About danspav

danspav · ‎06-05-2023

Hi @power12, If you give your panels IDs, then you can specify them in the CSS. If you give panels an identifier "XXX_" and a number, then you can use a neat CSS trick where you apply the CSS to all DIVs whose ID starts with "XXX_" <row> <panel id="apply_css_1">...</panel> <panel id="apply_css_2">...</panel> </row> <row> <panel id="apply_css_3">...</panel> </row> Then create your CSS panel and add the prefix: div[id^=apply_css] to each class <row> <panel depends="$alwaysHideCSSPanel$"> <html> <style> div[id^=apply_css] table thead tr th,td{ font-size:150% !important; width:150px !important; border: 1px solid black !important; text-align: right !important } div[id^=apply_css] table thead tr th{ font-weight: bold !important; } </style> </html> </panel> </row> That way your CSS is only applied to the panels you want. Cheers, Daniel

danspav · ‎06-04-2023

Hi @sai_krishna, Try this: <fieldset submitButton="false"> <input type="dropdown" token="reportingDayA"> <label>Reporting Day Misra apu</label> <fieldForLabel>readableDateA</fieldForLabel> <fieldForValue>epochA</fieldForValue> <search> <query>| tstats count where index=_internal by _time span=1d | eval readableDateA=strftime(_time,"%F") | eval epochA=strftime(_time,"%s") | dedup readableDateA | sort - _time ``` get latest and call it "latest" ``` | eventstats max(epochA) as latest | eval readableDateA=if(epochA=latest,"Latest",readableDateA) </query> <earliest>-7d@d</earliest> <latest>now</latest> </search> <selectFirstChoice>true</selectFirstChoice> </input> </fieldset> The search will get all the dates, and label the most recent one "Latest". Due to the way the list is sorted, this entry is the first one in the list. We can use that to our advantage by using the selectFirstChoice option for the dropdown - that makes the first entry in the list selected. Here it is in a dashboard: <form version="1.1" theme="light"> <label>Answers</label> <fieldset submitButton="false"> <input type="dropdown" token="reportingDayA"> <label>Reporting Day Misra apu</label> <fieldForLabel>readableDateA</fieldForLabel> <fieldForValue>epochA</fieldForValue> <search> <query>| tstats count where index=_internal by _time span=1d | eval readableDateA=strftime(_time,"%F") | eval epochA=strftime(_time,"%s") | dedup readableDateA | sort - _time | eventstats max(epochA) as latest | eval readableDateA=if(epochA=latest,"Latest",readableDateA) </query> <earliest>-7d@d</earliest> <latest>now</latest> </search> <selectFirstChoice>true</selectFirstChoice> </input> </fieldset> <row> <html> <h1>You selected: $reportingDayA$</h1> </html> </row> </form> Cheers, Daniel

danspav · ‎06-04-2023

Hi @mayurr98, I tried out a new props that looks like it's getting the fields to ingest correctly - transforms.conf [cs_srctype] CLEAN_KEYS = 0 DELIMS = , FIELDS = action,category,dest,file_name,file_path,severity,severity_id,signature,signature_id,vendor_product props.conf [cs_srctype] KV_MODE = none REPORT-cs_srctype = cs_srctype SEDCMD=s/^((?:[^,]+,){4}[^,]+)(?<=\\),/\1\\,/ I've only added one additional line in the props - a sedcmd to add an escape to any trailing slash in the file_path segment. With that config set up, the data is ingested with the correct vendor_product field: Cheers, Daniel

danspav · ‎06-04-2023

Hi @spoo, If you are using Simple XML, here's how you can create a snippet of SPL and add it to your base search: 1. Create some conditions on your dropdown so when the user changes the input it will create a snippet of SPL in a new token. If the user selects "System A" then we set the token to "|noop" which is just SPL that does nothing. If the user selects "System B" or "System C" then it sets the token to "| dedup time_day, name | dedup ID" <change> <condition label="System A"> <set token="SPL">| noop</set> </condition> <condition label="System B"> <set token="SPL">| dedup time_day, name | dedup ID</set> </condition> <condition label="System C"> <set token="SPL">| dedup time_day, name | dedup ID</set> </condition> </change> 2. Add the token to your base search (or chain search) Now we update the search to include the token where previously you had the |dedupe.. command: <search> <query>| pivot XYZ_dm ..... $SPL$ | table * </query> </search> When the token is set to "|noop" it won't affect the search results. When it is "|dedup..." it will add those commands to the search. Here's the code in an example dashboard: <form version="1.1"> <label>My Dashboard</label> <fieldset submitButton="false"> <input type="dropdown" token="system"> <label>System</label> <choice value="System A">System A</choice> <choice value="System B">System B</choice> <choice value="System C">System C</choice> <change> <condition label="System A"> <set token="SPL">| noop</set> </condition> <condition label="System B"> <set token="SPL">| dedup time_day, name | dedup ID</set> </condition> <condition label="System C"> <set token="SPL">| dedup time_day, name | dedup ID</set> </condition> </change> <default>System A</default> <initialValue>System A</initialValue> </input> </fieldset> <row> <panel> <title>SPL=$SPL$</title> <event> <search> <query>| makeresults $SPL$</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="list.drilldown">none</option> </event> </panel> </row> </form> Hopefully that helps. Cheers, Daniel

danspav · ‎06-04-2023

Hi @michaeler, Here's a regex to extract everything up to the first " - 1339Z" (any numbers will match) | rex field=rows "(?<Details>.+?)\s-\s\d{4}Z" Here's a query to test it out: | makeresults | eval rows="P3820 Houston to A345 Atlanta Line Down - 1339Z 19 May - On-going - TKT39390423@P3820 Houston to A345 Atlanta Line Down - 1339Z 19 May - 0834Z 20 May - TKT39390423@P3820 Houston to A345 Atlanta Line Down - 1339Z 19 MAY - Ongoing - TKT39390423 - 1339Z 19 May - On-going - TKT39390423@P3820 Houston - A345 Atlanta Line Down - 1339Z 19 MAY - Ongoing - INC39390423, DIRJ LLO MM#:394039 - 1339Z 19 May - On-going - TKT39390423@P3820 Houston - A345 Atlanta Line Down - 1339Z 19 MAY - 1834Z MAY - INC39390423, DIRJ LLO MM#:394039 - 1339Z 19 May - 0834Z 20 May - TKT39390423" | makemv rows delim="@" | mvexpand rows | table rows | rex field=rows "(?<Details>.+?)\s-\s\d{4}Z" Cheers, Daniel

danspav · ‎06-04-2023

Hi @Abdullaziz19, Your table is returning two fields: Percent_Failure, and count. You can make the singe value viz use the "Percent_Failure" field by selecting the following under the "Selected Data Field" option: That way you're specifying the right value to use. Note that you can also add the "%" character in the dashboard options too - just calculate the numeric value you want to display and set the Unit Label to "%". That way you can also round the number automatically, and set thresholds based on its value. Cheers, Daniel

danspav · ‎06-02-2023

Hi @justanothersplu, I think Bin has just the feature you're looking for: aligntime You can pass aligntime the following: earliest - snap to the earliest time (down to the second), and let everything bin off that latest - similarly, snap to the latest time <time-specifier> This is what you'll need: set it to @m to snap to the current time to the minute See docs: Bin Try running this: index=_internal | bin _time span=60m aligntime=@m All the bins will snap to the current minute, and go back in 60m increments. Note - this won't work if you set your search time range to end some time in the past, but will work if you only want to snap to the current clock time. To be able to get buckets to snap to the minute based on your search time and not the clock time, you could try something monstrous like: index=_internal | bin _time span=60m [ | makeresults | addinfo | eval aligntime=strptime(strftime(info_max_time,"%Y-%m-%d %H:%M:00"),"%Y-%m-%d %H:%M:%S") | table aligntime | return aligntime ] I don't recommend it, but this search will calculate the latest search time to the minute, and use it to add to the bin command. I think the first option will suit your needs best. cheers, Daniel

danspav · ‎06-01-2023

Hi @Tincho , It can be a bit of a pain creating regexes inside quotes, because you have to escape characters for the string, and escape characters for regex - meaning you double up on escaping characters. Here's a search that takes domain\\\\user and converts it to domain\user in a couple of different ways: | makeresults| eval user_name="DOMAIN\\\\\\\\USER" ``` Using replace - escaping multiple times ``` | eval user_name_replace=replace(user_name, "\\\\\\\\\\\\\\\\","\\") ``` Using sed ``` | eval user_name_sed = user_name | rex field=user_name_sed mode=sed "s/\\\\{4}/\\\\/" ``` Using rex to create a domain field, and user field, then combining them ``` | rex field=user_name "^(?<domain>[^\\\\]+)\\\\+(?<user>.+)$" | eval user_name_regex = domain . "\\" . user ``` output the results ``` | table user_name, user_name_replace,user_name_sed, user_name_regex That results in : Cheers, Daniel

danspav · ‎03-06-2023

Good pickup. If the token prefix/suffix and field prefix/suffix are used, then the values will get a bit complex, but I haven't yet run into a situation where I couldn't use <change>. However, seeing how it's unsupported, if you want to avoid using change then you'd need to rely on JavaScript to manipulate the $label$ token. Something like: var defaultTokenModel = mvc.Components.get("default"); defaultTokenModel.on("change:input", function(key, value) { ... // Update the $newLabel$ token value defaultTokenModel.set('labels', newLabel); }); See Splunk Dev docs for more info: https://dev.splunk.com/enterprise/docs/developapps/visualizedata/simplexmlextensions/tokenmanipulation/

danspav · ‎03-06-2023

Hi @DaDave , Here's a way to get the labels and values tokens in a multiselect. We will encode the key/values into the value field, and use conditional tags to extract the keys for the keys token and the values for the values token. Here's the dashboard code: <form version="1.1"> <label>Test</label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="input" searchWhenChanged="true"> <choice value="A|1">1</choice> <choice value="B|2">2</choice> <choice value="C|3">3</choice> <change> <condition match="isnull($input$)"> <unset token="selectedLabel"></unset> <unset token="selectedValue"></unset> </condition> <condition> <eval token="selectedLabel">replace($input$,"[a-zA-Z][|]","")</eval> <eval token="selectedValue">replace($input$,"[|][0-9]","")</eval> </condition> </change> </input> <input type="radio" searchWhenChanged="true"> <label>$selectedLabel$</label> </input> <input type="radio" searchWhenChanged="true"> <label>$selectedValue$</label> </input> </fieldset> <row><html> <table border="1"><tr><th>Value</th><th>Label</th></tr> <tr><td>$selectedValue$</td><td>$selectedLabel$</td></tr></table> </html>< I've updated the values in the multiselect to be in the format: value|key Then when the multiselect changes we extract everything before the | for the value, and everything after the | for the key. The replace regex will be a bit more complicated when you use actual data - but the general solution should work. Cheers Spav

danspav · ‎03-05-2023

Hi @Brausepaule, I like to play around with the link list items so they look more like buttons. Here's one example from a Social Media dashboard: Here's the Input code: <input type="link" token="platform" searchWhenChanged="true" id="platform"> <label>Platform</label> <choice value="*">All</choice> <choice value="Google Play Store">Google</choice> <choice value="Facebook">Facebook</choice> <choice value="Apple App Store">Apple</choice> <choice value="Instagram">Instagram</choice> <choice value="Twitter">Twitter</choice> <default>*</default> <initialValue>*</initialValue> <change> <condition label="All"> <set token="platform_name">All Platforms</set> </condition> <condition> <set token="platform_name">$label$</set> </condition> </change> </input> With the exception of the images, here's the CSS: div#platform button{height: 38px!important; padding-left: 36px!important; border: 1px solid #cccccc; min-width: 100px; background-repeat:no-repeat; background-size: 30px 30px; background-color:#ffffff; width: auto; padding: 10px; margin-right: 8px; color: #333333; height: 55px; border-radius:7px; font-size: 16px; } div#platform button[aria-checked="true"]{ border:3px solid #6b7785!important; } The last bit of CSS sets the border of the selected button to be bold, even when you click away to something else. I'm also setting the ID on the input, so the CSS will only apply to that list in particular. Hopefully that helps you out. -Spav

danspav · ‎02-22-2023

Hi @av_, Here's a solution that doesn't use javascript - just tokens in simplexml. Each text box is set up like this: <input type="text" token="text1" searchWhenChanged="true"> <label>TEXTBOX1</label> <default></default> <change> <condition match="value="" AND $text2$="""> <unset token="search_can_proceed"></unset> </condition> <condition match="value="" AND NOT $text2$="""> <set token="search_can_proceed">true</set> </condition> <condition match="NOT value="" AND NOT $text2$="""> <set token="search_can_proceed">true</set> </condition> </change> </input> The tokens are set when the text changes: If both are empty, we unset the search_can_proceed token If one has text but the other is empty then we set the search_can_proceed token Next, we make the search dependent on that token - and display a helpful panel that tells the user to enter text before the search will run: <row> <panel> <table depends="$search_can_proceed$"> <title>QUERY</title> <search depends="$search_can_proceed$"> <query>|makeresults | eval TEXTBOX1=$text1|s$, TEXTBOX2=$text2|s$ </query> </search> </table> <html rejects="$search_can_proceed$"> <h1> Please enter a term for TEXTBOX1 And/Or TEXTBOX2.</h1> </html> </panel> </row> The depends and rejects attributes let us show a panel based on the token existing or not. Here's the dashboard all together: <form> <label>Dueling Text Boxes</label> <init> <unset token="search_can_proceed"></unset> </init> <row> <panel> <title>Please enter a term for TEXTBOX1 And/Or TEXTBOX2</title> <input type="text" token="text1" searchWhenChanged="true"> <label>TEXTBOX1</label> <default></default> <change> <condition match="value="" AND $text2$="""> <unset token="search_can_proceed"></unset> </condition> <condition match="value="" AND NOT $text2$="""> <set token="search_can_proceed">true</set> </condition> <condition match="NOT value="" AND NOT $text2$="""> <set token="search_can_proceed">true</set> </condition> </change> </input> <input type="text" token="text2" searchWhenChanged="true"> <label>TEXTBOX2</label> <default></default> <change> <condition match="value="" AND $text1$="""> <unset token="search_can_proceed"></unset> </condition> <condition match="value="" AND NOT $text1$="""> <set token="search_can_proceed">true</set> </condition> <condition match="NOT value="" AND NOT $text1$="""> <set token="search_can_proceed">true</set> </condition> </change> </input> <input type="time" token="lifeTime"> <label>Select Time</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> </panel> </row> <row> <panel> <table depends="$search_can_proceed$"> <title>QUERY</title> <search depends="$search_can_proceed$"> <query>|makeresults | eval TEXTBOX1=$text1|s$, TEXTBOX2=$text2|s$ </query> </search> </table> <html rejects="$search_can_proceed$"> <h1> Please enter a term for TEXTBOX1 And/Or TEXTBOX2.</h1> </html> </panel> </row> </form> The only drawback to this is that if the tokens are set in the URL - e.g. by a drilldown, then the user will need to make the text box content change before the search is run.

danspav · ‎02-21-2023

Hi @TalNiv , The easiest way is how @gcusello said - update the original dashboard to create two tokens for earliest / latest. You can add this to the section where you create the $time$ token in the original dashboard: <eval token="earliest">tonumber($time$) - 10000</eval> If you don't have access to that dashboard there aren't many options. AFAIK you cannot use URL sourced tokens in the <init> section of your dashboard to do the same eval tag. One very roundabout way is to create a dummy search, and create tokens off that. E.g. put this at the top of your dashboard under the label section: <search> <query>|makeresults | eval earliest=tonumber($time$) - 100000, latest=$time$</query> <done> <set token="earliest">$result.earliest$</set> <set token="latest">$result.latest$</set> </done> </search> Now you can use $earliest$ and $latest$ in your searches.

danspav · ‎10-26-2020

Hi @sweety1309 I think the issue is with the where clause. Say the duration is 108. The where clause will not match on: (duration > 45 and duration <= 75) But will match on: (duration > 105 and duration <= 120) However, the where clause uses AND between these terms, so the duration must be both less than 75 AND greater than 105. Try replacing your ANDs with ORs: | where (duration > 45 AND duration <= 75) OR (duration > 105 AND duration <= 120) OR (duration > 120 AND duration <= 180) OR (duration > 180) Seeing as you don't use the duration field, you could simplify it further: | where (duration > 45 AND duration <= 75) OR (duration > 105)

danspav · ‎10-26-2020

Hi @ershishirkumar, There's a great app available on Splunkbase that tracks all available apps on Splunkbase: Analysis of Splunkbase Apps for Splunk https://splunkbase.splunk.com/app/2919/ It pulls down details about every app on Splunkbase and presents you with a couple of dashboards to explore. There's a section on the main dashboard that compares your installed apps with the latest version on Splunkbase ("local audit"). If you install this app, you could convert the search that performs the local audit to an email alert.

danspav · ‎10-24-2020

Hi @timgren The easiest option to do this is to add a blank panel under the results table and add the inputs to that: If you want to move the inputs to underneath the results table, you can try some CSS like this: First, add IDs to the inputs you want to move - e.g. : <input type="radio" token="radio" id="move_radio"> Then add some CSS to your dashboard: <row depends="$CSS$"><panel><html> <style> #move_txt, #move_radio, #move_check { position:relative; top:555px;z-index:1;} #row2 { margin-top: 200px} </style> </html></panel></row> That gives you this - with room underneath for the next panel: That's prone to issues though as when you resize the window the results panel will also resize, so you may need to adjust the CSS to move the inputs to fit. To be sure, you'd need to add some JavaScript to the dashboard to make sure the inputs moved when the window was resized. Something like this: require(['jquery', 'underscore', 'splunkjs/mvc'], function($, _, mvc) { $( window ).ready(move_inputs); $( window ).resize(move_inputs); function move_inputs( jQuery){ var position = $("#results_panel").position() var height = $("#results_panel").height(); var newtop = position.top + height - 40; console.log("Moving to : " + newtop + "px"); $( "#move_txt" ).css({top:newtop + "px"}); $( "#move_radio" ).css({top:newtop + "px"}); $( "#move_check" ).css({top:newtop + "px"}); } }); That assumes that you have the panel called "results_panel" and ids for the inputs as above.

danspav · ‎10-23-2020

Hi @Ashwini008, I have set this up before using this app from Splunkbase: IMAP Mailbox https://splunkbase.splunk.com/app/1739/ It hasn't been updated in a while, but will still do the job. You will need your exchange admin to configure your account to be IMAP enabled in order to use this. It also works on gmail with IMAP enabled. If you want to use it in Splunk 8.0+ I'd recommend converting it to python3 using 2to3.

danspav · ‎10-23-2020

Hi @mike_nau, Try the following search: |makeresults |eval raw="event_type=queue,item_name=\"xxx/job/3\",queue_time=20 ### event_type=queue,item_name=\"xxx/job/3\",queue_time=30 ### event_type=queue,item_name=\"xxx/job\",queue_time=0.03 ### event_type=job,job_name=\"xxx/job/3\",item_name=\"\",,queue_time=0.03 ### event_type=queue,item_name=\"xxx/job/2\",queue_time=22 ### event_type=queue,item_name=\"xxx/job\",queue_time=0.01 ### event_type=job,job_name=\"xxx/job/2\",item_name=\"\",queue_time=0.01 ### event_type=queue,item_name=\"xxx/job/1\",queue_time=25 ### event_type=queue,item_name=\"xxx/job/1\",queue_time=15 ### event_type=queue,item_name=\"xxx/job\",queue_time=0.19 ### event_type=job,job_name=\"xxx/job/1\",item_name=\"\",queue_time=0.19 " | makemv delim="###" raw | mvexpand raw | rename raw as _raw | extract | eval index="jenkins_statistics" | eventstats values(job_name) as valid_jobs | eval job_name=if(item_name=valid_jobs,item_name, NULL) | stats values(index) as index, count(queue_time), avg(queue_time) by job_name | table index, job_name, "count(queue_time)", "avg(queue_time)" | sort - "avg(queue_time)" The top bit is just generating the data from your table. The real stuff happens with the eventstats command. This will run a |stats type command over the whole data set and add the results to each row. In our case we get a field called "valid_jobs" that has job1,job2,job3. Next we set the job_name fields only if the item_name is the same as one of our "valid_jobs". Then we run stats to get the count and average by job_name Finally, we table out and sort by the average queue time. The result is a table similar to yours: Does that do what you were after?

danspav · ‎10-22-2020

Hi @caioandrades, I'm the developer of the Treview Viz app. I've just posted an update to Splunkbase which will let you specify the color for custom icons and the label. It also works on the other skins, but it looks best on the custom skin. With the update you can include an HTML color code in the "color" field like this: | eval color=if(cpu>80,"#990000", "#009900") You can download the new version from Splunkbase here: https://splunkbase.splunk.com/app/5101/

danspav · ‎10-21-2020

Hi @Rob_O, The Citrix Delivery Controller will have this information, which is available via an API. It's getting the data via the monitoring database, so if you have direct access to the DB you can probably bypass the API. Check out the Citrix developer docs here: https://developer-docs.citrix.com/projects/monitor-service-odata-api/en/latest/#failures The API provides data relating to connection failures - which is what you want. It will show connection attempts that failed, e.g. due to no machines available, or too many concurrent sessions. It will also tell you about successful connections that subsequently dropped out due to other network issues. I'm not familiar with the DB schema, but the data you're looking for will be there.

danspav · ‎10-21-2020

If you are trying to add two numbers from two different searches it's highly likely you can do that in one search using stats. Are you able to share more about each search? Otherwise, you can do an append to combine the two outputs with something like: | makeresults | eval abc=100 | table abc | append [| makeresults |eval xyz=45 | table xyz] | stats sum(abc) as abc, sum(xyz) as xyz | eval total = abc + zyz This search gets your first number, abc, then appends the second number, xyz. Then we run stats to get them on one row, and finally do a simple eval for the total. You could then use this result in a single value visualization on a dashboard. But as I mentioned, you can probably get both totals using stats. See docs for more info.

danspav · ‎10-21-2020

Hi @dkgs, All previous versions of the app up to 1.7.0 are cloud approved, but I've only just submitted version 1.8.0 so it's not approved yet. It's in the approval queue, so I'm hoping it will be available soon.

danspav · ‎10-21-2020

Hi @datracy, I'm a bit late in replying - but in case anyone else has this question - yes, you can set the color of icons. You can add the field "color" to set the color of the from icon. You can set the color of the link by setting a "linkcolor" field. Use hex colors or english words: "red" or "#FF0000" | eval color=case(value==0,"blue", value==1,"yellow",value==2,"green", 1==1, "red") Hope that helps

danspav · ‎12-17-2019

Hi @edvinas, The events in the Event Timeline Viz are listed in time-order. Take this example - two events have the same date, so they appear in the same order as the results: If you have the time axis at the bottom, the events will be flipped, so the order is preserved. The first event in the results is the closest to the axis. If they have different dates, they will appear on the time line in time order. If you want a specific order, can you manipulate the _time field? Perhaps you can give an example of how you want it ordered.

danspav · ‎11-17-2019

Hi @RngFox, I had the same problem with my own apps. It looks like from around Splunk 7.3-ish the word "undefined" appeared under all the fields in the visualization options menu. The work-around is to provide help, or a single space character, so that there is a value to display within the splunk-control-group tag: To show nothing (removing 'undefined'): <splunk-control-group label="Mode" help=" "> To show a helpful message: <splunk-control-group label="Mode" help="Select the mode"> See the Formatter API reference. Updating your formatter.html to include this attribute on all tags will remove the annoying 'undefined' message. Cheers Daniel

Posts	104
Solutions	30
Karma Given	8
Karma Received	58
Member Since	‎04-07-2019

Online Status	Offline
Date Last Visited	‎07-10-2026 12:26 AM

Re: How to make a css script affect only specific...

Re: How to add "Latest" keyword in the reporting d...

Re: How to avoid comma separated delimiter being e...

Re: How to exclude dedup when there is a dropdown ...

Re: Regex field extraction repeating string

Re: How do I calculate HTTP failure Percentage?

Re: Grouping events from bin command to adhere to ...

Re: Replace Characters- How can I replace \\\\ for...

Re: Usage of multiple labels in a multivalue field...

Re: Usage of multiple labels in a multivalue field...

Re: Where can I find CSS for Link List Selected It...

How to make two textboxes work with a submit link ...

Re: Search time range based on epoch token from dr...

Re: Multiple 'Where' conditions

Re: Splunkbase app update alert

Re: Move an input class to bottom of panel

Re: How to read data from email in outlook and ind...

Re: Joining data from multiple events with stats

Re: How to use colors on Tree View

Re: Insight into Citrix VDI

Re: How to compare output of two splunk queries wh...

Re: Network Diagram Viz is supported by Splunk Clo...

Re: Can icons in network diagram viz like firewall...

Re: In Event Timeline viz app: does it possible to...

Re: custom viz formatter.html div.hlp-block

Join the Conversation