Annotating adds a new annotate field to an event and sets a custom value or note as the value. Flagging an event simply sets the annotate field as 'flag'.
When performing an annotation, you MUST wait for the search job to finish. Or else, Annotate cannot access the search ID to find the event.
You can remove/disable workflow actions from Settings->Fields->Workflow Actions. If you don't think you will ever need an action, just disable it.
The dashboards have been left in XML, which means you can still edit them using Splunk's Dashboard Editor. You can add panels and inputs to any of the dashboards.
allows subset searching for annotations
first release
made dashboard searches faster for annotations
added timecharts to dashboards
added time range to dashboards
added blank csv file to fix file error
Beta Release: #1
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.