Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. a month ago
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
07-21-2020
04:43 AM
1 Karma
@learningsplunk try the following, where token from the text box is $Stocks$ | inputlookup Stocks.csv where Stock_ticker="*$Stocks$*"
| stats count
... View more
07-20-2020
07:10 AM
1 Karma
@nagas as per your question if you want the stats last week till day of the week (same as today's day that week) and also current week till today's day, you can try and adjust the following run anywhere example as per your needs: index=_internal sourcetype=splunkd log_level!=INFO earliest="-1w@w0" latest=now
| eval window=case(_time>=relative_time(now(),"-1w@w0") AND _time<=relative_time(now(),"-1w@s"),"Last Week",
_time>=relative_time(now(),"-0w@w0") AND _time<=relative_time(now(),"-0w@s"),"Current Week")
| stats sum(date_hour) as Transaction_count min(_time) as EarliestEventTime max(_time) as LatestEventTime by window
| fieldformat EarliestEventTime=strftime(EarliestEventTime,"%Y/%m/%d %H:%M:%S")
| fieldformat LatestEventTime=strftime(LatestEventTime,"%Y/%m/%d %H:%M:%S") If you need to do such comparison based on selected date in the past week, you may need to pass the epoch time as token to the SPL above and replace now() with that date. Please try out and confirm!
... View more
07-20-2020
06:47 AM
1 Karma
@alrisha as of now only font color seems to be available configuration for viz elements like table in Beta Dashboard : https://docs.splunk.com/Documentation/DashApp/latest/DashApp/chartsTable You can definitely put in the idea for CSS style configuration for visualizations in Beta Dashboard app using ideas.splunk.com by navigating to Apps & Add On > Supported Apps > Dashboard App (Beta) Do vote other features you think are necessary.
... View more
07-20-2020
05:47 AM
1 Karma
@philipp the reason why I had asked those question was to gauge how you can create re-usable sections in your dashboard. 1) Using tokens for SPLs inside same panel will help you a bit with the dropdown options running same search/panel but with different SPL with token. (All will still need to show all panels). 2. On similar lines as above, even Prebuilt Panel in your case will take the panels out of the current Simple XML and place them as separate code. It will only help you reduce actual lines of Simple XML code for various Dropdown options like Component and Environment as they can be passed to Prebuilt panels as tokens. 3. If you had slight design change to show same type of visualization like all Columns charts together and all Line charts together, you could have taken advantage of Trellis layout to split by Component and Environment. Then you will actually have only two panels searches one for Column Chart and another for Line chart and based on the dropdown value the Chart Splits will happen dynamically (including All condition). 4. Best fit seems to be Simple XML JS extension with Splunk JS stack to build viz based on options selected. Simple XML will only pass the Search to be executed and possibly chart type/config. While this would be helpful to reduce code if you have several searches and each search splitting out in several charts, you are right that code reduction will result in complexity introduced by the JS layer. You have to pick and choose how much Simple XML code you want to reduce vs option you can adopt. Also is the code reduction for reducing the disk usage by Simple XML dashboard or for better readability by developers (for the later Simple XML source code editor does provide the option to expand/collapse specific Simple XML element.)
... View more
07-20-2020
05:07 AM
@Lakshman Sorry I did not get the new requirement. As far as you are showing slices in your pie by alert level you can use pie or donut representation. However, for over 200 ids to be represented across various alert levels you may need Bar, Line chart or something else depending on what exactly you need to plot. Your new request seems SPL challenge that should be posted in Search help with your data sample current Splunk Search and issue you are running into with expected result for addressing the issue better. Do up vote the answers and accept if your issue posted is resolved!
... View more
07-20-2020
05:01 AM
@manish_singh_77 , based on the details provided, although actual value of the tokens are dynamic, the number of tokens are static. If you want them as Under label it kind of implies that no. of single values in your Trellis layout is also statically fixed to 5 single values. So following are your options including the previous answers which is still applicable: Option 1: Create separate panel with single value where Caption can be passed as tokens. As per details provided you will have 5 (static) splits of Single Value. Option 2: Add tokens to SPL which powers the single value trellis. Once the values of tokens are resolved in the SPL, concatenate the value with the Trellis split by field using eval command. This will make the values from token appear as Trellis title which you can position as caption using Simple XML CSS override. Option 3: Below the Trellis layout create a Row with 5 html panels and assign the tokens as div sections in those panels. Use CSS override to let the html panel stick underneath the Trellis panel and it will make them appear as caption for Single Value trellis.
... View more
07-19-2020
07:40 AM
1 Karma
@galsegal Try adding the following condition to find whether true value is present within JSON field message.anomaly.features.anomaly{} | eval isTrue=if(('message.anomaly.features.anomaly{}'="true"),1,0) The field isTrue evaluates to 1 if there is true value identified in respective field. If not it evaluates to 0. PS: If you want to filter only events with one of the values as true instead of eval you can directly use search i.e. | search "message.anomaly.features.anomaly{}"="true" Following is a run anywhere example based on one of the sample data provided. | makeresults
| eval _raw="
{
\"message\":{
\"anomaly\":{
\"features\":{
\"anomaly\":[
\"false\",
\"true\",
\"false\",
\"false\"
]
}
}
}
}"
| append
[| makeresults
| eval _raw="
{
\"message\":{
\"anomaly\":{
\"features\":{
\"anomaly\":[
\"false\",
\"false\",
\"false\",
\"false\"
]
}
}
}
}"]
| spath
| fields - _raw _time
| eval isTrue=if(('message.anomaly.features.anomaly{}'="true"),1,0) Please try out and confirm!
... View more
07-19-2020
07:23 AM
@dokaas_2 seems straightforward use case for Image Overlay in Simple XML for which there is already example in the Splunk Dashboard Examples app (also several others on Splunk Community answers). Nevertheless since you have already used SVG app and got it working in Simple XML just wanted to update that this would be really easy use case for Splunk Dashboard App Beta with SVG Choropleth viz. Check out the following blog: https://www.splunk.com/en_us/blog/tips-and-tricks/dashboards-beta-v0-5-svg-choropleths-unleash-your-inner-picasso.html
... View more
07-19-2020
07:19 AM
1 Karma
@loginsoft Build the input through Splunk Add On Builder app which allows you to keep a track of already indexed check point. Besides you also can extend the underlying python with your customization to ensure that already indexed data is ignored. Read the documentation for setting the checkpoint value (also covers how to set it for JSON data): https://docs.splunk.com/Documentation/AddonBuilder/latest/UserGuide/ConfigureDataCollection
... View more
07-19-2020
07:11 AM
1 Karma
@vikashperiwal try the following Reg Ex based approach with a run anywhere example that you can change with your SPL. Essentially just try the following regex | rex field="Field_ID" ("?<Field_ID>[^|\/]+.json"). If the regex does not work you may have to further test and modify regex as per your actual data as the following regex is based only on the sample data provided in the question. | makeresults
| fields - _time
| eval Field_ID="umt_nic_rbg_config.json;mrd.json;rbg_config.json;nic_rbg_config.json;/apps/dat/smrdau/xyz/mrd/temp/umt_nic_rbg_config.json_bu1595098800;/apps/dat/amrdau/xyz/mrd/temp/mrd.json_date=202;/apps/dat/amrdu/xyz/mrdap-ingestion/temp/rbg_config.json_business;/apps/dat/amrdau/xyz/mrdap/temp/nic_rbg_config.json_bdate=2020"
| makemv Field_ID delim=";"
| mvexpand Field_ID
| rex field="Field_ID" ("?<Field_ID>[^|\/]+.json")
... View more
07-19-2020
07:00 AM
1 Karma
@manish_singh_77 in past for similar use case, instead of using Under Label that can not be dynamic for Single Value Trellis, I had added the Under Label to the aggregation split by field. That would make the title for each of trellis layout viz. Then I would apply CSS override to move y-axis position by 150px-180px so that it would appear below the value in the viz as Under Label instead of title. I am unable to find the answer on communities, but hope you get the idea.
... View more
07-19-2020
06:56 AM
@manish_singh_77 the answer to this question lies in HTML independent of Splunk. You need to set an id for element like row/panel or table where you want to set the focus to go on drilldown. I would prefer panel containing table so that selection is in focus but not selected (hihglighted). Step 1: To make this solution generic, get the current Splunk App Name and Current Dashboard Name from Global tokens using independent search: <search>
<query>| makeresults
| fields - _time
| eval appName="$env:app$",dashboardName="$env:page$"</query>
<done>
<set token="appName">$result.appName$</set>
<set token="dashboardName">$result.dashboardName$</set>
</done>
</search> Step 2: Give id to the panel containing drilldown table i.e. <panel id="drilldown_focus_element"> Step 3: While setting the drilldown token from Single Value Trellis, set the link to same app/dashboard to focus on element using #drilldown_focus_element <drilldown>
<set token="tokName">$trellis.value$</set>
<link>/app/$appName$/$dashboardName$#drilldown_focus_element</link>
</drilldown>
... View more
07-18-2020
08:27 AM
Based on the original ask, my intent was to show you how to use the SPL to perform validations you need. I would expect you to incorporate any further validations as per your needs. I am not sure why you want to treat a URL without https and http as valid URL. Nevertheless take advantage of SPL and add as many validations you need! Do upvote the answers that helped!
... View more
07-17-2020
03:28 PM
@khojas02 yes this would be possible with Splunk. Could you elaborate on the conditions that are possible with Metrics ID? Please refer to following couple of answers which document three options to do it depending on whether you want to use JS or not. https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-highlight-a-table-cell-based-on-a-field-of-the-search/td-p/455645 https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-font-color-based-on-a-condition-for-a-particular/td-p/487257
... View more
07-17-2020
03:21 PM
@bowesmana <finalized> is not supported search event handler since version 6.5 use <done> instead. Refer to the latest list of supported search event handlers: https://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#Search_event_handlers
... View more
07-17-2020
03:17 PM
@anilchaithu there is already an app built for this. Refer to Image Viewer Custom Visualization on Splunkbase. If that is not what you are looking for please provide more details on what you are trying and what is not working?
... View more
07-17-2020
03:10 PM
1 Karma
@hrs2019 you can use an independent search to pass the URLs from text box to SPL and process to validate whether it matches your Upto 5 URL criteria and all URL beginning with https criteria. Following is a run anywhere sample dashboard for above example. Please try out and confirm! <form>
<label>Text Box Validation</label>
<search>
<query>| makeresults
| eval url="$url$"
| eval url_count=split(trim(url),",")
| rex field=url "(?<url_type>(https|http))" max_match=0
| eval boolValidationURLCount=case(mvcount(url_count)<=5,"true",true(),"false")
| eval boolValidationURLCondition=case(url_type="https" AND url_type!="http","true",true(),"false")</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<done>
<condition match="$result.boolValidationURLCount$=="true" AND $result.boolValidationURLCondition$=="true"">
<set token="tokValidURLs">$result.url$</set>
</condition>
<condition match="$result.boolValidationURLCount$=="false" AND $result.boolValidationURLCondition$=="false"">
<set token="tokValidationError">Only upto 5 URLs allowed. URL must start with https</set>
<unset token="tokValidURLs"></unset>
</condition>
<condition match="$result.boolValidationURLCount$=="false" AND $result.boolValidationURLCondition$=="true"">
<set token="tokValidationError">Only upto 5 URLs allowed.</set>
<unset token="tokValidURLs"></unset>
</condition>
<condition match="$result.boolValidationURLCount$=="true" AND $result.boolValidationURLCondition$=="false"">
<set token="tokValidationError">URLs must start with https</set>
<unset token="tokValidURLs"></unset>
</condition>
</done>
</search>
<fieldset submitButton="false">
<input id="splunk_input_text_url" type="text" token="url" searchWhenChanged="true">
<label>Enter Upto 5 URLs (https ONLY)</label>
<default>https://www.facebook.com,https://www.gmail.com,https://www.amazon.com;https://www.splunk.com,https://yahoo.com,https://se.ccp.com</default>
</input>
</fieldset>
<row>
<panel>
<html rejects="$tokValidURLs$">
<style>
#splunk_input_text_url{
width: 1220px !important;
}
</style>
<div>
<b style="color:red">$tokValidationError$.</b>
</div>
<div>
Please validate input <b style="color:red">$url$</b>!!!
</div>
</html>
<table depends="$tokValidURLs$">
<title>Table with valid URLs</title>
<search depends="$tokValidURLs$">
<query>| makeresults
| fields - _time
| eval URL="$tokValidURLs$"
| makemv URL delim=","
| mvexpand URL
| rex field=URL "(?<URL_Type>(https|http))"
| table URL, URL_Type</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>
... View more
07-17-2020
02:58 PM
@durgave please provide volume details for each of your data sources. Time is hard-coded in one of your Sub Searches but not all. Any specific reason? Since you are not performing any aggregation, please restrict the number of fields to only required for each index before the dedup command using something like | fields yourField1 yourField2 | dedup yourField1 Refer to .Conf session around Master joining your dataset without using the join command.
... View more
07-17-2020
02:48 PM
@abbijagare do you need help with Search query or Visualization? Nevertheless share what you have tried and is not working for you? What does your data and Search query look like? Please mock/anonymize and sensitive data/code before posting.
... View more
07-17-2020
02:45 PM
@ankursaxena2020 seems like you accepted my question as answer by mistake. If your query is already resolved it is possibly based on Rich's answer. So accept his answer if no further queries!
... View more
07-17-2020
02:41 PM
@g-money ideally you should not add Javascript (rather any static resources) from external website without knowing the complete code. This will open up your app/web page to cross site insecure contents and XSS attack. Splunk4Good provides you with several insightful Covid dashboards along with github repo for you to build your based on your data source, please see if that would suit your needs. https://covid-19.splunkforgood.com/hub Having said that, there are two ways you can use internet based static JS file reference. 1. Convert an Empty Simple XML Dashboard to HTML Dashboard and past the HTML content as is in the html section of the HTML dashboard. 2. For Simple XML JS extension, add a dummy JS file to your Splunk Apps's appserver/static folder and reference web based JS file in that dummy JS file. Please find below Example of Simple XML JS Extension approach as HTML Dashboard would be straight forward. PS: Use at your own caution as stated earlier. Following is the Simple XML Dashboard code (notice <script> section is not added to the <html> panel): <dashboard script="cdc_covid_dummy.js">
<label>CDC Covid Dashboard</label>
<row>
<panel>
<html>
<div data-post-id="50079" data-site-id="499" data-site-root-folder="coronavirus" class="mb-3" data-host="www.cdc.gov" data-theme="theme-cyan" data-cdc-widget="cdcMaps" data-config-url="/coronavirus/2019-ncov/cases-updates/us-case-count-maps-charts/map-cases-us-CaseOnly_Desktop.json">
</div>
</html>
</panel>
</row>
</dashboard> Following is the required JS file cdc_covid_dummy.js to be placed under your Splunk app's appserver/static folder (may require refresh, bump or restart of Splunk instance and also clearing of web browser history): require(['//tools.cdc.gov/TemplatePackage/contrib/widgets/tp-widget-external-loader.js',
'splunkjs/mvc/simplexml/ready!'
], function () {
// Dummy JS to link CDC JS over Web
}); Please try out and confirm! Recommended approach would be to use Splunk4Good code and plug in your data source. Do UPVOTE if this reply helps 🙂
... View more
07-17-2020
02:07 PM
@ankursaxena2020 you have given two conditions for Prod, what if environment is not Prod, how do you want to handle those conditions?
... View more
07-17-2020
02:04 PM
1 Karma
If you want to reduce the content of Simple XML and re-use same panel code over different dashboards, prebuilt panel is the way. However, if it is just readability, the source code editor allows you to expand collapse specific sections of code manually when you are editing. If your intent is to just change the tokens for various panels, why not create single panel with all the elements that change as tokens? Ideally if your use case is more complicated, you should resort to JS. Specific reason for avoiding JS? For the two sample panels in your question do you have the actual code which you have right now and what is expected to be changed.
... View more
07-17-2020
12:34 PM
1 Karma
Your sample data seem to work out of the box for me. Only issue that I see is that you do not have Time field in your data, which implies you need to set Time to CURRENT for each csv file event. Following is the props.conf setting for a dummy sourcetype I created to ingest your data. [ sample_data_csv ]
DATETIME_CONFIG=CURRENT
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
BREAK_ONLY_BEFORE_DATE=null
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
category=Custom
description=Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled=false
pulldown_type=true
HEADER_FIELD_LINE_NUMBER=1 As per the sample data provided in the question following are the extracted fields by default. But I still added HEADER_FIELD_LINE_NUMBER=1 and DATETIME_CONFIG=CURRENT config (you must check and confirm the date information whether it can be the time of file forward or it has to be supplied within the CSV). And following is the query I tried and worked. PS : I had added INDEXED_EXTRACTION = csv in the props.conf for tstats to work. So in case even after applying props.conf like the one above fields are not getting extracted, you would need to ensure whether your csv is valid UTF8 format CSV with no special characters or not. In case you need further help you might have to share your props.conf or sample CSV file.
... View more
07-17-2020
11:18 AM
1 Karma
@srewarrior if you would notice the series name in Legend of your screenshot, your stats aggregation is changing the field name from total_time to values(total_time). Because of this the field total_time is not available for subsequent eval. So try changing your search to index=xxx_website_monitoring sourcetype=web_ping https://my.website.com
| stats values(total_time) as total_time by _time
| eval red = if(total_time>=500,total_time,0)
| eval yellow = if(total_time<500 AND total_time>=300,total_time,0)
| eval green = if(total_time<300, total_time, 0)
| table _time red, yellow, green Following is a run anywhere example based on the SPL, sample screenshot provided. Please try out and confirm. PS: You would need to replace the run anywhere data generation with your actual index search for SPL to work with your data. <dashboard theme="dark">
<label>Color By Range</label>
<row>
<panel>
<html>
<style>
#total_time_kpi g.highcharts-legend-item text tspan:nth-child(2){
font-size:110% !important;
font-weight:bold !important;
fill:lightgrey !important;
}
</style>
</html>
<chart id="total_time_kpi">
<search>
<query>| makeresults count=288
| eval delta=300
| accum delta
| eval _time=_time-delta
| eval total_time=substr(tostring(random()),1,3), url="https://clarifier238e601.eclarifier.com"
| table _time total_time url
| search url=TERM("https://clarifier238e601.eclarifier.com")
| stats last(total_time) as total_time by _time
| eval redCritical = if((total_time >= 500),total_time ,0)
| eval yellowWarning = if(total_time >=300 AND total_time <500,total_time ,0)
| eval greenOK = if(total_time <300,total_time ,0)
| table _time redCritical,yellowWarning,greenOK</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">area</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{"redCritical":"#DC4E41","yellowWarning":"#F8BE34","greenOK":"#5CC05C"}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">seriesCompare</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</dashboard>
... View more
