I have value in field: value: 10,5 CC,00136;CY,00004;JE,00004;QK,00004 Where  CC,CY,JE - type message and there are more of them than in example 00136,00004 - number of message But I need to get table: Type Count CC 136 CY 4 JE 4   How can i do it with SPL language?

How to set the width of the bar chart panel ? For example  if huge data comes the horizontal slider moves left to right and if less data occurs scroll bar will be hidden based on the drilldown "CASE" condition we need to check (Multi-Value Dropdown) please help me with the solution ,Thanks in Advance 

How to set the width of the bar chart panel ? for example  if huge comes comes the horizontal slider moves left to right and if less data occurs scroll bar will be hidden please help me with the solution ,Thanks in Advance 

Hi Splunk team,  When I used Splunk to search the log data and found it didn't split correctly, It displayed as below: The two data have been combined together, Can anyone has some suggestions do this situation? appreciate it.

We are currently using "Microsoft Office 365 Reporting Add-on for Splunk" in Splunk Cloud. https://splunkbase.splunk.com/app/3720/ According to the "Upgrade Readiness App", this Add-on does not support jQuery 3.5 yet. Does anyone know if there is a plan to support it? Or are there any other Add-ons that can retrieve o365 email logs? Thank you.

I have an SHC and I am using an SHC Deployer to deploy apps to it. Those apps include Splunk ES which is very large. The latest 7.0.0 update for ES may be so large that it causes errors when I apply the cluster bundle. I have tried increasing max_content_length in [httpServer] in server.conf, this did not work. What configs can I change to increase this limit so I can use my SHC Deployer? It seems odd that I can't deploy an unmodified ES installation according to the documentation because it's beyond Splunk's limits.      splunk apply shcluster-bundle -target xxx -auth xxx Error while deploying apps to target=xxx with members=x: Error while updating app=Splunk_SA_Scientific_Python_Linux_x86_64 on target=xxx: Non-200/201 status_code=413; {"messages":[{"type":"ERROR","text":"Content-Length of 2147484959 too large (maximum is 2147483648)"}]},...repeated for each member        

Hi all, I installed the Splunk CIM on my Splunk instance and I've a doubt regarding tags whitelisting. The docs says that (https://docs.splunk.com/Documentation/Splunk/8.2.4/Knowledge/Designdatamodelobjects This means that the tags whitelist configuration in Splunk CIM settings must have at least tags used within the constraints used in the specific datamodel. Let's do an example with Authentication datamodel. This is the default tags whitelist configuration after installing the app: And this is the root dataset constraint: How you can see, the tag authentication used as root constraint isn't by default one of whitelisted tags for Authentication datamodel. Shall I add tags used inside constraints on my own? Or is there something I'm missing? Thanks a lot

I'm having an issue on my SHC, running a simple stats count by _time for any particular index, the _time comes through with my preferred time zone set in my preferences, when I go to export it to a CSV file it reverts back to local time zone. Anyone know why this would be happening?