Yeah unfortunatly there isn't a way to do this at the moment sorry. You could try put one node over the top of another and just change the size? Actually probably a better way would be to enable "HTML in labels" in advanced settings, and then you can pass a small block of HTML formatted text, something like eval label = "<div style=\"border: 2px solid " + my_color_variable + "\">" + some node contents + "</div>" This basically gives you infinite customizability but it is a bit ugly. ... View more

Hi @manderson7 OK So with Number Display viz, You can pass in a field called "drilldown" that you can set to whatever you want. Then in Splunk UI > Drilldown settings, just leave this blank. On another panel or in another search you can just use $row.drilldown$ or you can also use $row.title$ (if that field is in your original data). Here is a working example: <form theme="dark"> <label>Number display viz setting token</label> <row> <panel> <viz type="number_display_viz.number_display_viz"> <search> <query> | makeresults count=10 | streamstats count as id | eval title = "Item " + id, value = "50%", drilldown = "your unique key if you want " + id | table title subtitle value drilldown</query> </search> <option name="drilldown">none</option> <option name="number_display_viz.number_display_viz.bordercolor">#FFFFFF</option> <option name="number_display_viz.number_display_viz.bordersize">2</option> <option name="number_display_viz.number_display_viz.colorprimary">#000000</option> <option name="number_display_viz.number_display_viz.colorprimarymode">auto</option> <option name="number_display_viz.number_display_viz.colorsecondary">#000000</option> <option name="number_display_viz.number_display_viz.colorsecondarymode">auto</option> <option name="number_display_viz.number_display_viz.max">100</option> <option name="number_display_viz.number_display_viz.min">0</option> <option name="number_display_viz.number_display_viz.nodatacolor">#0178c7</option> <option name="number_display_viz.number_display_viz.padding">8</option> <option name="number_display_viz.number_display_viz.pulserate">0</option> <option name="number_display_viz.number_display_viz.shadowcolor">#F2F4F5</option> <option name="number_display_viz.number_display_viz.shapebordercolor">#000000</option> <option name="number_display_viz.number_display_viz.shapebordercolormode">darker1</option> <option name="number_display_viz.number_display_viz.shapebordersize">1</option> <option name="number_display_viz.number_display_viz.shapedropcolor">#ffffff</option> <option name="number_display_viz.number_display_viz.shapeshadow">no</option> <option name="number_display_viz.number_display_viz.shapetexture">texture3</option> <option name="number_display_viz.number_display_viz.size">250</option> <option name="number_display_viz.number_display_viz.sparkHeight">30</option> <option name="number_display_viz.number_display_viz.sparkWidth">95</option> <option name="number_display_viz.number_display_viz.sparkalign">3</option> <option name="number_display_viz.number_display_viz.sparkalignv">62</option> <option name="number_display_viz.number_display_viz.sparkcolorfill">#009DD9</option> <option name="number_display_viz.number_display_viz.sparkcolorline">#0178c7</option> <option name="number_display_viz.number_display_viz.sparkcolormodefill">darker1</option> <option name="number_display_viz.number_display_viz.sparkcolormodeline">darker2</option> <option name="number_display_viz.number_display_viz.sparkmax">100</option> <option name="number_display_viz.number_display_viz.sparkmin">0</option> <option name="number_display_viz.number_display_viz.sparknulls">gaps</option> <option name="number_display_viz.number_display_viz.sparkorder">fg</option> <option name="number_display_viz.number_display_viz.sparkstyle">area</option> <option name="number_display_viz.number_display_viz.spinnerspeedmax">20</option> <option name="number_display_viz.number_display_viz.spinnerspeedmin">1</option> <option name="number_display_viz.number_display_viz.style">a3</option> <option name="number_display_viz.number_display_viz.subtitlealign">center</option> <option name="number_display_viz.number_display_viz.subtitlealignv">45</option> <option name="number_display_viz.number_display_viz.subtitlecolor">#C6C6C6</option> <option name="number_display_viz.number_display_viz.subtitlecolormode">static</option> <option name="number_display_viz.number_display_viz.subtitledrop">no</option> <option name="number_display_viz.number_display_viz.subtitledropcolor">#ffffff</option> <option name="number_display_viz.number_display_viz.subtitlefont">number_display_viz-thin</option> <option name="number_display_viz.number_display_viz.subtitlesize">50</option> <option name="number_display_viz.number_display_viz.textalign">center</option> <option name="number_display_viz.number_display_viz.textalignv">70</option> <option name="number_display_viz.number_display_viz.textcolor">#000000</option> <option name="number_display_viz.number_display_viz.textdrop">yes</option> <option name="number_display_viz.number_display_viz.textdropcolor">#919191</option> <option name="number_display_viz.number_display_viz.textduration">300</option> <option name="number_display_viz.number_display_viz.textmode">static</option> <option name="number_display_viz.number_display_viz.textprecision">1</option> <option name="number_display_viz.number_display_viz.textprocessing">abr1</option> <option name="number_display_viz.number_display_viz.textsize">100</option> <option name="number_display_viz.number_display_viz.textunitposition">after</option> <option name="number_display_viz.number_display_viz.textunitsize">50</option> <option name="number_display_viz.number_display_viz.thickness">50</option> <option name="number_display_viz.number_display_viz.thresholdcol1">#1a9035</option> <option name="number_display_viz.number_display_viz.thresholdcol2">#d16f18</option> <option name="number_display_viz.number_display_viz.thresholdcol3">#b22b32</option> <option name="number_display_viz.number_display_viz.thresholdcol4">#ffffff</option> <option name="number_display_viz.number_display_viz.thresholdcol5">#ffffff</option> <option name="number_display_viz.number_display_viz.thresholdcol6">#ffffff</option> <option name="number_display_viz.number_display_viz.thresholdsize">20</option> <option name="number_display_viz.number_display_viz.thresholdval2">70</option> <option name="number_display_viz.number_display_viz.thresholdval3">90</option> <option name="number_display_viz.number_display_viz.titlealign">center</option> <option name="number_display_viz.number_display_viz.titlealignv">25</option> <option name="number_display_viz.number_display_viz.titlecolor">#ffffff</option> <option name="number_display_viz.number_display_viz.titlecolormode">static</option> <option name="number_display_viz.number_display_viz.titledrop">no</option> <option name="number_display_viz.number_display_viz.titledropcolor">#ffffff</option> <option name="number_display_viz.number_display_viz.titlesize">80</option> <option name="refresh.display">progressbar</option> </viz> </panel> </row> <row> <panel> <title>you clicked item: $row.drilldown$ ($$row.title$$ token is now = $row.title$)</title> </panel> </row> </form> ... View more

Hi @FrankVl Yes, this app will work on a SHC. First, decide if you want to track changes on just one search head or if you want to track changes on all search heads. In theory all search heads should be the same so it is up to you if you want to track changes on all of them. For any search heads where you are going to run this, you will need to manually SSH onto the box and run the git initalization commands. If you are going to run on one search head, you need to put the app configuration into system/local/ If you are using multiple search heads you can push the app configuration from the SH deployer. In both cases you will push the git_for_splunk app from the SH deployer as normal. You might need to slightly alter the out-of-the-box dashboards. All the best, Chris. ... View more

HI @nickmew Yes drilldown to other dashboards should work fine. Make sure your data has a "title" field, then add a drilldown that uses the token $click.name$, $click.value$ or also $row.$ Hope this helps ... View more

OK I see what is happening here. This app is a visualization and not an "app" - so it should remain with "Visibility" = false. Instead you first need to do a search, for example: index=_internal | timechart span=1m count as count | eval regions = "normal=#99D18B,5000,Warning=#FCB64E,7000,Error=#B50101" Then click the "visualizations" tab, and select "region chart viz". Once done you can open the "formatting options" menu and if you go to the "help" tab, there will be a link to more examples. Hope this helps and good luck 🙂 ... View more

Hi @Bimord I can appreciate that this is quite confusing, but you need to output two different "types" of rows. The path rows and the node rows. So your query here is going to create "path rows" index=main sourcetype="*:application" | stats sum(eval(event_severity_code="SUCCESS")) as good sum(eval(event_severity_code="ERROR")) as errors sum(eval(event_severity_code="WARNING")) as warn by host | eval to=host, from="BEL" | table to from good warn error So you then need to add on the node rows. One way to do that, is a query like so: | makeresults | eval raw = " node=BEL label=\"My Bel\" icon=users labely=30 height=40 ### node=host1 icon=tablet labely=30 height=40 ### node=host2 icon=database labely=30 height=40 " | makemv delim="###" raw | mvexpand raw | rename raw as _raw | extract | table node label icon labely height and finally combine both queries together like so: index=main sourcetype="*:application" | stats sum(eval(event_severity_code="SUCCESS")) as good sum(eval(event_severity_code="ERROR")) as errors sum(eval(event_severity_code="WARNING")) as warn by host | eval to=host, from="BEL" | append [| makeresults | eval raw = "node=BEL label=\"My label\" icon=users labely=30 height=40 ### node=host1 icon=tablet labely=30 height=40 ### node=host2 icon=database labely=30 height=40 " | makemv delim="###" raw | mvexpand raw | rename raw as _raw | extract ] | table to from good warn error node icon labely label height Hope this helps, Chris ... View more

Hi @jmcr Can you provide a sample of what your output data looks like so I can try and reproduce the problem? If the value is not being set appropriately, the usual reason is that the visualisation is trying to guess which column is which and it hasn't guessed correctly. Make sure your column/field is named "value" and it will be correctly set. If doAFullRedraw is false, then the value will still be updated. all the best ... View more