About danspav

danspav · ‎06-08-2023

Hi @DonBaldini, You can stop clicks from working on the checkbox label by using this css in your dashboard: <row depends="$CSS$"><html><style> .splunk-checkboxgroup label{pointer-events: none!important;} </style></html></row> Cheers, Daniel

danspav · ‎06-08-2023

Hi @super_saiyan, You can update limits.conf to change the Show Source settings. The docs mention that results are "pruned" so while you increase the limit, you may still not get an increase in events displayed. https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf#.5Bshow_source.5D [show_source] distributed = <boolean> * Whether or not a distributed search is performed to get events from all servers and indexes. * Turning this off results in better performance for show source, but events will only come from the initial server and index. * Default: true distributed_search_limit = <unsigned integer> * The maximum number of events that are requested when performing a search for distributed show source. * As this is used for a larger search than the initial non-distributed show source, it is larger than max_count * Splunk software rarely returns anywhere near this number of results, as excess results are pruned. * The point is to ensure the distributed search captures the target event in an environment with many events. * Default: 30000 max_count = <integer> * Maximum number of events accessible by show_source. * The show source command will fail when more than this many events are in the same second as the requested event. * Default: 10000 max_timeafter = <timespan> * Maximum time after requested event to show. * Default: '1day' (86400 seconds) max_timebefore = <timespan> * Maximum time before requested event to show. * Default: '1day' (86400 seconds) Cheers, Daniel

danspav · ‎06-08-2023

Hi @bamflpn, The peer-apps/xxx/local directory has higher precedence than etc/system/local on indexers. (see docs: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles#Precedence_within_global_context.2C_indexer_cluster_peers_only) To confirm the location of the setting that's overwriting your coldToFrozenPath, you can run btool on your indexers: ./splunk btool indexes list --debug | grep coldToFrozenPath That should print out each line of all indexes.conf on the host that contribute to the final indexes config for the coldToFrozen option. Find the line that has the wrong value and that's the file that you should update. If you want to delete the system/local/indexes.conf file you should first check what it's doing. To see what other config is being used from system/local/indexes.conf you can run: ./splunk btool indexes list --debug | grep system/local Any config that is listed will be applied to that indexer from the system/local/indexes.conf file. Either move the config to a peer-apps app, or just remove it if you don't need it. Cheers, Daniel

danspav · ‎06-08-2023

Hi @POR160893, I mocked up a similar dashboard and it looked fine in my browser when the window was maximised, but got the same bunched up look when the window was smaller. I played around with the CSS and got it looking ok no matter how small the window went. Here's what I ended up with: <row depends="$CSS$"><html><sytle> .singlevalue{width:10%!important;} .splunk-single, .svg-container{width: 100%!important;min-width:auto!important;;} .dashboard-row .dashboard-panel .panel-element-row div.single { min-width:auto;} rect{width: 100%!important;} </style> </html> </row> Note I set the single value width to 10% because there are 10 panels (100% / 10 = 10%) Give it a go and see how you get on. Cheers, Daniel

danspav · ‎06-08-2023

Hi @sizemorejm, On Simple XML dashboards (aka Classic Dashboards) you can do that by using tokens. When you set a token, you can make panels or rows show, or make searches run. To make it show when the token exists use this: <row depends="$token$"> There's more info on docs here: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Viz/tokens#Access_tokens_to_show_or_hide_user_interface_components Here's a sample dashboard with 4 tabs that show based on which button you click: <form version="1.1"> <label>Tabbed Dashboard</label> <description>https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-Dashboard/m-p/646374#M52808</description> <fieldset submitButton="false"> <input type="link" token="page" searchWhenChanged="true" id="tab_menu"> <label></label> <choice value="Tab 1">Tab 1</choice> <choice value="Tab 2">Tab 2</choice> <choice value="Tab 3">Tab 3</choice> <choice value="Tab 4">Tab 4</choice> <change> <condition value="Tab 1"><set token="show_tab_1">true</set><unset token="show_tab_2"></unset><unset token="show_tab_3"></unset><unset token="show_tab_4"></unset></condition> <condition value="Tab 2"><set token="show_tab_2">true</set><unset token="show_tab_1"></unset><unset token="show_tab_3"></unset><unset token="show_tab_4"></unset></condition> <condition value="Tab 3"><set token="show_tab_3">true</set><unset token="show_tab_1"></unset><unset token="show_tab_2"></unset><unset token="show_tab_4"></unset></condition> <condition value="Tab 4"><set token="show_tab_4">true</set><unset token="show_tab_1"></unset><unset token="show_tab_2"></unset><unset token="show_tab_3"></unset></condition> </change> </input> </fieldset> <row depends="$show_tab_1$"> <panel> <title>Tab 1</title> <table> <search> <query>| makeresults | eval title="Page 1"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> <row depends="$show_tab_2$"> <panel> <title>Tab 2</title> <table> <search> <query>| makeresults | eval title="Tab 2"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> <row depends="$show_tab_3$"> <panel> <title>Tab 3</title> <table> <search> <query>| makeresults | eval title="Tab 3"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> <row depends="$show_tab_4$"> <panel> <title>Tab 4</title> <table> <search> <query>| makeresults | eval title="Tab 4"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> <row depends="$CSS_ONLY$"><html><style> #tab_menu { width: fit-content!important; } div#tab_menu button{ height: 38px!important; border: 1px solid #cccccc; min-width: 100px; /* background-color:#ffffff; */ width: auto; padding: 10px; margin-right: 8px; color: #333333; height: 55px; border-radius:7px; font-size: 16px; } div#tab_menu button[aria-checked="true"]{background-color:#006eaa!important;color:white!important;} </style></html></row> </form> Cheers, Daniel

danspav · ‎06-05-2023

Hi @DS904458, Depending on how you want to use the list of numbers, you may be able to use a macro. E.g. this search: index=_internal sourcetype=splunkd | eval list= `generate_list(50,10,7)` | makemv list delim=" " | table _time, sourcetype, list Returns a list of 7 numbers from 10 to 50 : The macro definition is: [generate_list(3)] args = max,min,length definition = [|makeresults count=$length$\ | streamstats count as id\ |eval value=if(id=1,$min$, round($min$ + (id-1) * (($max$ - $min$) / ($length$ - 1)),1))\ | stats list(value) as value\ | nomv value\ | eval value="\"" . value . "\""\ | return $value] errormsg = Please only enter numbers for: Max, Min, Length. iseval = 0 validation = tonumber(max) >0 AND tonumber(min) >-1 AND tonumber(length) >0 It could also be used as the search for a dropdown on a dashboard, e.g.: | makeresults | eval list=`generate_list(50,10,7)` | makemv list delim=" " | mvexpand list | table list Does that help? Cheers, Daniel

danspav · ‎06-05-2023

Hi @McMac84, Running searches are all logged to the _audit index - you can get details on cancelled searches there: index=_audit action=search info IN("cancel","cancelled") | timechart span=15m count by user limit=15 I believe "cancel" is system-cancelled, and "cancelled" is user-cancelled, but that's just my guess based on this docs page. Cheers, Daniel

danspav · ‎06-05-2023

Hi @Hadas I've published a new version of the app since your post - try upgrading to the latest version to see if your issue is resolved. https://splunkbase.splunk.com/app/4438 Cheers, Daniel

danspav · ‎06-05-2023

Hi @gabriel_vasseur You can achieve this in JavaScript - the following will test to see if the theme is dark mode or not, and use that to determine which CSS to dynamically load. Here's the Javascript&colon; require(['jquery', 'api/SplunkVisualizationUtils'], function($, vizUtils) { // Splunk Answers: https://community.splunk.com/t5/Building-for-the-Splunk-Platform/Different-custom-CSS-depending-on-dark-VS-light-mode/m-p/631551#M10940 var isSplunkDarkMode = false; function addCss(fileName) { var link = $("<link />",{rel: "stylesheet", type: "text/css", href: fileName}) $('head').append(link); } if (typeof vizUtils.getCurrentTheme === "function") { // safe to use the function isSplunkDarkMode = (vizUtils.getCurrentTheme()=="dark"); }else{ //version 6.x, 7.0 isSplunkDarkMode = false; } //Update to point to your app / stylesheets here: var stylesheet = (isSplunkDarkMode) ? "/static/app/search/dark.css" : "/static/app/search/light.css" addCss(stylesheet); }); You need to update the links to point to your stylesheets as this one assumes they are in the search app. Create the files in $SPLUNK_HOME/etc/apps/<appname>/appserver/static/ Then update the app name above changing "search" to the actual app name. Cheers, Daniel

danspav · ‎06-05-2023

Hi @eholz1, You can try the small/medium/large trellis sizing to see if they give you enough white space between the blocks. If not, you can try tweaking the CSS: <row depends="$CSS_ONLY$"> <html><style> div.viz-facet-size-medium{border:1px solid blue;margin-right: 65px;margin-bottom:65px;} </style></html> </row> The above makes my medium panels look like this: The blue outline is just to help visualize how big the gaps are. Tweaking the margin to 5px gives: The different CSS classes to tweak are: div.viz-facet-size-small{margin: 0px 15px 15px 0px;} div.viz-facet-size-medium{margin: 0px 15px 15px 0px;} div.viz-facet-size-large{margin: 0px 15px 15px 0px;} Cheers, Daniel

danspav · ‎06-05-2023

Hi @power12, If you give your panels IDs, then you can specify them in the CSS. If you give panels an identifier "XXX_" and a number, then you can use a neat CSS trick where you apply the CSS to all DIVs whose ID starts with "XXX_" <row> <panel id="apply_css_1">...</panel> <panel id="apply_css_2">...</panel> </row> <row> <panel id="apply_css_3">...</panel> </row> Then create your CSS panel and add the prefix: div[id^=apply_css] to each class <row> <panel depends="$alwaysHideCSSPanel$"> <html> <style> div[id^=apply_css] table thead tr th,td{ font-size:150% !important; width:150px !important; border: 1px solid black !important; text-align: right !important } div[id^=apply_css] table thead tr th{ font-weight: bold !important; } </style> </html> </panel> </row> That way your CSS is only applied to the panels you want. Cheers, Daniel

danspav · ‎06-04-2023

Hi @sai_krishna, Try this: <fieldset submitButton="false"> <input type="dropdown" token="reportingDayA"> <label>Reporting Day Misra apu</label> <fieldForLabel>readableDateA</fieldForLabel> <fieldForValue>epochA</fieldForValue> <search> <query>| tstats count where index=_internal by _time span=1d | eval readableDateA=strftime(_time,"%F") | eval epochA=strftime(_time,"%s") | dedup readableDateA | sort - _time ``` get latest and call it "latest" ``` | eventstats max(epochA) as latest | eval readableDateA=if(epochA=latest,"Latest",readableDateA) </query> <earliest>-7d@d</earliest> <latest>now</latest> </search> <selectFirstChoice>true</selectFirstChoice> </input> </fieldset> The search will get all the dates, and label the most recent one "Latest". Due to the way the list is sorted, this entry is the first one in the list. We can use that to our advantage by using the selectFirstChoice option for the dropdown - that makes the first entry in the list selected. Here it is in a dashboard: <form version="1.1" theme="light"> <label>Answers</label> <fieldset submitButton="false"> <input type="dropdown" token="reportingDayA"> <label>Reporting Day Misra apu</label> <fieldForLabel>readableDateA</fieldForLabel> <fieldForValue>epochA</fieldForValue> <search> <query>| tstats count where index=_internal by _time span=1d | eval readableDateA=strftime(_time,"%F") | eval epochA=strftime(_time,"%s") | dedup readableDateA | sort - _time | eventstats max(epochA) as latest | eval readableDateA=if(epochA=latest,"Latest",readableDateA) </query> <earliest>-7d@d</earliest> <latest>now</latest> </search> <selectFirstChoice>true</selectFirstChoice> </input> </fieldset> <row> <html> <h1>You selected: $reportingDayA$</h1> </html> </row> </form> Cheers, Daniel

danspav · ‎06-04-2023

Hi @mayurr98, I tried out a new props that looks like it's getting the fields to ingest correctly - transforms.conf [cs_srctype] CLEAN_KEYS = 0 DELIMS = , FIELDS = action,category,dest,file_name,file_path,severity,severity_id,signature,signature_id,vendor_product props.conf [cs_srctype] KV_MODE = none REPORT-cs_srctype = cs_srctype SEDCMD=s/^((?:[^,]+,){4}[^,]+)(?<=\\),/\1\\,/ I've only added one additional line in the props - a sedcmd to add an escape to any trailing slash in the file_path segment. With that config set up, the data is ingested with the correct vendor_product field: Cheers, Daniel

danspav · ‎06-04-2023

Hi @spoo, If you are using Simple XML, here's how you can create a snippet of SPL and add it to your base search: 1. Create some conditions on your dropdown so when the user changes the input it will create a snippet of SPL in a new token. If the user selects "System A" then we set the token to "|noop" which is just SPL that does nothing. If the user selects "System B" or "System C" then it sets the token to "| dedup time_day, name | dedup ID" <change> <condition label="System A"> <set token="SPL">| noop</set> </condition> <condition label="System B"> <set token="SPL">| dedup time_day, name | dedup ID</set> </condition> <condition label="System C"> <set token="SPL">| dedup time_day, name | dedup ID</set> </condition> </change> 2. Add the token to your base search (or chain search) Now we update the search to include the token where previously you had the |dedupe.. command: <search> <query>| pivot XYZ_dm ..... $SPL$ | table * </query> </search> When the token is set to "|noop" it won't affect the search results. When it is "|dedup..." it will add those commands to the search. Here's the code in an example dashboard: <form version="1.1"> <label>My Dashboard</label> <fieldset submitButton="false"> <input type="dropdown" token="system"> <label>System</label> <choice value="System A">System A</choice> <choice value="System B">System B</choice> <choice value="System C">System C</choice> <change> <condition label="System A"> <set token="SPL">| noop</set> </condition> <condition label="System B"> <set token="SPL">| dedup time_day, name | dedup ID</set> </condition> <condition label="System C"> <set token="SPL">| dedup time_day, name | dedup ID</set> </condition> </change> <default>System A</default> <initialValue>System A</initialValue> </input> </fieldset> <row> <panel> <title>SPL=$SPL$</title> <event> <search> <query>| makeresults $SPL$</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="list.drilldown">none</option> </event> </panel> </row> </form> Hopefully that helps. Cheers, Daniel

danspav · ‎06-04-2023

Hi @michaeler, Here's a regex to extract everything up to the first " - 1339Z" (any numbers will match) | rex field=rows "(?<Details>.+?)\s-\s\d{4}Z" Here's a query to test it out: | makeresults | eval rows="P3820 Houston to A345 Atlanta Line Down - 1339Z 19 May - On-going - TKT39390423@P3820 Houston to A345 Atlanta Line Down - 1339Z 19 May - 0834Z 20 May - TKT39390423@P3820 Houston to A345 Atlanta Line Down - 1339Z 19 MAY - Ongoing - TKT39390423 - 1339Z 19 May - On-going - TKT39390423@P3820 Houston - A345 Atlanta Line Down - 1339Z 19 MAY - Ongoing - INC39390423, DIRJ LLO MM#:394039 - 1339Z 19 May - On-going - TKT39390423@P3820 Houston - A345 Atlanta Line Down - 1339Z 19 MAY - 1834Z MAY - INC39390423, DIRJ LLO MM#:394039 - 1339Z 19 May - 0834Z 20 May - TKT39390423" | makemv rows delim="@" | mvexpand rows | table rows | rex field=rows "(?<Details>.+?)\s-\s\d{4}Z" Cheers, Daniel

danspav · ‎06-04-2023

Hi @Abdullaziz19, Your table is returning two fields: Percent_Failure, and count. You can make the singe value viz use the "Percent_Failure" field by selecting the following under the "Selected Data Field" option: That way you're specifying the right value to use. Note that you can also add the "%" character in the dashboard options too - just calculate the numeric value you want to display and set the Unit Label to "%". That way you can also round the number automatically, and set thresholds based on its value. Cheers, Daniel

danspav · ‎06-02-2023

Hi @justanothersplu, I think Bin has just the feature you're looking for: aligntime You can pass aligntime the following: earliest - snap to the earliest time (down to the second), and let everything bin off that latest - similarly, snap to the latest time <time-specifier> This is what you'll need: set it to @m to snap to the current time to the minute See docs: Bin Try running this: index=_internal | bin _time span=60m aligntime=@m All the bins will snap to the current minute, and go back in 60m increments. Note - this won't work if you set your search time range to end some time in the past, but will work if you only want to snap to the current clock time. To be able to get buckets to snap to the minute based on your search time and not the clock time, you could try something monstrous like: index=_internal | bin _time span=60m [ | makeresults | addinfo | eval aligntime=strptime(strftime(info_max_time,"%Y-%m-%d %H:%M:00"),"%Y-%m-%d %H:%M:%S") | table aligntime | return aligntime ] I don't recommend it, but this search will calculate the latest search time to the minute, and use it to add to the bin command. I think the first option will suit your needs best. cheers, Daniel

danspav · ‎06-01-2023

Hi @Tincho , It can be a bit of a pain creating regexes inside quotes, because you have to escape characters for the string, and escape characters for regex - meaning you double up on escaping characters. Here's a search that takes domain\\\\user and converts it to domain\user in a couple of different ways: | makeresults| eval user_name="DOMAIN\\\\\\\\USER" ``` Using replace - escaping multiple times ``` | eval user_name_replace=replace(user_name, "\\\\\\\\\\\\\\\\","\\") ``` Using sed ``` | eval user_name_sed = user_name | rex field=user_name_sed mode=sed "s/\\\\{4}/\\\\/" ``` Using rex to create a domain field, and user field, then combining them ``` | rex field=user_name "^(?<domain>[^\\\\]+)\\\\+(?<user>.+)$" | eval user_name_regex = domain . "\\" . user ``` output the results ``` | table user_name, user_name_replace,user_name_sed, user_name_regex That results in : Cheers, Daniel

danspav · ‎03-06-2023

Good pickup. If the token prefix/suffix and field prefix/suffix are used, then the values will get a bit complex, but I haven't yet run into a situation where I couldn't use <change>. However, seeing how it's unsupported, if you want to avoid using change then you'd need to rely on JavaScript to manipulate the $label$ token. Something like: var defaultTokenModel = mvc.Components.get("default"); defaultTokenModel.on("change:input", function(key, value) { ... // Update the $newLabel$ token value defaultTokenModel.set('labels', newLabel); }); See Splunk Dev docs for more info: https://dev.splunk.com/enterprise/docs/developapps/visualizedata/simplexmlextensions/tokenmanipulation/

danspav · ‎03-06-2023

Hi @DaDave , Here's a way to get the labels and values tokens in a multiselect. We will encode the key/values into the value field, and use conditional tags to extract the keys for the keys token and the values for the values token. Here's the dashboard code: <form version="1.1"> <label>Test</label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="input" searchWhenChanged="true"> <choice value="A|1">1</choice> <choice value="B|2">2</choice> <choice value="C|3">3</choice> <change> <condition match="isnull($input$)"> <unset token="selectedLabel"></unset> <unset token="selectedValue"></unset> </condition> <condition> <eval token="selectedLabel">replace($input$,"[a-zA-Z][|]","")</eval> <eval token="selectedValue">replace($input$,"[|][0-9]","")</eval> </condition> </change> </input> <input type="radio" searchWhenChanged="true"> <label>$selectedLabel$</label> </input> <input type="radio" searchWhenChanged="true"> <label>$selectedValue$</label> </input> </fieldset> <row><html> <table border="1"><tr><th>Value</th><th>Label</th></tr> <tr><td>$selectedValue$</td><td>$selectedLabel$</td></tr></table> </html>< I've updated the values in the multiselect to be in the format: value|key Then when the multiselect changes we extract everything before the | for the value, and everything after the | for the key. The replace regex will be a bit more complicated when you use actual data - but the general solution should work. Cheers Spav

danspav · ‎03-05-2023

Hi @Brausepaule, I like to play around with the link list items so they look more like buttons. Here's one example from a Social Media dashboard: Here's the Input code: <input type="link" token="platform" searchWhenChanged="true" id="platform"> <label>Platform</label> <choice value="*">All</choice> <choice value="Google Play Store">Google</choice> <choice value="Facebook">Facebook</choice> <choice value="Apple App Store">Apple</choice> <choice value="Instagram">Instagram</choice> <choice value="Twitter">Twitter</choice> <default>*</default> <initialValue>*</initialValue> <change> <condition label="All"> <set token="platform_name">All Platforms</set> </condition> <condition> <set token="platform_name">$label$</set> </condition> </change> </input> With the exception of the images, here's the CSS: div#platform button{height: 38px!important; padding-left: 36px!important; border: 1px solid #cccccc; min-width: 100px; background-repeat:no-repeat; background-size: 30px 30px; background-color:#ffffff; width: auto; padding: 10px; margin-right: 8px; color: #333333; height: 55px; border-radius:7px; font-size: 16px; } div#platform button[aria-checked="true"]{ border:3px solid #6b7785!important; } The last bit of CSS sets the border of the selected button to be bold, even when you click away to something else. I'm also setting the ID on the input, so the CSS will only apply to that list in particular. Hopefully that helps you out. -Spav

danspav · ‎02-22-2023

Hi @av_, Here's a solution that doesn't use javascript - just tokens in simplexml. Each text box is set up like this: <input type="text" token="text1" searchWhenChanged="true"> <label>TEXTBOX1</label> <default></default> <change> <condition match="value="" AND $text2$="""> <unset token="search_can_proceed"></unset> </condition> <condition match="value="" AND NOT $text2$="""> <set token="search_can_proceed">true</set> </condition> <condition match="NOT value="" AND NOT $text2$="""> <set token="search_can_proceed">true</set> </condition> </change> </input> The tokens are set when the text changes: If both are empty, we unset the search_can_proceed token If one has text but the other is empty then we set the search_can_proceed token Next, we make the search dependent on that token - and display a helpful panel that tells the user to enter text before the search will run: <row> <panel> <table depends="$search_can_proceed$"> <title>QUERY</title> <search depends="$search_can_proceed$"> <query>|makeresults | eval TEXTBOX1=$text1|s$, TEXTBOX2=$text2|s$ </query> </search> </table> <html rejects="$search_can_proceed$"> <h1> Please enter a term for TEXTBOX1 And/Or TEXTBOX2.</h1> </html> </panel> </row> The depends and rejects attributes let us show a panel based on the token existing or not. Here's the dashboard all together: <form> <label>Dueling Text Boxes</label> <init> <unset token="search_can_proceed"></unset> </init> <row> <panel> <title>Please enter a term for TEXTBOX1 And/Or TEXTBOX2</title> <input type="text" token="text1" searchWhenChanged="true"> <label>TEXTBOX1</label> <default></default> <change> <condition match="value="" AND $text2$="""> <unset token="search_can_proceed"></unset> </condition> <condition match="value="" AND NOT $text2$="""> <set token="search_can_proceed">true</set> </condition> <condition match="NOT value="" AND NOT $text2$="""> <set token="search_can_proceed">true</set> </condition> </change> </input> <input type="text" token="text2" searchWhenChanged="true"> <label>TEXTBOX2</label> <default></default> <change> <condition match="value="" AND $text1$="""> <unset token="search_can_proceed"></unset> </condition> <condition match="value="" AND NOT $text1$="""> <set token="search_can_proceed">true</set> </condition> <condition match="NOT value="" AND NOT $text1$="""> <set token="search_can_proceed">true</set> </condition> </change> </input> <input type="time" token="lifeTime"> <label>Select Time</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> </panel> </row> <row> <panel> <table depends="$search_can_proceed$"> <title>QUERY</title> <search depends="$search_can_proceed$"> <query>|makeresults | eval TEXTBOX1=$text1|s$, TEXTBOX2=$text2|s$ </query> </search> </table> <html rejects="$search_can_proceed$"> <h1> Please enter a term for TEXTBOX1 And/Or TEXTBOX2.</h1> </html> </panel> </row> </form> The only drawback to this is that if the tokens are set in the URL - e.g. by a drilldown, then the user will need to make the text box content change before the search is run.

danspav · ‎02-21-2023

Hi @TalNiv , The easiest way is how @gcusello said - update the original dashboard to create two tokens for earliest / latest. You can add this to the section where you create the $time$ token in the original dashboard: <eval token="earliest">tonumber($time$) - 10000</eval> If you don't have access to that dashboard there aren't many options. AFAIK you cannot use URL sourced tokens in the <init> section of your dashboard to do the same eval tag. One very roundabout way is to create a dummy search, and create tokens off that. E.g. put this at the top of your dashboard under the label section: <search> <query>|makeresults | eval earliest=tonumber($time$) - 100000, latest=$time$</query> <done> <set token="earliest">$result.earliest$</set> <set token="latest">$result.latest$</set> </done> </search> Now you can use $earliest$ and $latest$ in your searches.

danspav · ‎10-26-2020

Hi @sweety1309 I think the issue is with the where clause. Say the duration is 108. The where clause will not match on: (duration > 45 and duration <= 75) But will match on: (duration > 105 and duration <= 120) However, the where clause uses AND between these terms, so the duration must be both less than 75 AND greater than 105. Try replacing your ANDs with ORs: | where (duration > 45 AND duration <= 75) OR (duration > 105 AND duration <= 120) OR (duration > 120 AND duration <= 180) OR (duration > 180) Seeing as you don't use the duration field, you could simplify it further: | where (duration > 45 AND duration <= 75) OR (duration > 105)

danspav · ‎10-26-2020

Hi @ershishirkumar, There's a great app available on Splunkbase that tracks all available apps on Splunkbase: Analysis of Splunkbase Apps for Splunk https://splunkbase.splunk.com/app/2919/ It pulls down details about every app on Splunkbase and presents you with a couple of dashboards to explore. There's a section on the main dashboard that compares your installed apps with the latest version on Splunkbase ("local audit"). If you install this app, you could convert the search that performs the local audit to an email alert.

Posts	88
Solutions	29
Karma Given	7
Karma Received	48
Member Since	‎04-07-2019

Online Status	Offline
Date Last Visited	Thursday

Re: Can I make checkbox label clickable?

Re: How to increase the number of results in "show...

Re: Indexer cluster with differing peer-apps/index...

Re: Unable to center metrics on Dashboard Row

Re: Splunk Dashboard

Re: How to genterate list of data by giving max an...

Re: SPL for cancelled / timed out searches?

Re: How do I get Network diagram viz to stop movin...

Re: Different custom CSS depending on dark VS ligh...

Re: How to Add padding between trellis single valu...

Re: How to make a css script affect only specific...

Re: How to add "Latest" keyword in the reporting d...

Re: How to avoid comma separated delimiter being e...

Re: How to exclude dedup when there is a dropdown ...

Re: Regex field extraction repeating string

Re: How do I calculate HTTP failure Percentage?

Re: Grouping events from bin command to adhere to ...

Re: Replace Characters- How can I replace \\\\ for...

Re: Usage of multiple labels in a multivalue field...

Re: Usage of multiple labels in a multivalue field...

Re: Where can I find CSS for Link List Selected It...

How to make two textboxes work with a submit link ...

Re: Search time range based on epoch token from dr...

Re: Multiple 'Where' conditions

Re: Splunkbase app update alert