}~3i�uVR¸PS!'Q{ã!'{VR¸PS!'Q:Yø�uÓ" "

Î" "<module name="FlashChart" layoutPanel="results_area_1"> <param name="height">300px</param> <param name="width">100%</param>

°%¸YR;!·Z%!'Z" "

Ñb´51.3�GJ�0Ü{*7i3bÔ½.i°ÔÕ89� °%¸YR ��5�wi°4eÛÇÓÑbÔ½.i�G��ÿýþ()ÞÚÈ´G�üT£±³�()ÛÇÓ" "

°%¸YR;!·Z%!'Z ´51.3�J´µ°k>cÛÇÓ" "

"

-[­.n" "

fE" "

"! ø!\SR"G".{«" "

! ´51.3b6°ü�Ó" "

! -.£7iÛ��¶w£33Üü�89Ó" "

! ¾2GÑ)�ua;;÷u±��()G¥t89�mõ.mÚaøÚ±ÔÕcÛÇÓ" nnuK;;$Ðu�?bo°s

aÞ¶w£33°��ÇÈÑ�UÜ!ÛÇÓ" "

"! RZ!QRS"G".{«" "

! ´51.3b�(°ü�Ó" "

! -.£7iÛ��¶w£33Üü�89Ó" "

C9"

�¤�67" "

"! Yø�°!%Z"G" -m" "

! Yø�0b-m°��Ó" "

! -m�G$#Ù=p"ï:%<Z{YR¸PZ{Y$%&'({YZ¸PVR¯·PY$¸P(%Z{ZÐ$NYZ\{�%¸YR ±»Çȳ»-mÜ`ÈÑ�Ó" "

! Yø� �GâÊst()�ÚGùcd¬¨cGÑ)ÛÜ7jx()ÞÚ�ÚÃ+±ÕÐÑ�Ó" "

! )}~3i�uVR¸PS!'Q{ã!'{S!·Z%!'Z:Yø�uÓ" "

"! YS¸S&YÉ&V(ZSY"G"á3" "! )}~3iG"<;;" "

! `ÈÂKG<;; b)}~3i°Äj!cÛÇÓÑ)�G��°ýþæ±G4,wº7�ÿF�89�J

´4ÆÍbÁé3ÜÇÓo°úd��ÇÈ�G��n{oÿ*�Íd�AG#.$.±ÔÕ()È)*

�ûAÛÇÓ" "

Î" "<module name="FlashTimeline" layoutPanel="graph_area"> <param name="height">180px</param> <param name="width">100%</param>

#!·$%ZXZY&%SY;¸ã%Z" "

��bÂæ°Õ�GÒb4GÁ±²°ÔÖ×Ük>cÛÇÓ" "

-[­.n" "

fE" "

�cÓ" "

�¤�67" "

"! Z'S!SO"¸·Z"G"Z[Z'SY"i"PZY&%SY"i"¸&SN" "

! q1.2ÿ{*7iG±²GÛ��z~�k±ÜwÚÞ0{l[ob¹.�3°=>ÇÈ�?Ð�°ó

�ÛÇÓ" "

! )}~3i� ¸&SNäz~åÓ" "

"! \!Y$%¸OXNø"&·ãZPY"G"SP&Z"i"�¸%YZ" "

! SP&Z bÂKGþ3ÿG¹.�3bíþ±ÔÕ()ÛÇÓ" "

! )}~3i� N'ä�7åÓ" "

"! \!Y$%¸O<Z'&"G"SP&Z"i"�¸%YZ" "

! ¹.�3b£3±Gwx,wcÞÔÕ()È��Î7ib�+,¤r®7­01.°4�È�?Ð�°

¬ÄcÛÇÓ" "

! )}~3i� �¸%YZê4��ÚëÓ" "

"! \¸S¸%[ZP%¸O<N\Z"G"RZ¸S·¸$"i"R!QR%Nø"i"'N'Z" "

CK"

! )}~3i).n�.4v{´.�°GRZ¸S·¸$GR!QR%Nø ùÏú 'N'Z Üü�cÛÇÓ" "

! )}~3i� 'N'Zä�cåÓ" "

Î" "<module name="SimpleResultsTable" layoutPanel="results_area_1"/>

:!\\Z'MR¸PS°NP·¸SSZP" "

Ñb´51.3�GdVN%&·'dGd%!'ZdGd¸PZ¸dGÒb»(ÛÈÛ�Ô½.in{¤b²³±stÇȤ3r®7Üj>()ÞÚÛÇÓ! !

-[­.n" "

fE" "

�cÓ" "

�¤�67" "

"! VR¸PS"G"¸PZ¸"i"ã¸P"i"VN%&·'"i"%!'Z"i"$!Z"i"YV¸SSZP" "

! k>ÇÈÔ½.ib7t£n{¤°²³ÇÈ�!±stcÛÇÓ" "

"! VR¸PS:YS¸V(<N\Z"G"\Z�¸&%S"i"YS¸V(Z\"i"YS¸V(Z\a;;" "

! ü|[}ùÏú¦|[}°dYS¸V(Z\däýe�þå´.�ÜÔÕ(MÈ�!±stcÛÇÓ" "

"! VR¸PS:'&%%#¸%&Z<N\Z"G"VN''ZVS"i"Q¸$Y"i"¢ZPN" "

! d%!'ZdÔ½.iùÏúd¸PZ¸dÔ½.iÜG).n±ÿ½,¤ÿ`ÈÂKb»Ö��b¬Ä±stcÛÇÓ" "

! '&%%o°d;d�cÞ�ÐG!´ÿOëÈÛÛ±ÇÈGÛ��o°Ú´ÇÈbÚÁ)�ÿþëÛÇÓ" "

"! YZVN'\¸POWÐ!Y:YV¸%Z"G"d%NQd"i"äZ·$SO"YSP!'Qå" "! ÑLµmÆ.3°»3±ÇÈGÛ��"Ö±ÇÈ�bü�±stcÛÇÓ" "

"! %ZQZ'\:$%¸VZ·Z'S"G"P!QRS"i"ãNSSN·"i"%Z�S"i"SN$"i"'N'Z" "

! Ô½.izt�³»£�Ô½.imÎbJß²³±stcÛÇÓ" "

Î" "<module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="chartTitle">CPU performance in the past 24 hours</param>

õ.5f7i+.3" "

õ.5b{*7i°}~./,iÇÈ��b%ñ���ÜÇÓ" "

MN&'S" "

a õ.5`�Ab{*7i3Ó" "

'2?" Ù¸Q!'¸SNP ´51.3°_#cÞstÇÈÂKGÙ¸Q!'¸SNP �Gl®7i´51.3bäÆÜ��dÒkÜ`È

CE"

f`ÿ`AÛÇÓ" "

-[­.n" "

fE" "

"! N$S!N'Y"G" xmi" "

! @ Ýb�]bxmi?SZÐS ùÏú [¸%&ZGùÏú aÝb�¤�67�.?YZ%ZVSZ\Ó" "

! ;ZÐS"G" ÔÕÇȹ�miÓ" "

! #¸%&Z"G" þ3äá3åÓ" "

! �]ÿq1.b)}~3i����Èxmi�]�Çȱ�GYZ%ZVSZ\GSP&Z °��cÛÇÓ" "

�¤�67" "

�cÓ" "

Î" "<module name="Count" layoutPanel="page_controls"> <param name="switcherTitle">As List</param> <param name="options"> <list> <param name="text">10</param> <param name="value">10</param> </list> <list> <param name="text">20</param> <param name="selected">True</param> <param name="value">20</param> </list> <list> <param name="text">50</param> <param name="value">50</param> </list> </param>

<¸Ð=!'ZY" "

{*7iñbÁéþ3ÓÁéþ3°ü�ÇÈ��b�+,¤r®7°k>cÛÇÓ" "

-[­.n" "

fE" "

"! N$S!N'Y"G" xmi" "

! @ Ýb�]bxmi?SZÐS ùÏú [¸%&ZGùÏú aÝb�¤�67�.?YZ%ZVSZ\Ó" "

! ;ZÐS"G" ÔÕÇȹ�miÓ" "

! #¸%&Z"G" þ3äá3åÓ" "

! �]ÿq1.b)}~3i����Èxmi�]�Çȱ�Gselected=true°��cÛÇÓ" "

C©"

�¤�67" "

�cÓ" "

Î" " <module name="MaxLines" layoutPanel="page_controls"> <param name="options"> <list> <param name="text">5</param> <param name="selected">True</param> <param name="value">5</param> </list> <list> <param name="text">10</param> <param name="value">10</param> </list> <list> <param name="text">20</param> <param name="value">20</param> </list> <list> <param name="text">50</param> <param name="value">50</param> </list> <list> <param name="text">100</param> <param name="value">100</param> </list> <list> <param name="text">200</param> <param name="value">200</param> </list> <list> <param name="text">All</param> <param name="value">0</param> </list> </param>

Ù¸Q!'¸SNP" "

"

{*7i°õ.5±L-cGR_bx7w°).nbÌA±ÔÕcÛÇÓõ.5b���GfÁ��bdZ[Z'SYdÛ��dPZY&%SYdbÚÁ)�Ü��cÛÇÓ" "

'2?" Ù¸Q!'¸SNP °FÝ Z[Z'SY#!ZøZPäÎ?Z[Z'SY#!ZøZP � Ù¸Q!'¸SNP b�åbI±ßÚÞd�(ÚÓÒÐÜ�Ú�G{*7ib aõ.5]beÔÕ()ÛÇÓ" "

-[­.n" "

fE" "

"! Z'S!SO"¸·Z"G"Z[Z'SY"i"PZY&%SY"i"YZSS!'QY" "

CC"

! $¸Q!'¸SNP ÿ{*7i3GÁ±²G��/,¤b²³bÚÁ)�±ÜwÚÞx7w°jkÇû!�ó

�ÛÇÓ" "

! *dbÂKGÑ)�üHÜÇÿGf/7�²ï°®Ð��Ü�GÑ)Øb3�¾2B�AÛÇÓ" "

�¤�67" "

"! VN&'S"Gá3" "

! )}~3i� a;Ó" "

! a õ.5±ÔÕ()È{*7i{±²b3Ó" "

"! ·¸ÐÙ¸QZY"G"á3" "! )}~3i� a;Ó" "

! õ.5bÁé3Ó" "

Î" "<module name="Paginator" layoutPanel="page_controls"> <param name="count">100</param> <param name="entityName">results</param> <param name="switcherTitle">As Table</param> <param name="maxPages">10</param>

#ZQ·Z'S¸S!N'" "

{*7ib£|­7¹.�67n{¤°��cÛÇÓ" "

-[­.n" "

?$¸P¸·8N$S!N'YA"PZâ&!PZ\"G";P&Z"%¸ãZ%"G" " dSZÐSd�d[¸%&Zdb @ÝbfE�.°FÝ�]bxmiÓd[¸%&Zd�GP¸øG!''ZPGN&SZPG�&%% bÚÁ)�ÜÇÓ" "

fE" "

"! N$S!N'Y"G" xmi" "

! @ Ýb�]bxmi?SZÐS ùÏú [¸%&ZGùÏú aÝb�¤�67�.?YZ%ZVSZ\Ó" "

! ;ZÐS"G" ÔÕÇȹ�miÓ" "

! #¸%&Z"G" £|­7¹.�67boÜG!''ZPGN&SZPG�&%%GÛ�� P¸ø bÚÁ)�°ü�cÛÇÓ" "

! q1.b)}~3i£|­7¹.�67��Èxmi�]±Çȱ�Gselected=true°��cÛ

ÇÓ" "

�¤�67" "

"! YZQ·Z'S¸S!N'"G"!''ZP"i"N&SZP"i"�&%%"i"P¸ø" "

! �ì&ÿ`AF�ÇÈÓ" "

! xm07|cÞÚÈ´51.3±�+.��½miÇÈ��bG£|­7¹.�67bo°��cÛÇÓ" "

CA"

Î" "<module name="Segmentation"> <param name="options"> <list> <param name="text">inner</param> <param name="selected">True</param> <param name="value">inner</param> </list> <list> <param name="text">outer</param> <param name="value">outer</param> </list> <list> <param name="text">full</param> <param name="value">full</param> </list> <list> <param name="text">raw</param> <param name="value">raw</param> </list> </param>

#N�SâP¸$" "

{*7ibô.�[,¤°ËA`ëÈÔ�,w�,wm°ÔÕcÛÇÓ�}bÂKG{*7i¹�mi�GýÛb).n±$þÿ`ÈÂK±be%Ar()Gmw+.34.ÿf`±pHÞÔÕ()ÛÇÓ�7bÂKG{*7i¹�mi�G®{7�®b&ÜU%Ar()ÛÇÓ" "

-[­.n" "

fE" "

�cÓ" "

�¤�67" "

"! Z'¸ã%Z"G";P&Z"i"°¸%YZ" "

! )}~3iÜô.�[,¤°�7±ÇÈ��Ð�°ü�Ó" "

! )}~3i� ;P&Zä�7åÓ" "

Î" "<module name="SoftWrap"> <param name="switcherTitle">As List</param>

{7w3.�" "

^b´51.3°stcÞG®��x¯.m°q1.±��cÛÇÓ" "

A;"

#ZP[ZP#!\ZU'V%&\Z" "

lmnof7¹7Íb..4.hb{7w3.�°.g.icÛÇÓÛ�G<¸(N"äRSS$8{{øøø:·¸(NSZ·$%¸SZY:NPQ{°ª«å¹7¤v.iê�°.g.icÛÇÓ" "

'(?" #$%&'( b M##�»©��AÛMgÓM##°õ.5±��ÇÈÂK�GM##b»©uv°�.ÇÈGÛ��#$%&'( b)}~3iM##°Äj!cÛÇÓ" "

-[­.n" "

fE" "

"! YPV"G"pXU" "! ÔÕÇÈ'� RS·% }µ{3°ü�Ó" "

! Ñb}µ{3�GfÁÑb´51.3b YPV.�)uvwix±bccÛÇÓ" "

�¤�67" "

�cÓ" "

Î" "<module name="ServerSideInclude" layoutPanel="full_width_controls"> <param name="src">hello_world.html</param> </module>

U°P¸·ZU'V%&\Z" "

»b pX=�Øf7¹7Í°ÔÕÇÈ{7[{7}v.oä!�P¸·Zå°��cÛÇÓ" "

-[­.n" "

fE" "

"! YPV"G"pXU" "! U°P¸·Z b pX=°ü�Ó" "

�¤�67" "

"! VRZV(¯ZÐ!YSY"G"°¸%YZ"i";P&Z" "

! x´.i YPV Û��+.l3 YPV ÿ¡ôÇÈ�?Ð�°Ô�,wcÛÇÓ" "

! '2?" VRZV(¯ZÐ!YSY ÿ ;P&Z ±��()ÞÚÈÂK�G+.l3 W$$ b'�w}µ{3�m�,¤c

ÛÇÓ" "

! )}~3i� °¸%YZäÔ�,wÇÈåÓ" "

"! RZ!QRS"G"¸&SN"i"'&·ãZP"N�"$!ÐZ%Y" "! !�P¸·Z °¬¨ÇÈo¶w£33ä3oåÓ" "

Aa"

! x´.ibpXU �G�%&!\"RZ!QRS °�cdc9(MÈ��±G�Ë� >¸[¸#VP!$S b \NV&·Z'S:\N·¸!' �

�ÿf`ÜÇÓêRSS$8{{·Y\':·!VPNYN�S:VN·{Z'L&Y{%!ãP¸PO{VVaAEACAä##:CKå:¸Y$ÐùÏú

RSS$Y8{{\Z[Z%N$ZP:·N¢!%%¸:NPQ{Z'{!%<{\NV&·Z'S:\N·¸!'ª«bÑ�ë" "

! )}~3i� ¸&SNäz~��åÓ" "

Î" "<module name="IFrameInclude" layoutPanel="full_width_controls"> <param name="src">http://www.google.com</param> </module>

A@"

���i¶,w"

´51.3bjk" "

´51.3bjk" "

Ñb×��mn�ÜÇÓ" "

´51.3bjk�G#$%&'( b´51.3)uvwixÜ¥t89�ÇûÞb´51.3±ÝÚÞTòcÞ�ØþaÞd�(ÚÓ$#Ù=p"ï:%<Z{YR¸PZ{Y$%&'({YZ¸PVR¯·PY$¸P(%Z{·N\&%ZY{°ª«cÞd�(ÚÓ 51.3� >¸[¸#VP!$SùÏú :;<=�Øjk()ÞÚÛÇÓÒbæ±�í-[­.n±ÝÚÞßàÇÈ%ñ���}µ{3ÿ`AÛÇÓÛ�G´51.3� ÙOSRN' °4�ÈÑ�ÿÜ!ÛÇÓ´51.3b >¸[¸#VP!$S }µ{3�GÒb´51.3ÿ}v.oô.w7t�?bÏб³I=tÇÈ�°ÕcÞÚÛÇÓÝÛAG´51.3ÿstÇÈ-[­.nbèé�GÒb��0b�t��°ÕcÛÇä���³I=tÇÈÂKåÓ:;<=}µ{3�G´51.3°õ.5v{2®iÇÈ��°ü�cÛÇÓ" "

·¸(N ¹7¤v.ibjk" "

·¸(N ¹7¤v.ibjk" "

Ñb×��mn�ÜÇÓ" "

¹7¤v.i�G$#Ù=p"ï:%<Z{YR¸PZ{Y$%&'({YZ¸PVR¯·PY$¸P(%Z{SZ·$%¸SZY b¹7¤v.i)uvwix±��Ü!ÛÇÓ¹7¤v.i�G#$%&'("âZã bõ.5°v{2®iÇÈ��°ü�cÛÇÓ#$%&'(ST£w�67±ÝÚÞUü+ÜÇÓ¹7¤v.i� <¸(N ¹7¤v.i�m¹oÜjk()ÞÚÛÇÓ" "

#$%&'( r,�1�.�ºv­7i°»¼½¯}i®�2±¾�¿À" "

#$%&'( r,�1�.�ºv­7i°»¼½¯}i®�2±¾�¿À" "

#$%&'( ÿk>c�Ô½.in|[}°»b®��2¤xÆ.�67±¾�¿eÛÇÓóJ²Ü�G#$%&'( ��7|3.{7�7°ýOcÞÚÛMgÓc�ÿaÞG#$%&'( ±»ÇÈ.­�{7£�12+|{7°stÇÈf`ÿ`AÛÇÓ" "

'2?"õ.5±2w£mÇÈ��bÜUGõ.5¯.m°��ÇÈÑ�±ÏA#.$.)b°>ÈÑ�ÿÜ!ÛÇÓ" "

{7£�12+|{7°ÒÓ±ÇÈ" "

ÛÁ��±GøZã:VN'� Ü{7£�12+|{7°ÒÓ±cÛÇÓ^bmn7$°��cÛÇÓ" "

[settings] enable_insecure_login = true ...

A<"

Òb4G#$%&'( bæÿ~ÿf`ÜÇÓ" "

#$%&'( b��}µ{3bc9±ÝÚÞ¦cd�ÚÂK�GST�/0123b��}µ{3bi¶,w°ª«cÞd�(ÚÓ" "

#$%&'( Üq1.°=>ÇÈ" "

^±G»¼½2¤xÆ.�67±¾�¿À`q°4Àq1.z<=°=>cÛÇäÎ?|[}nÔ½.i�?åÓÑbq1.±�G��x z<=�stÜ!ÛMgÓfÁ�� z<=Ü×5cÞd�(ÚÓ" "

q1.bÎ" "

$#Ù=p"ï:%<Z{ZSV{¸$$Y{·O¯SZYS¯¸$${%NV¸%{\¸S¸{&!{[!ZøY{·O¯[!Zø:з% �Øbΰ��±ÕcÛÇÓ

<view template="dashboard.html"> <module name="StaticContentSample" layoutPanel="panel_row1_col1"> <param name="text">This is some sample static text.</param> </module> <module name="StaticContentSample" layoutPanel="panel_row1_col2"> <param name="text">This is some more sample static text.</param> </module> <module name="StaticContentSample" layoutPanel="panel_row2_col1"> <param name="text">This is even more sample static text.</param> </module> </view>

q1.±²³°�ë�ÂK�G^bpXU °+.�cÞÒbq1.°x}v,�1Þd�(ÚÓ" "

RSS$Y8{{·ORNYS:VN·8C;CA{YZP[!VZY"#{·O&YZP{YZ¸PVR{\¸S¸{&!{[!ZøY*PZ�PZYRGa" "

üH#.$.Üx}v,�1ÇÈf`�`AÛMgÓÒÓ�#.$.Ü`)ìbÜU89ÜÇÓ" "

zLb.{i± !�P¸·Z °=>ÇÈ" "

Á4±G..�-.¹u2¤xÆ.�67°��ÇÈ !�P¸·Z °^b{!'YZV&PZ%NQ!' º7�g{7i±ÏA=>cÛÇÓ" "

http://splunkserver:8000/account/insecurelogin?username=admin&password=changeme&return_to=/app/foo/myview

+PZS&P'¯SN,-[­.nbo�pXU °ºmÆ.¤cÞd�(ÚäRSS$8{{·ZOZPøZã:VN·{ZP!V{SNN%Y{\Z'VN\ZP{åÓ"=>c�:;<=õ.5�G!�P¸·Z `qXÜÒbq1.°k>cÛÇÓ" "

:;<=bÎ" "

!�P¸·Z � RS·% ±��ÇÈΰ^±ÕcÛÇÓ" "

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Splunk Stuff</title> </head> <body> <!-- content starts here --> <h1>Hey Look At My Pretty Pictures!</h1>

A9"

<iframe src ="http://myhost:8000/account/insecurelogin?username=test_user&password=changeme&return_to=%2Fapp%2Fmy_test_app%2Fmy_view" width="100%" height="300"> <p>Your browser does not support iframes.</p> </iframe> <!-- content ends here --> </body> </html>

AK"

ÁÂÃÄÅ"

W$$ °-,Æ.5±ÇÈ"

W$$ °-,Æ.5±ÇÈ"

Ñb×��mn�ÜÇÓ"

��c�ÇûÞbf7g.h7iÿG$SPLUNK_HOME/etc/apps/<your_App>/default/±`È W$$ b)}~3i)uvwix±`ÈÑ�°�.cÛÇÓW$$ã&!%\ZP mwx¤i°stcÞÚÈÂK�GW$$ ���)}~3iÛ��+.l3bÚÁ)�±`AÛÇÓ"

#$%&'("ɸYZ bÊË"

#$%&'("ɸYZ bÊË"

Ñb×��mn�ÜÇÓ"

W$$ bjkÿÂæÇÈ�G#$%&'("ɸYZ ÜÊËÇÈÑ�ÿÜ!ÛÇÓ"

AE"

ÌÍÎ"

ÌÍÎ" "

ÌÍÎ" "

Ñb£w�67�Gr,�1�.�G}~.o��GÒb»bq1.bÌÍΰ×ØcÞÚÛÇÓ" "

r,�1�.�bÎ" "

r,�1�.�bÎ" "

Ñb£w�67�(ÛÈÛ�r,�1�.���bΰÚdÝ�×ØcÛÇÓ" "

Î a" "<view template="dashboard.html"> <label>Advanced Dashboards - Intro</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="ServerSideInclude" layoutPanel="panel_row1_col1"> <param name="src">advanced_dashboard1.html</param> </module> <module name="StaticContentSample" layoutPanel="panel_row2_col1"> <param name="text">This is a basic example using HiddenSavedSearch + HiddenChartFormatter + FlashChart to show a flash chart from a saved search.</param> </module> <module name="HiddenSearch" layoutPanel="panel_row2_col1" group="Charting the results of a saved search" autoRun="True"> <param name="search">index=_internal source=*metrics.log Component=metrics group=per_sourcetype_thruput | chart sum(kb) by series | sort sum(kb) desc | head 10</param> <param name="earliest">-1h</param> <module name="HiddenChartFormatter"> <param name="chart">bar</param> <param name="primaryAxisTitle.text">Sourcetype</param> <param name="secondaryAxisTitle.text">KB Indexed</param> <param name="legend.placement">none</param> <module name="JobProgressIndicator"/> <module name="FlashChart"> <param name="width">100%</param> <param name="height">300px</param> </module>

A©"

</module> </module> <module name="StaticContentSample" layoutPanel="panel_row2_col2" group="Allowing the user to change the time range"> <param name="text">This example uses HiddenSearch instead of HiddenSavedSearch, and includes a TimeRangePicker module to allow the user to change the time range.</param> </module> <module name="TimeRangePicker" layoutPanel="panel_row2_col2"> <param name="searchWhenChanged">True</param> <param name="selected">All time</param> <module name="HiddenSearch" autoRun="True"> <param name="search">| dbinspect bins=400</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="primaryAxisTitle.text">Time</param> <param name="chartTitle">Distribution of index buckets over time</param> <module name="JobProgressIndicator"/> <module name="FlashChart"/> </module> </module> </module> <module name="StaticContentSample" layoutPanel="panel_row3_col1"> <param name="text">This example redirects the user to see the same graph in the charting view using a simple module called ViewRedirectorLink.</param> </module> <module name="HiddenSearch" layoutPanel="panel_row3_col1" group="Simple Redirects - 1" autoRun="True"> <param name="search">index=_internal source=*metrics.log Component=metrics group=per_sourcetype_thruput | timechart sum(kb)</param> <param name="earliest">-1h</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="primaryAxisTitle.text">time</param> <param name="secondaryAxisTitle.text">KB Indexed</param> <param name="legend.placement">right</param> <module name="JobProgressIndicator"/> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> </module> <module name="ViewRedirectorLink" layoutPanel="panel_row3_col1"> <param name="viewTarget">charting</param> <param name="label">Redirect 1</param> </module> </module> </module> <module name="StaticContentSample" layoutPanel="panel_row3_col2"> <param name="text">This example redirects the user to see the same graph in the charting view using a pair of modules, SubmitButton + ViewRedirector. Just for fun we added a TimeRangePicker above the SubmitButton which allows the user to change the timerange before the redirect.</param> </module> <module name="HiddenSearch" layoutPanel="panel_row3_col2" group="Simple Redirects - 2" autoRun="True"> <param name="search">index=_internal source=*metrics.log Component=metrics group=per_sourcetype_thruput | timechart sum(kb)</param> <param name="earliest">-1h</param>

AC"

<module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="primaryAxisTitle.text">time</param> <param name="secondaryAxisTitle.text">KB Indexed</param> <param name="legend.placement">right</param> <module name="JobProgressIndicator"/> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> </module> <module name="TimeRangePicker"> <param name="searchWhenChanged">True</param> <param name="selected">Today</param> <module name="SubmitButton"> <param name="label">Redirect 2</param> <module name="ViewRedirector"> <param name="viewTarget">charting</param> </module> </module> </module> </module> </module> <module name="ServerSideInclude" layoutPanel="panel_row4_col1"> <param name="src">advanced_dashboard1_summary.html</param> </module> </view>

Î @" "<view template="dashboard.html"> <label>Advanced Dashboards - Drilldown patterns</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="StaticContentSample" layoutPanel="panel_row1_col1"> <param name="text">These examples demonstrate a few 'drilldown' patterns for dashboards that are particularly useful. There is an enormous range of possible configurations and these are only a couple examples.</param> </module> <module name="StaticContentSample" layoutPanel="panel_row2_col1"> <param name="text">This simple example uses a complex SearchSelectLister that generates the 10 sourcetypes with the most data indexed in the last hour. The user can then pick one and then we redirect them to flashtimeline and run a search for just the events from that sourcetype, this time over the past 2 hours. </param> </module> <!-- our base search will just be "*", over the past 2 hours --> <module name="HiddenSearch" layoutPanel="panel_row2_col1" group="Drilldowns - 1" autoRun="True"> <param name="search">*</param>

AA"

<param name="earliest">-2h</param> <module name="SearchSelectLister"> <param name="settingToCreate">series_setting</param> <param name="search">index=_internal metrics NOT source="*web_service.log" NOT source="*access.log" NOT source="*/searches.log" NOT source="*intentions.log" NOT source="*splunkd.log" group="per_sourcetype_thruput" | chart sum(kb) over series | sort sum(kb) desc | head 10 | sort series</param> <param name="earliest">-1h</param> <param name="label">source</param> <param name="searchWhenChanged">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">series</param> <param name="value">series</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">series_setting</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="sourcetype">$target$</param> </param> </param> <module name="SubmitButton"> <param name="label">Drilldown 1</param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> <module name="StaticContentSample" layoutPanel="panel_row2_col2"> <param name="text">This example is the same except instead of SearchSelectLister we use SearchLinkLister and ViewRedirector. The takeaway is that the listers are all interchangeable. ie if you'd rather have radio buttons just use SearchRadioLister.</param> </module> <module name="HiddenSearch" layoutPanel="panel_row2_col2" group="Drilldowns - 2" > <param name="search">*</param> <param name="earliest">-2h</param> <module name="SearchLinkLister"> <param name="settingToCreate">series_setting</param> <param name="search">index=_internal metrics NOT source="*web_service.log" NOT source="*access.log" NOT source="*/searches.log" NOT source="*intentions.log" NOT source="*splunkd.log" | chart sum(kb) over series | sort sum(kb) desc | head 10 | sort series</param> <param name="earliest">-1h</param> <param name="searchWhenChanged">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">series</param> <param name="value">series</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">series_setting</param> <param name="intention"> <param name="name">addterm</param>

a;;"

<param name="arg"> <param name="sourcetype">$target$</param> </param> </param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> <module name="StaticContentSample" layoutPanel="panel_row3_col1"> <param name="text"> This example uses a SearchSelectLister to give the list of indexes. Then a second SearchSelectLister generates a link for each sourcetype within the chosen index. </param> </module> <module name="StaticContentSample" layoutPanel="panel_row3_col1"> <param name="text"> Then when the user chooses a sourcetype from the second pulldown we will construct a third search for index="foo" sourcetype="bar". When the user clicks the SubmitButton module this search will travel down, hit a module called ViewRedirector, and off the user goes. </param> </module> <module name="StaticContentSample" layoutPanel="panel_row3_col1"> <param name="text"> Just for fun we also have configured the ViewRedirector module to launch a popup window, and instead of flashtimeline we use a simple stripped down view that we made just for this app. </param> </module> <module name="SearchSelectLister" layoutPanel="panel_row3_col1" group="Drilldowns - 3"> <param name="label">which index</param> <param name="settingToCreate">index_setting</param> <param name="search">| eventcount summarize=false index=* | search index!="splunklogger" index!="summary" index!="history" | sort index desc</param> <param name="searchWhenChanged">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">index</param> <param name="value">index</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">index_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="index"> <param name="fillOnEmpty">True</param> <param name="prefix">index=</param> <param name="value">$target$</param> </param> </param> </param> <module name="SearchSelectLister"> <param name="label">Sourcetype</param> <param name="settingToCreate">sourcetype_setting</param> <param name="search">| metadata type="sourcetypes" $index$</param>

a;a"

<param name="applyOuterIntentionsToInternalSearch">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">sourcetype</param> <param name="value">sourcetype</param> </list> </param> <module name="HiddenSearch"> <param name="search">$index$ $sourcetype$</param> <module name="ConvertToIntention"> <param name="settingToConvert">sourcetype_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="sourcetype"> <param name="fillOnEmpty">True</param> <param name="prefix">sourcetype=</param> <param name="value">$target$</param> </param> </param> </param> <module name="SubmitButton"> <param name="label">Search</param> <module name="ViewRedirector"> <param name="viewTarget">really_simple_viewer</param> <param name="popup">True</param> </module> </module> </module> </module> </module> </module> </module> <module name="StaticContentSample" layoutPanel="panel_row3_col2"> <param name="text">very similar except that the second is a SearchLinkLister. Beware that prior to 4.0.3 there is a bug in this configuration.(SPL-25464).</param> </module> <module name="SearchSelectLister" layoutPanel="panel_row3_col2" group="Drilldowns - 4"> <param name="label">which index</param> <param name="settingToCreate">index_setting</param> <param name="search">| eventcount summarize=false index=* | search index!="splunklogger" index!="summary" index!="history" | sort index desc</param> <param name="searchWhenChanged">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">index</param> <param name="value">index</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">index_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="index"> <param name="fillOnEmpty">True</param> <param name="prefix">index=</param> <param name="value">$target$</param>

a;@"

</param> </param> </param> <module name="SearchLinkLister"> <param name="settingToCreate">sourcetype_setting</param> <param name="search">| metadata type="sourcetypes" $index$</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">sourcetype</param> <param name="value">sourcetype</param> </list> </param> <module name="HiddenSearch"> <param name="search">$index$ $sourcetype$</param> <module name="ConvertToIntention"> <param name="settingToConvert">sourcetype_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="sourcetype"> <param name="fillOnEmpty">True</param> <param name="prefix">sourcetype=</param> <param name="value">$target$</param> </param> </param> </param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> <module name="StaticContentSample" layoutPanel="panel_row4_col1"> <param name="text">Now we take a bunch of leaps ahead and put it all together. We put in a Sorter module, a Paginator module. We put in a HiddenSearch+SimpleResultsHeader pattern to give us 'Sources (208)'. Then we duplicate the same pattern for both Sourcetypes and Hosts. (NOTE: prior to 4.0.3 a bug will make this configuration not work, specifically because of the presence of the Paginator. SPL-25516)</param> </module> <module name="SearchSelectLister" layoutPanel="panel_row4_col1" group="Drilldowns - 5"> <param name="label">which index</param> <param name="settingToCreate">index_setting</param> <param name="search">| eventcount summarize=false index=* | search index!="splunklogger" index!="summary" index!="history" | sort index desc</param> <param name="searchWhenChanged">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">index</param> <param name="value">index</param> </list> </param>

a;<"

<!-- Here is where we take the generic setting value outputted by the SearchSelectLister, and we turn that into an intention. Ultimately this one intention will be consumed in 6 different places. We will use the combination of HiddenSearch + SimpleResultsHeader in the first 3 child-branches to generate the 'Sourcetypes (14)' headers. Then we will have 3 SearchLinkLister modules configured with applyOuterIntentionsToInternalSearch="True" --> <module name="ConvertToIntention"> <param name="settingToConvert">index_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="index"> <param name="fillOnEmpty">True</param> <param name="prefix">index=</param> <param name="value">$target$</param> </param> </param> </param> <module name="HiddenSearch"> <param name="search">| metadata type=sources $index$</param> <module name="SimpleResultsHeader" layoutPanel="panel_row4_col1_grp1"> <param name="entityName">results</param> <param name="headerFormat">Sources (%(count)s)</param> </module> </module> <module name="HiddenSearch"> <param name="search">| metadata type=sourcetypes $index$</param> <module name="SimpleResultsHeader" layoutPanel="panel_row4_col1_grp2"> <param name="entityName">results</param> <param name="headerFormat">Sourcetypes (%(count)s)</param> </module> </module> <module name="HiddenSearch"> <param name="search">| metadata type=hosts $index$</param> <module name="SimpleResultsHeader" layoutPanel="panel_row4_col1_grp3"> <param name="entityName">results</param> <param name="headerFormat">Hosts (%(count)s)</param> </module> </module> <!-- from here on inward, it's all just dealing with sources. We put each of these 3 branches in its own grp layoutPanel so that they will all float alongside eachother within the same panel. --> <module name="Sorter" layoutPanel="panel_row4_col1_grp1"> <param name="sortKey">totalCount</param> <param name="sortDir">desc</param> <param name="fields"> <list> <param name="label">Source</param> <param name="value">source</param> </list> <list> <param name="label">Total Count</param> <param name="value">totalCount</param> </list>

a;9"

<list> <param name="label">First Time</param> <param name="value">firstTime</param> </list> </param> <module name="Paginator"> <param name="count">10</param> <param name="entityName">settings</param> <param name="maxPages">10</param> <!-- the module that generates the blue links. Note that it although it configures its own internal search, it has a flag that allows it to apply intentions from the main context, to its internal search. --> <module name="SearchLinkLister"> <param name="settingToCreate">list1</param> <param name="search">| metadata type=sources $index$</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">source</param> <param name="value">source</param> </list> <list> <param name="label">totalCount</param> <param name="labelFormat">number</param> </list> </param> <!-- Further upstream we used ConvertToIntention to make a stringreplace intention for a metadata search. Here we use it again, this time to convert the same setting to a simpler addterm intention. (the first intention will have been consumed by the searchSelectLister, but the setting will still be there ) --> <module name="ConvertToIntention"> <param name="settingToConvert">index_setting</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="index">$target$</param> </param> </param> <!-- This takes some getting used to, but here is where we take the setting generated by the SearchLinkLister when the user clicks a link, and convert that into an intention. --> <module name="ConvertToIntention"> <param name="settingToConvert">list1</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="source">$target$</param> </param> </param> <!-- And finally, whenever any context information hits this ViewRedirector we will instantly redirect. because of the internals of 'SearchLinkLister', nothing will arrive here until the moment of the user clicking the blue link --> <module name="ViewRedirector">

a;K"

<param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> <!-- from here on inward, it's all just dealing with sourcetypes --> <module name="Sorter" layoutPanel="panel_row4_col1_grp2"> <param name="sortKey">totalCount</param> <param name="sortDir">desc</param> <param name="fields"> <list> <param name="label">Sourcetype</param> <param name="value">sourcetype</param> </list> <list> <param name="label">Total Count</param> <param name="value">totalCount</param> </list> <list> <param name="label">First Time</param> <param name="value">firstTime</param> </list> </param> <module name="Paginator"> <param name="count">10</param> <param name="entityName">settings</param> <param name="maxPages">10</param> <!-- the module that generates the blue links. Note that it although it configures its own internal search, it has a flag that allows it to apply intentions from the main context, to its internal search. --> <module name="SearchLinkLister"> <param name="settingToCreate">list1</param> <param name="search">| metadata type=sourcetypes $index$</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">sourcetype</param> <param name="value">sourcetype</param> </list> <list> <param name="label">totalCount</param> <param name="labelFormat">number</param> </list> </param> <!-- Further upstream we used ConvertToIntention to make a stringreplace intention for a metadata search. Here we use it again, this time to convert the same setting to a simpler addterm intention. (the first intention will have been consumed by the searchSelectLister, but the setting will still be there ) --> <module name="ConvertToIntention"> <param name="settingToConvert">index_setting</param> <param name="intention"> <param name="name">addterm</param> <param name="arg">

a;E"

<param name="index">$target$</param> </param> </param> <!-- This takes some getting used to, but here is where we take the setting generated by the SearchLinkLister when the user clicks a link, and convert that into an intention. --> <module name="ConvertToIntention"> <param name="settingToConvert">list1</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="sourcetype">$target$</param> </param> </param> <!-- And finally, whenever any context information hits this ViewRedirector we will instantly redirect. because of the internals of 'SearchLinkLister', nothing will arrive here until the moment of the user clicking the blue link --> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> <!-- from here on inward, it's all just dealing with hosts --> <module name="Sorter" layoutPanel="panel_row4_col1_grp3"> <param name="sortKey">totalCount</param> <param name="sortDir">desc</param> <param name="fields"> <list> <param name="label">Host</param> <param name="value">host</param> </list> <list> <param name="label">Total Count</param> <param name="value">totalCount</param> </list> <list> <param name="label">First Time</param> <param name="value">firstTime</param> </list> </param> <module name="Paginator"> <param name="count">10</param> <param name="entityName">settings</param> <param name="maxPages">10</param> <!-- the module that generates the blue links. Note that it although it configures its own internal search, it has a flag that allows it to apply intentions from the main context, to its internal search. --> <module name="SearchLinkLister"> <param name="settingToCreate">list1</param> <param name="search">| metadata type=hosts $index$</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="searchFieldsToDisplay">

a;©"

<list> <param name="label">host</param> <param name="value">host</param> </list> <list> <param name="label">totalCount</param> <param name="labelFormat">number</param> </list> </param> <!-- Further upstream we used ConvertToIntention to make a stringreplace intention for a metadata search. Here we use it again, this time to convert the same setting to a simpler addterm intention. (the first intention will have been consumed by the searchSelectLister, but the setting will still be there ) --> <module name="ConvertToIntention"> <param name="settingToConvert">index_setting</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="index">$target$</param> </param> </param> <!-- This takes some getting used to, but here is where we take the setting generated by the SearchLinkLister when the user clicks a link, and convert that into an intention. --> <module name="ConvertToIntention"> <param name="settingToConvert">list1</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="host">$target$</param> </param> </param> <!-- And finally, whenever any context information hits this ViewRedirector we will instantly redirect. because of the internals of 'SearchLinkLister', nothing will arrive here until the moment of the user clicking the blue link --> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> </module> </module> <module name="ServerSideInclude" layoutPanel="panel_row5_col1"> <param name="src">advanced_dashboard2_summary.html</param> </module> </view>

a;C"

}~.o��bÎ"

}~.o��bÎ"

Î a" "<view onunloadCancelJobs="False" autoCancelInterval="100"> <!-- autoCancelInterval is set here to 100 --> <label>Advanced Form Search - 1</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="HiddenSearch" layoutPanel="mainSearchControls" autoRun="True"> <param name="search">index=_internal metrics</param> <module name="StaticSelect"> <param name="settingToCreate">group</param> <param name="label">field:</param> <param name="staticFieldsToDisplay"> <list> <param name="label">Index</param> <param name="value">per_index_thruput</param> </list> <list> <param name="label">Source</param> <param name="value">per_source_thruput</param> </list> <list> <param name="label">Sourcetype</param> <param name="value">per_sourcetype_thruput</param> </list> <list> <param name="label">Host</param> <param name="value">per_host_thruput</param> </list> </param> <!-- just for this module we need to render him into 'mainSearchControls' or else he'll take up an odd space in 'splSearchControls-inline' --> <module name="ConvertToIntention"> <param name="settingToConvert">group</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="group">$target$</param> </param> </param> <!-- and then in the very next module we return to putting modules into 'splSearchControls-inline' -->

a;A"

<module name="SearchSelectLister"> <param name="settingToCreate">series_setting</param> <param name="label">value:</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="search">index=_internal source="*metrics.log" metrics group series | head 5000 | top limit=200 series | sort series</param> <param name="searchFieldsToDisplay"> <list> <param name="label">series</param> <param name="value">series</param> </list> </param> <module name="TimeRangePicker"> <!-- <param name="label">time range:</param> --> <param name="selected">Last 4 hours</param> <param name="searchWhenChanged">True</param> <module name="SubmitButton"> <param name="allowSoftSubmit">False</param> <param name="label">Search</param> <module name="ConvertToIntention"> <param name="settingToConvert">series_setting</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="series">$target$</param> </param> </param> <module name="Message" layoutPanel="graphArea"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">2</param> <module name="StaticContentSample" layoutPanel="resultsAreaLeft"> <param name="text">Now we use a HiddenSearch module to reset the base search string to be a timechart of sum(kb). However because HiddenSearch is downstream of the SubmitButton module, it will still pick up all the stuff the user picked above. We also use a HiddenChartFormatter here to give us a column chart, suppress the legend and specify the correct axis titles.</param> </module> <module name="HiddenSearch" layoutPanel="resultsAreaLeft"> <param name="search">index=_internal metrics NOT source="*web_service.log" NOT source="*access.log" NOT source="*/searches.log" NOT source="*intentions.log" NOT source="*splunkd.log" | timechart sum(kb)</param> <module name="HiddenChartFormatter"> <param name="chart">column</param> <param name="primaryAxisTitle.text">(Selected Series)</param> <param name="secondaryAxisTitle.text">KB Indexed</param> <param name="legend.placement">none</param> <module name="JobProgressIndicator"/> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> </module> </module> </module>

aa;"

<module name="StaticContentSample" layoutPanel="resultsAreaLeft"> <param name="text">Here we do the same thing, also living directly underneath the SubmitButton module, but instead we reset everything to show the max(eps), min(eps) and avg(eps) over time.</param> </module> <module name="HiddenSearch" layoutPanel="resultsAreaLeft"> <param name="search">index=_internal metrics NOT source="*web_service.log" NOT source="*access.log" NOT source="*/searches.log" NOT source="*intentions.log" NOT source="*splunkd.log" | timechart min(eps) avg(eps) max(eps)</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="primaryAxisTitle.text">(Selected Series)</param> <param name="secondaryAxisTitle.text">event throughput</param> <param name="legend.placement">bottom</param> <module name="JobProgressIndicator"/> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </view>

Î @" "<view template="dashboard.html"> <label>Advanced Form Search - 2</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="SearchSelectLister" layoutPanel="panel_row1_col1" group="Chose group and series to view sum(kb), avg(kbps), median(eps), max(eps) and min(eps)"> <param name="settingToCreate">group_setting</param> <param name="search">index=_internal source=*metrics.log Component=metrics group group="*" series="*" | stats count by group</param> <param name="earliest">-6h</param> <param name="label">Groups</param> <param name="searchFieldsToDisplay"> <list> <param name="label">group</param> <param name="value">group</param> </list> </param>

aaa"

<module name="ConvertToIntention"> <param name="settingToConvert">group_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="group"> <param name="value">$target$</param> </param> </param> </param> <!-- Series selector --> <module name="SearchSelectLister"> <param name="settingToCreate">series_setting</param> <param name="search">index=_internal source=*metrics.log Component=metrics group=$group$ | stats count by series</param> <param name="earliest">-6h</param> <param name="label">Series based on selected group</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">series</param> <param name="value">series</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">series_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="series"> <param name="value">$target$</param> </param> </param> </param> <module name="SubmitButton"> <param name="label">Search</param> <!-- Chart for: index=_internal metrics NOT sendout group=<group> series=<series> | timechart sum(kb) --> <module name="HiddenSearch"> <param name="search">index=_internal source=*metrics.log Component=metrics group=$group$ series=$series$ | timechart sum(kb)</param> <param name="earliest">-6h</param> <module name="HiddenChartFormatter"> <param name="chart">column</param> <param name="chart.stackMode">stacked</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">sum(kb)</param> <param name="legend.placement">None</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> </module> </module> </module> <!-- Chart for: index=_internal metrics NOT sendout group=<group> series=<series> | timechart sum(kb) --> <module name="HiddenSearch">

aa@"

<param name="search">index=_internal source=*metrics.log Component=metrics group=$group$ series=$series$ | timechart avg(kbps)</param> <param name="earliest">-6h</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="chart.stackMode">stacked</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">avg(kbps)</param> <param name="legend.placement">None</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> </module> </module> </module> <!-- Chart for: index=_internal metrics NOT sendout group=<group> series=<series> | timechart sum(kb) --> <module name="HiddenSearch"> <param name="search">index=_internal source=*metrics.log Component=metrics group=$group$ series=$series$ | timechart median(eps) max(eps) min(eps)</param> <param name="earliest">-6h</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="chart.stackMode">stacked</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">median(eps) max(eps) min(eps)</param> <param name="legend.placement">None</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> </module> </module> </module> </module> </module> </module> </module> </module> <module name="SearchSelectLister" layoutPanel="panel_row1_col2" group="Search for cpu intensive processors in the last 24 hours."> <param name="settingToCreate">name_setting</param> <param name="search">index=_internal source=*metrics.log Component=metrics group=pipeline | stats sum(cpu_seconds) as totalCPU by name | where totalCPU > 0 | sort -totalCPU</param> <param name="earliest">-1d</param> <param name="label">Name</param> <param name="searchFieldsToDisplay"> <list> <param name="label">name</param> <param name="value">name</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">name_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="name">

aa<"

<param name="value">$target$</param> </param> </param> </param> <!-- Add the processor --> <module name="SearchSelectLister"> <param name="settingToCreate">processor_setting</param> <param name="search">index=_internal source=*metrics.log Component=metrics group=pipeline name=$name$ | stats sum(cpu_seconds) as totalCPU by processor | where totalCPU > 0 | sort -totalCPU</param> <param name="earliest">-1d</param> <param name="label">Processor</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">processor</param> <param name="value">processor</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">processor_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="processor"> <param name="value">$target$</param> </param> </param> </param> <module name="SubmitButton"> <param name="label">Search</param> <!-- Chart for: showing the sum cpu_seconds for a given name and processor --> <module name="HiddenSearch"> <param name="search">index=_internal source=*metrics.log Component=metrics group=pipeline name=$name$ processor=$processor$ | timechart sum(cpu_seconds) </param> <param name="earliest">-1d</param> <module name="HiddenChartFormatter"> <param name="chart">column</param> <param name="chart.stackMode">stacked</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">sum(kb)</param> <param name="legend.placement">None</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> </module> </module> </module> </module> </module> </module> </module> </module> </view>