@koreanfather I did have an answer to add % or same prefix/suffix on y-axis. However, this seems like a data mapping based replacement of y-axis, which is indeed a difficult challenge to implement. I can try to have a look in some spare time 🙂 But see if you can use the following answer along with Data parsing through Custom cell renderer to solve your issue: https://community.splunk.com/t5/Splunk-Search/How-to-change-the-Y-axis-label-on-a-chart-overlay/td-p/390762 Could you add details on what is there on x-axis so that we can see if there is an alternate visualization for your needs? ... View more

@koreanfather can you add a mockup of what kind of output you are looking for? It can be whiteboard or sketch as well. The y-axis value (numeric) is used to plot the height of column or line chart. If you do not have the value how would you plot the height? ... View more

@vikashperiwal worked fine for me on Splunk 8.x which version are you trying and what error do you see? I have tried two approach one through $click.value$ and other through $row._time$ <drilldown> <eval token="form.tok_time">round($click.value$,0)</eval> <set token="clickedRowTime">$row._time$</set> <eval token="clickedRowTimeEpoch">round(strptime($row._time$,"%Y-%m-%dT%H:%M:%S.%3N%z"),0)</eval> </drilldown> https://community.splunk.com/t5/Splunk-Search/Drilldown-pass-the-earliest-and-latest-from-a-timechart/td-p/337915 Following is the run anywhere example that I tried:   <form> <label>Table with drilldown</label> <fieldset submitButton="false"> <input type="time" token="tokTime" searchWhenChanged="true"> <label></label> <default> <earliest>-60m@m</earliest> <latest>now</latest> </default> </input> <input type="text" token="tok_time"> <label></label> <default></default> </input> </fieldset> <row> <panel> <title>tok_time: $tok_time$ | clickedRowTime: $clickedRowTime$ | clickedRowTimeEpoch: $clickedRowTimeEpoch$</title> <table> <search> <query>index=_internal sourcetype=splunkd log_level!=INFO | timechart count as ERROR</query> <earliest>$tokTime.earliest$</earliest> <latest>$tokTime.latest$</latest> <sampleRatio>1</sampleRatio> </search> <!-- Convert string time format not epoch --> <!-- 2020-07-15T12:35:20.000+05:30 --> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <eval token="form.tok_time">round($click.value$,0)</eval> <set token="clickedRowTime">$row._time$</set> <eval token="clickedRowTimeEpoch">round(strptime($row._time$,"%Y-%m-%dT%H:%M:%S.%3N%z"),0)</eval> </drilldown> </table> </panel> </row> </form>   ... View more

@vishaltaneja070 are no. of rows and columns in your viz static or dynamic? If they are static, have you checked out Dashboard Beta app on Splunkbase which should make this use case really easy: https://splunkbase.splunk.com/app/4710/ If the tables columns/rows are dynamic can you not try CSS extension to ensure that the table output looks like that in the screenshot. Ensuring dynamic table rather than static image. ... View more

@Lakshman can you try out Semicircle Donut Chart viz Custom Visualization from Splunkbase, for your use case which will allow you to color the slices based on the SLA field.   Following is a run anywhere example based on the sample data and use case provided.   <dashboard> <label>Color Slice by Value</label> <row> <panel> <title>Semicircle Donut</title> <viz type="semicircle_donut.semicircle_donut"> <search> <query>| makeresults | eval data="6,1234;2,3456" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval alert_level=mvindex(data,0), id=mvindex(data,1), color=case(alert_level==6,"red",alert_level==2,"green",true(),"grey") | table id alert_level color</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="semicircle_donut.semicircle_donut.colorField">color</option> <option name="semicircle_donut.semicircle_donut.cutoutPercentage">50</option> <option name="semicircle_donut.semicircle_donut.legendPosition">right</option> <option name="semicircle_donut.semicircle_donut.type">full</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> </row> </dashboard>  Please try out and confirm! ... View more

Just wanted to confirm with you what is the Date format you are passing is it relative time or absolute like Date Range? Also can you add some sample data and screenshot of example? If you have Splunk Entitlement, work with Splunk Support to find the root cause, workaround and solution of the issue. I am curious if you are hitting the following bug (please check and confirm): https://community.splunk.com/t5/Dashboards-Visualizations/7-1-Dashboards-not-converting-timepicker-to-timezone/td-p/399430 ... View more

@lping you should have accepted the previous elaborate answer, as that covered the solution for the issue posted. However, do upvote the comments / answers that assisted resolving your issue! ... View more

@andrewtrobec understand the rendering as the format for the table. For example the Range Colors that need to be applied on the table cells. Even when the data changes, the cell values will still render based on the range colors already defined in the table format renderer. If you need to change it every time based on event like on click token change in your case, then you can handle the same in JS. There could be something like the following past answer of mine that can be used. You may have to change it to set refresh token that refreshes the SPL as well after renderer change so that content gets updated. https://community.splunk.com/t5/Dashboards-Visualizations/How-to-add-css-class-to-table-field-by-input-in-Splunk/td-p/309775 For the SPL based approach if you do not want to show reload time (re-run of SPL), you can try post processing as in my example. Finally if above options seem too much round about, you can definitely reach out to support to see if this can be fixed.  ... View more

@andrewtrobec you will have to ensure that table re-renders with the new setting each time token changes, which can be done only via JS. The approach that you are using renders the table with initial fields settings but does not change afterward as the table render remains the same.  As an alternative you can control fields directly via SPL if you want to keep changes to Simple XML. Following is a run anywhere example based on code provided by you. <form> <label>Show fields in table</label> <init> <set token="tok_fields">"source"</set> </init> <search id="bSearch"> <query>index=_internal | stats count by source user | sort - count | head 10 </query> <earliest>-1h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <fieldset submitButton="false"> <input type="checkbox" token="tok_show_user"> <label></label> <choice value="*">Show user</choice> <change> <eval token="tok_fields">if($tok_show_user$="*","\"source\",\"user\"","\"source\"")</eval> <unset token="tokReload"></unset> </change> </input> </fieldset> <row> <panel> <table> <search base="bSearch"> <query>| fields $tok_fields$</query> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form>   ... View more

@ssadanala1 do you mean token picker or time picker? Could you add more details about your use case? What are the two SPLs that you want to run and what is the condition based on token? Based on the details about your use case seems like you do not need map command. You can use input <change> event handler or an independent search. ... View more

@bowesmana it would be a combination of following 2 answers of mine https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-a-dashboard-as-value-in-dropdown-of-another/td-p/327727 https://community.splunk.com/t5/Dashboards-Visualizations/Report-of-Dashboard/td-p/492121 ... View more

@architkhanna  check what is your logged in User Time Zone. Is it GMT or IST? https://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureuserswithSplunkWeb ... View more

@uptoNoGood If you refer to screenshot on Splunkbase, one of the splits is the description (and the same split is displayed on left axis as well as tooltip). Also Splunk Built Custom Visualizations always come with example dashboard and similar example is also present in the dashboard. ... View more

@sarithapguptha refer to one of my older answers on similar lines: https://community.splunk.com/t5/Dashboards-Visualizations/Add-percent-sign-on-a-stacked-column-chart-data-label/td-p/345399?childToView=598113#answer-598113 ... View more

Understood. Yes granular restrictions can be applied via JS. If users don't have access to edit Simple XML then even my proposal would also work. Consider this, if someone can edit the XML then they can also remove the JS script from bein called. from the dashboard. ... View more

@dharudiya does your index have data for all 10 services? If not it will only show the service for which data is available for selected filter/s including time. Even if you forcefully displayed remaining 9 panels they will be empty. Do you really want your dashboard space to be filled with 90% empty space? If so please add more details on what you want to display for empty panels? ... View more

@akvern please add more details for the community to assist you better. Is it a table of chart drilldown from source dashboard to Dashboard A or Dashboard B? Can you share some screenshot, sample code and data? Please mock/anonymize any sensitive information. ... View more

@bowesmana instead of using navigation default.xml, can you create a prebuilt panel with menu options built using Simple XML and REST API so that you can control which navigation option to show and which one to hide? Then include prebuilt panel in all your dashboards? ... View more

@pavanml the use case for All and All filtered values are different. Seems like you are after the second use case. Please try the following run anywhere example and confirm   <form> <label>Pass all filtered values</label> <fieldset submitButton="false"> <input type="time" token="time" searchWhenChanged="true"> <label></label> <default> <earliest>-60m@m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="log_level" searchWhenChanged="true"> <label>Log Level</label> <choice value="*">All</choice> <fieldForLabel>log_level</fieldForLabel> <fieldForValue>log_level</fieldForValue> <search> <query>index=_internal sourcetype=splunkd | stats count by log_level | sort log_level | fields log_level</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <default>*</default> </input> <input type="dropdown" token="component" searchWhenChanged="true"> <label>Component</label> <choice value="all">All</choice> <fieldForLabel>component</fieldForLabel> <fieldForValue>component</fieldForValue> <search> <query>index=_internal sourcetype=splunkd log_level="$log_level$" | stats count by component | sort component | fields component | eventstats values(component) as components | eval components="\"".mvjoin(components,"\",\"")."\""</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <done> <condition match="$job.resultCount$==0"> <unset token="tokComponentFilter"></unset> </condition> <condition> <set token="tokComponents">$result.components$</set> </condition> </done> </search> <change> <condition value="all"> <set token="tokComponentFilter">$tokComponents$</set> </condition> <condition> <set token="tokComponentFilter">$value$</set> </condition> </change> <default>all</default> </input> </fieldset> <row> <panel> <html>tokComponentFilter: $tokComponentFilter$ </html> </panel> </row> <row> <panel> <table> <search> <query>index=_internal sourcetype=splunkd component IN ($tokComponentFilter$) | chart count by component log_level</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>       ... View more

@bmendez0428 try replacing button section in HTML (between Dashboard Title and first row) i.e. <div style="float: right;"> <input type="button" onclick="location.href='tem_search_ui_html?form.sTime.earliest=-24h%40h&form.sTime.latest=now';" value="Go to Search Screen" /> <input type="button" onclick="location.href='http://spwaitbussvs/ts/itbs/tem/Shared%20Documents1/Automation/QA%20Availability%20Dashboard%20issue%20tracker.xlsx';" value="Issue log" /> <input type="button" onclick="location.href='http://spwaitbussvs/ts/itbs/tem/Shared%20Documents1/Automation/TEM%20QA%20Availability%20Dashboard%20FAQ.docx';" value="FAQ" /> <p></p> </div>   With the following   <div id="row_header" class="dashboard-row dashboard-row1"> <div id="panel_header" class="dashboard-cell" style="width: 100%;"> <div class="dashboard-panel clearfix"> <div class="panel-element-row"> <div id="html_header" class="dashboard-element html" style="width: 100%"> <div class="panel-body html"> <style> #element1 th[data-sort-key="Application Name"], #element1 th[data-sort-key="Test Case"]{ width: 10% !important; padding-left: 0px; padding-right: 0px; } #element1 th[data-sort-key^="QA"], #element1 th[data-sort-key^="STG"], #element1 th[data-sort-key^="PVE"]{ width: 8% !important; padding-left: 0px; padding-right: 0px; } div.panel-body.html{ display: flex; padding-left: 0px !important; padding-right: 0px !important; } #html_header #button_options{ width: 10% !important; border-style: solid; } #html_header .p.swimlane{ width: 10% !important; } #html_header div.p{ border-style: solid; text-align: center; } #html_header div.p{ width: 8% !important; } #html_header .p.Major_Release{ width: 16% !important; } #html_header #button_options a{ border-width: 2px; border-style: solid; border-radius: 50%; margin-right: 5px; } #html_header #button_options a i{ text-align: center; width: 15px; } </style> <div id="button_options"> <a onclick="location.href='tem_search_ui_html?form.sTime.earliest=-24h%40h&form.sTime.latest=now';" title="Go to search screen"> <i class="icon-search"></i> </a> <a onclick="location.href='http://spwaitbussvs/ts/itbs/tem/Shared%20Documents1/Automation/QA%20Availability%20Dashboard%20issue%20tracker.xlsx';" title="Issue log"> <i class="icon-menu"></i> </a> <a onclick="location.href='http://spwaitbussvs/ts/itbs/tem/Shared%20Documents1/Automation/TEM%20QA%20Availability%20Dashboard%20FAQ.docx';" title="Issue log"> <i class="icon-question"></i> </a> </div> <div class="p swimlane"> <p>Swimlane Upcoming Releases</p> </div> <div class="p asm"> <p>ASM</p> </div> <div class="p may_mr"> <p>May MR</p> </div> <div class="p april_mr"> <p>April MR</p> </div> <div class="p dry_run"> <p>Dry Run</p> </div> <div class="p AUP_NG"> <p>AUP NG</p> </div> <div class="p Major_Release"> <p>Major Release</p> </div> <div class="p Late_Regres"> <p>Late Regress.</p> </div> <div class="p Web_Perform"> <p>Web Perform.</p> </div> <div class="p empty"> <p></p> </div> </div> </div> </div> </div> </div> </div>  Could you also describe as to why you are using HTML Dashboard instead of Simple XML JS extension as that would have made dashboard coding and editing a lot easier? Following is a Simple XML example (JS would need to be coded for handling click on buttons).   <dashboard> <label>Table with Header</label> <row> <panel> <html id="html_header"> <style> #element1 th[data-sort-key="Application Name"], #element1 th[data-sort-key="Test Case"]{ width: 10% !important; padding-left: 0px; padding-right: 0px; } #element1 th[data-sort-key^="QA"], #element1 th[data-sort-key^="STG"], #element1 th[data-sort-key^="PVE"]{ width: 8% !important; padding-left: 0px; padding-right: 0px; } div.panel-body.html{ display: flex; padding-left: 0px !important; padding-right: 0px !important; } #html_header #button_options{ width: 10% !important; border-style: solid; } #html_header .p.swimlane{ width: 10% !important; } #html_header div.p{ border-style: solid; text-align: center; } #html_header div.p{ width: 8% !important; } #html_header .p.Major_Release{ width: 16% !important; } #html_header #button_options a{ border-width: 2px; border-style: solid; border-radius: 50%; margin-right: 5px; } #html_header #button_options a i{ text-align: center; width: 15px; } </style> <div id="button_options"> <a title="Go to search screen"><i class="icon-search"></i></a> <a title="Issue log"><i class="icon-menu"></i></a> <a title="FAQ"><i class="icon-question"></i></a> </div> <div class="p swimlane"> <p>Swimlane Upcoming Releases</p> </div> <div class="p asm"> <p>ASM</p> </div> <div class="p may_mr"> <p>May MR</p> </div> <div class="p april_mr"> <p>April MR</p> </div> <div class="p dry_run"> <p>Dry Run</p> </div> <div class="p AUP_NG"> <p>AUP NG</p> </div> <div class="p Major_Release"> <p>Major Release</p> </div> <div class="p Late_Regres"> <p>Late Regress.</p> </div> <div class="p Web_Perform"> <p>Web Perform.</p> </div> <div class="p empty"> <p></p> </div> </html> </panel> </row> <row> <panel> <table id="element1"> <search> <query>| makeresults | fields - _time | eval "Application Name"="ABCD","Test Case"="ABCD",QA1="warn",QA2="warn",QA3="warn",QA4="ok",QA5="warn",QA6="warn",QA7="critical",STG="critical",STG2="N/A",PVE="ok" | table "Application Name", "Test Case", QA*, STG*,PVE</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard>     ... View more

@to4kawa  Purpose for my stats first and field extract later was to reduce field extraction on number of events. A derivative of the following search optimization technique 🙂 : https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Optimizing_your_lookup_search ... View more

@to4kawa The sum total and percent in the screenshot is from the built in formatting option for the Table. So SPL is not really needed! ... View more