Hi, no problem 🙂 So I'm trying to make this dynamic so that if the data changes, the extractions still work and also any new fields get extracted without having to manually create them. So the props/transforms I gave extract all the fields almost as I need. This also includes new fields. So what I need is a way to get splunk to enrich the fields so that we know which field belongs to which RPA. In the example above, I have 8 "Initiator ID" values which anyone searching this data will have no idea what RPA they belong to. So I want splunk to assign the 4 under the RPA1 heading and the second 4 to belong to RPA2. So if a user searches for RPA1, they only get the fields extracted under the RPA1 heading. I hope I'm explaining this ok. Thanks Steve ... View more

Hi Giuseppe, Thanks for the reply. Apologies, I probably should have stated how I'm extracting the fields. transforms: [emc_sourcetype] DELIMS = "\"{\n}\"", ":" FORMAT = $1::$2 MV_ADD = true props: [emc_sourcetype] KV_MODE = none KV_TRIM_SPACES = true REPORT-extractions = emc_sourcetype Thanks ... View more

Hi, Thanks for the reply. I've tried setting it as a token that is defined (help_target) and get the same result. This is the inputs section. <form> <init> <set token="help_target_title">NetApp Volume Details</set> <set token="help_target">NetAppVolumeDetails</set> </init> <label>NetApp Volume Details WIP smoyes</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="system" searchWhenChanged="true"> <label>System Name</label> <search> <query>sourcetype="ontap:system" | stats count by system-name</query> <earliest>-60m@m</earliest> <latest>now</latest> </search> <change> <unset token="Detail_show"></unset> <set token="form.aggregate">*</set> <unset token="Chart_noshow"></unset> </change> <fieldForLabel>system-name</fieldForLabel> <fieldForValue>system-name</fieldForValue> </input> <input type="time" token="time" depends="$details_show$"> <label>Time Period for Capacity Chart</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> ... View more

Thanks aaraneta. I've submitted case 416266 🙂 ... View more

Hi Sorry, Yes, we set the token before the search. This UI removed my code, I've added it back 😉 The way our code works is it defines the token before any panels as the token is used in several charts. This definition is on a search that has the maximums and this maximum is used for each chart so there is a visual representation of use. The chart below is an example. The chart on the left would be the maximum and this maximum would also be used for the chart on the right. !!!! I hate that you can't attach images to comments 😞 Added to the top post. ... View more

Hi Cmerriman, Thanks for the reply. Everything was working and only broke with the upgrade. Anyways, here are the code snippets. Define the token: <input type="dropdown" token="YAxisMax" searchWhenChanged="false" depends="$hidden$"> <search> <query>REALLY BIG SEARCH</query> </search> <fieldForLabel>YAxisMax</fieldForLabel> <fieldForValue>YAxisMax</fieldForValue> <selectFirstChoice>true</selectFirstChoice> </input> Chart code: <row> <panel> <chart> <title>XIV Usage For Each Site by $displayby$</title> <search> <query>REALLY BIG SEARCH</query> <earliest>-60m@m</earliest> <latest>now</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.maximumNumber">$YAxisMax$</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> Hope that helps 🙂 Thanks Steve ... View more

Hi Somesoni2, Thanks for the suggestion, but this will not work in our environment. This needs to be transparent to the end user. I appreciate that we could do an automated lookup, but it will just put the search head under unnecessary load. We have quite a few users that have to run very intense queries that return several hundred thousand events. I just don't see a lookup being a viable solution due to the expense to the search head. Also, not all forwarders are under deployment control 😞 Thanks Steve ... View more

Hi Giuseppe, Many thanks for the suggestion. We did look into this before I posted and it's not feasible as we will have quite a few hundred servers feeding into Splunk. The thought of a lookup being queried hundreds of times a second is frightening. There has to be a more elegant solution. We also don't want end users looking into the _internal index. Thanks Steve ... View more

Hi Neil, That's correct. This seemed like a solution as without it, the YAxisMax dropdown would only ever display the first result from when the dashboard was opened and you'd have to manually select the new value. So the theory was to unset the token after a change so that YAxisMax would be forced to use the new value. ... View more

Hi, Thanks for the replay. These are the versions in use: Splunk Add-on for AWS - 3.0.0 Splunk App for AWS - 4.1.1 Splunk Enterprise - 6.3.0 PagerDuty Incidents - 1.0 Thanks ... View more