@niketnilay this is kinda what im looking for the first scenario: So the table would populate those line markers/annotations based on the user inputting the time and comment that they have for them. ... View more

@niketnilay thanks for getting back to me!..Its pretty much the same as what you answered in that question above.. however: - Is there a way to annotate manually based on a table - EG - I build a | table with _time, comment - this can then populate the chart at the time specified in the table, with the comment associated with it(think ES workflow where the analyst pastes a note/comment at a certain time -- except this is a much poorer version 🙂 ) The other thing im looking to do with annotations is to highlight a specified day.. like tell me when today is, or last monday(but not on a timechart - just a normal chart) Do you have any thoughts on this? ... View more

Awesome, thanks! ... View more

Thanks alot!! ... View more

@vnravikumar thanks for getting back to me!.. Looks exactly like what I need however im not sure how it relates to my dashboard(dont speak JS at all) .. would you be able to give me a small working example of how splunks xml should correlate to the fields in the JS example? I would reverse engineer thee Layer8 app but its no longer available. ... View more

@cmerriman thanks for getting back to me! The problem is that if I dont escape everything it will not dump it all to the csv file which kinda breaks my dashboard.. Escaping everything works but doesnt make a good default/initial value because obviously it wouldnt run the case statement first time round. ... View more

@niketnilay I have implemented this, however it seems that if i add an append in the js button for the outputlookup(as i dont want it to overwrite the values each time but build a long list of whatever is saved) it created 2 items per click each time. Do you know how to resolve this? ... View more

Thanks alot for the help!! ... View more

@kamlesh_vaghela no joy - still does the infinity save loop 😕 .. my thoughts are that it must just be endlessly running the outputlookup one tokSave is clicked. I cant see anything int he console that implies its constantly running. Could it be a splunk process? ... View more

Here is a portion of the xml dashboard <query>| inputlookup "savename".csv where reading="$reading$" |tail 1 | table reading periodCutter stdevLoTolerance stdevHiTolerance timeRange_earliest timeRange_latest </query> <done> <condition match="$job.resultCount$!=0"> <set token="form.timeRange.earliest">$result.timeRange_earliest$</set> <set token="form.timeRange.latest">$result.timeRange_latest$</set> <set token="form.reading">$result.reading$</set> <set token="form.periodCutter">$result.periodCutter$</set> <set token="form.stdevLoTolerance">$result.stdevLoTolerance$</set> <set token="form.stdevHiTolerance">$result.stdevHiTolerance$</set> <set token="timeRange.earliest">$result.timeRange_earliest$</set> <set token="timeRange.latest">$result.timeRange_latest$</set> <set token="reading">$result.reading$</set> <set token="periodCutter">$result.periodCutter$</set> <set token="stdevLoTolerance">$result.stdevLoTolerance$</set> <set token="stdevHiTolerance">$result.stdevHiTolerance$</set> </condition> </done> <query>| makeresults | eval tokSave="$tokSave$" | fields - tokSave | eval timeRange_earliest="$timeRange.earliest$" | eval timeRange_latest="$timeRange.latest$" | eval reading="$reading$" | eval periodCutter="$periodCutter$" | eval stdevLoTolerance="$stdevLoTolerance$" | eval stdevHiTolerance="$stdevHiTolerance$" | eval tokDashboardName="$env:page$" | outputlookup append=true "savename".csv ... View more

@kamlesh_vaghela thanks for getting back to me! Its not so much that it doesnt work - it is saving stuff, the problem is that it saves continuously - so if i click save once, it will always save everything while im working on the dashboard until I hit the refresh button - this is not the behaviour I want.. I only want it to save stuff when I click the save button each time and then stop saving straight after. The reason for this is that im dumping the saves to a lookupfile which then gets re-read into the dashboard.. so obviously if it keeps continuously saving stuff without my input it will be saving the wrong thing and overcrowding the csv(its appending). ... View more

@niketn thanks for getting back to me! I have implemented a version with the HTML link above but the client would also like an option of not using HMTL, hence using the above method described.. I am using your dashboard as per my above mention in the dashboard and reconfigured it to do what I want(I just replaced the tokens and added a tail - | inputlookup "$env:app$_$env:user$".csv where tokLogLevel="$tokLogLevel$" |tail 1 | table tokTime_earliest tokTime_latest tokLogLevel ) So now if i select loglevel error with a 4h time range and hit save, it saves it so that if i then select something else and decide to come back to loglevel=error etc, it will recall the saved settings - job almost done. The problem im facing now is that that save button JS seems to be stuck in an endless loop - so after I hit save it keeps "listening" and records everything i select on the dashboard to the lookup file. EG, it is not saving per click - its in a constant saving state until i refresh the page. Do you have any idea how i would stop that behaviour so that it only saves when I click on the save button? Thanks! ... View more

@niketnilay how would I go about implementing this in the KV store? Ive got it working with lookups.. ... View more