I had the same requirement, however my series are being generated dynamically. The overlay is always the last of the series, however there can be between 5 and 10 series, depending on a dropdown selector (that sets a token).  I found I could select the series I want to apply css styling to by using the token value in the css selector.  In my case I first hide all the data labels, and then set the visibility for the last series (the overlay) to visible.  .highcharts-data-label text tspan { visibility:hidden !important; } .highcharts-series-$p2_nr_clusters$ .highcharts-data-label text tspan { visibility:visible !important; } ... View more

There is an easier solution. Click Settings > Searches,reports and alerts > search the name of the correlation Under Actions, click Edit > Advanced Edit > and edit "action.correlationsearch.label" > Save If you refresh the content page , it should be the new name you set it to ... View more

Make sure that you either set or remove this macro from both search stanzas.  [ `set_local_host`]     ... View more

I followed your first recommendation and it hasn't worked for me. In my case I have to distributed search, I have one SH and two IDX. I created the limits.conf file in SH. Should I do it in IDXs? ... View more

Can you try this: Go to the js file which is responsible for your dashboard from: APP_directory/appserver/static/javascript/ Add the following lines into your code    var sub_tok = mvc.Components.get("submitted");  sub_tok.set("earliest", {value for that token});  sub_tok.set("latest", {value for that token});   Dump the splunk and restart your splunk and try again. ... View more

Hi probably it could connect to it, but I’m quite sure that it’s not a supported configuration. For all other components it has said that “server” part must be a higher level. Only exeption (what I have found) is that indexer peers could be a lower level than SHs but also there is remarks that only temporarily. r. Ismo ... View more

I have the same exact problem and I have been unsuccessful in finding a fix.  The unified audit was working with the Oracle queries until a few months back and then it stopped completing successfully (query times out). I even tried increasing the timeout to 3600 seconds and it still failed. Not sure what changed and/or if it's a bug with DBX or with Oracle 12 or both. ... View more

@vikashperiwal unfortunately this will not be just CSS based solution as there is no direct link between Chart series being hovered and tooltip's DOM. You may have to try jQuery based approach. Try to adjust the example as per your needs: https://community.splunk.com/t5/Archive/How-to-change-the-dislay-value-in-graph/td-p/375473 ... View more

@skakehi_splunk This worked perfectly, thank you. But i am not so clear on use of below field in the query. Would you mind explaining to me about in which way it's useful ? | eval _time=StartTime   ... View more

The stats command will return no results if the field used in the 'by' clause is empty. Check that the field in the 'by' clause is spelled correctly and that it has values. ... View more

Hi @niketn  Now, my dashboard panel has the time duration values with the format as "HH:MM:SS.FF" as below: Type, Count, Duration A, 20, 05:10:33.40 B, 50, 04:59:02.66 C, 10, 01:28:57.51 I need the column `Duration` has to be color coded based on highest to lowest duration range. Is there any possibility to get the color coding without using any Java Script ... View more

try this: (index=A ID=xyz) OR (index=B URL_REQUEST_ID=xyz) | rename URL_REQUEST_ID as ID | table index ID .. all the required fields | stats values(*) as * by ID ~~I AM BACK ... View more

The following search reports the amount of physical memory in KB: index=windows sourcetype=WinHostMon | stats latest(TotalPhysicalMemoryKB) as TotalPhysicalMemoryKB, latest(TotalVirtualMemoryKB) as TotalVirtualMemoryKB by host | sort 0 host Notes: This requires the input “OperatingSystem” to be activated in your deployment, using: [WinHostMon://OperatingSystem] interval = 600 disabled = 1 type = OperatingSystem index = windows For the demonstration, let’s store this result in a temporarily lookup csv file: index=windows sourcetype=WinHostMon | stats latest(TotalPhysicalMemoryKB) as TotalPhysicalMemoryKB, latest(TotalVirtualMemoryKB) as TotalVirtualMemoryKB by host | sort 0 host | outputlookup windows_memory_inventory.csv Then, looking at the memory statistics, we have the amount of currently used volume of memory in KB, let’s map this with the inventory data and use some easy calculation: index=perfmon sourcetype="PerfmonMk:Memory" | eval used_memory_KB=coalesce('Available_KBytes', Value) | lookup windows_memory_inventory.csv host as host OUTPUTNEW TotalPhysicalMemoryKB | eval free_memory_pct=((used_memory_KB/TotalPhysicalMemoryKB)*100), used_memory_pct=(100-free_memory_pct) | timechart avg(used_memory_pct) as used_memory_pct by host ~~I AM BACK ... View more

Did you put the new sourcetype in your inputs.conf? The change will only apply to new data. Anything already indexed will be under the old sourcetype. sourcetype = mysourcetype ... View more

If HF only use to receive and forward data to Indexer, HF can be to ignore? ... View more

| search "body.refundTenderType"=* | search "body.refundTenders{}.paymentType"=* | rename body.refundTenderType as "RefundTender" | rename body.refundTenders{}.paymentType as "RefundTenderPaymentType" | stats count AS Count BY RefundTender RefundTenderPaymentType, body.orderNumber add this here | eval Refund = RefundTender . "-" . RefundTenderPaymentType | table Refund , body.orderNumber | chart count by Refund Try this if it works ... View more

Hi Try this | makeresults | eval ALERT_DESCRIPTION ="test For transaction Login . 3 out of 3 transactions failed 1234" | append [| makeresults | eval ALERT_DESCRIPTION ="test FILE_test_file test" ] | append [| makeresults | eval ALERT_DESCRIPTION ="test" ] | eval ISSUE_TYPE=case((match(ALERT_DESCRIPTION,"(FILE_test_file) | (For transaction Login \\. 3 out of 3 transactions failed)")),"Global FIle Issue",true(),"-") ... View more

well, as far as I know, it's not related to query. that's pretty simple query. refer this https://answers.splunk.com/answers/685827/help-with-error-from-a-custom-command-error-search.html https://answers.splunk.com/answers/724469/what-causes-search-auto-canceled.html pls, accept/upvote the answer if it works for you. if you are getting same error again then you could try running a search on index instead of data model if it's not accelerated. ... View more

Thank you very much mayurr98. Worked perfectly! ... View more

try: ((CT=Tier_1 or CT=Tier_2) AND (CPU_used>=50 or mem_used>=50 or mem_alloc>=0.9 or CPU_alloc>=0.9)) OR (CT=Tier_3 AND ( cpu_used>50 OR mem_used>60...)) Please upvote/accept the answer if it works for you. ... View more

@mayurr98 | rex "KB_List\":\"(?[^\"]+)" | table KB_Listed this worked..thanks a ton ... View more

Not sure what exactly is your query but are you trying to get this? index=epackage flow_event=Package* containsAmendedReport="false" | eval Time2 = strptime(strftime(_time,"%F"),"%F"), Quad = case( _time > (Time2 + (09*3600)) AND _time < (Time2 + (11*3600)),"1st", _time > (Time2 + (11*3600)) AND _time < (Time2 + (13*3600)),"2nd", _time > (Time2 + (13*3600)) AND _time < (Time2 + (15*3600)),"3rd", _time > (Time2 + (15*3600)) AND _time < (Time2 + (17*3600)),"4th") | bin _time span=1d | stats sum(numberOfReports) as count by Quad | where count> 300 | stats dc(Quad) ... View more

Update: Moving the hot & warm buckets from the new index location back to the old AND coping the .manifest bucket info from the new to old .manifest worked. ... View more

index=XX sourcetype=XX (earliest=$earliestTime$ latest=$latestTime$) OR (earliest=$earliestTime1$ latest=$latestTime1$) OR (earliest=$earliestTime2$ latest=$latestTime2$) OR (earliest=$earliestTime3$ latest=$latestTime3$) OR (earliest=$earliestTime4$ latest=$latestTime4$) | streamstats values(eval(strftime(_time,"%m%d"))) as label | bin span=5m _time | streamstats values(eval(strftime(_time,"%H:%M:%S"))) as time | chart dc(ecn) over time by label | where time!=$click.value$ What about this query? You have to put "nothing" in $click.value$ in <init> ... View more