- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @chrisyoungerjds ,
When running a dashboard search for Flow Map Viz the not all icons in the lookup seem load fast enough and some icons revert to the default square.
Is there a way to ensure all icons load successfully or is this a limitation of the app
Kind regards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi @nathanluke86
Apologies for the delay in responding, I have been on holidays. Your query looks fine, and there is no problem with using tokens/dropdowns. The only thought I have is that the icons failing to load might happen becuase Splunk takes a bit of extra time to do the subsearch (the append). Lucky there may be a simple fix for this, try replacing teh last line with this instead:
|inputlookup append=t path.csv
so your whole query would look like this
index = iis dest_host=$dest$ src_host_name=$src$ status=*
| chart useother=false usenull=false count over src_host_name by status
| streamstats count as tmp
| untable tmp status count
| stats sum(eval(if(like(status,"2%"),count,0))) as good,
,sum(eval(if(like(status,"4%"),count,0))) as error, ,sum(eval(if(like(status,"3%"),count,0))) as warn
,values(eval(if(status=="src_host_name",count,NULL))) as src_host_name by tmp
| eval from=src_host_name , to="dest_host"
| fields from to error warn good
|inputlookup append=t path.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi @nathanluke86
Apologies for the delay in responding, I have been on holidays. Your query looks fine, and there is no problem with using tokens/dropdowns. The only thought I have is that the icons failing to load might happen becuase Splunk takes a bit of extra time to do the subsearch (the append). Lucky there may be a simple fix for this, try replacing teh last line with this instead:
|inputlookup append=t path.csv
so your whole query would look like this
index = iis dest_host=$dest$ src_host_name=$src$ status=*
| chart useother=false usenull=false count over src_host_name by status
| streamstats count as tmp
| untable tmp status count
| stats sum(eval(if(like(status,"2%"),count,0))) as good,
,sum(eval(if(like(status,"4%"),count,0))) as error, ,sum(eval(if(like(status,"3%"),count,0))) as warn
,values(eval(if(status=="src_host_name",count,NULL))) as src_host_name by tmp
| eval from=src_host_name , to="dest_host"
| fields from to error warn good
|inputlookup append=t path.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @chrisyoungerjds,
This seems to have resolved this issue.
Thanks for being so supportive.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

good stuff. glad its sorted
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

No this should not occur but I do believe you becuase a while back I had a similar problem. I think what might be happening is that you might have multiple "node" rows, or late arriving "node" rows in your data. Its a big hard to explain but if you are able to share your search query I can help further
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @chrisyoungerjds
index = iis dest_host=$dest$ src_host_name=$src$ status=*
| chart useother=false usenull=false count over src_host_name by status
| streamstats count as tmp
| untable tmp status count
| stats sum(eval(if(like(status,"2%"),count,0))) as good,
,sum(eval(if(like(status,"4%"),count,0))) as error, ,sum(eval(if(like(status,"3%"),count,0))) as warn
,values(eval(if(status=="src_host_name",count,NULL))) as src_host_name by tmp
| eval from=src_host_name , to="dest_host"
| fields from to error warn good
|append [| inputlookup path.csv]
Could this be caused by the drop down menus I am using for src and dest host.
I'm loving this app by the way.
