@to4kawa The sum total and percent in the screenshot is from the built in formatting option for the Table. So SPL is not really needed! ... View more

@thl8490123 based on the screenshot and SPL provided in the question, you are better off running tstats query which will perform way better. Please try out the following SPL and confirm | tstats count where index=main source IN ("wineventlog:application","wineventlog:System","wineventlog:security") by host _time source span=1mon | eval {source}=count | fields - source count   ... View more

The app that you are using has not been updated since 2018 also only supported for 7.0 not higher. Can you try more recent and latest Splunk version supported Semicircle Donut Chart Viz ... View more

@NewSplunkUserX  try the following SPL     index=qualys (STATUS=NEW OR RE-OPENED OR ACTIVE) | stats count by NETBIOS | eval GROUP=substr(NETBIOS,1,2) | stats sum(count) as count by GROUP   ... View more

@Priya312  rangemap to color single value is not recommended way. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/SingleValueFormatting#Migration_for_rangemap_settings_in_existing_single_value_visualizations   Following are some of your alternatives. Please try out and confirm. Do up vote the comment and answers if they assist you! https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Visualization-Set-value-to-always-have-that-color/td-p/449751 ... View more

Great. You can try in your local/dev instance first and check the output with your existing query. If it works do accept the answer. 🙂 ... View more

@brhicke747  You would need to place appLogo.png and appLogo_2x.png images in the following folder: $SPLUNK_HOME/etc/apps/<yourAppName>/static Please try out and confirm! Do upvote the answers, if it works 🙂 ... View more

@DEADBEEF what do you mean by not working? The link input behaviour or CSS Style override to make it appear as button? There is a know issue and fix fir CSS Style override from Simple XML dashboard code. Please refer to answer  https://community.splunk.com/t5/Dashboards-Visualizations/How-to-include-CSS-in-Dashboards-with-the-latest-Splunk-version/td-p/465917 Do upvote the answer/comments that helped. ... View more

@lping  Based on your example seems like host_tok token value from source dashboard can only have two values i.e. consul_client or consul_server. In the destination dashboard if you do not want users to change this value have a hidden input consume the token and set required SPL accordingly. I have used a dropdown in the following example. PS: search event handlers can be <done>, <progress>, <fail>, <error> or <cancelled>. The <init> section is only for Dashboard load. Having said these you actually need an input and code <change> event handler. I dont know from where you are getting $earliest$ and $latest$ for one of your panel while the other panel Search uses static time. If these tokens are also coming from the source dashboard's drilldown, you would need to create a time input as well and set the default value accordingly. Please try out and confirm the following example based on your question: <form> <label>Conditional Token</label> <description>Gives stats on ERRORS</description> <fieldset submitButton="false"> <input depends="$alwaysHide$" type="dropdown" token="host_tok" searchWhenChanged="true"> <label></label> <change> <condition value="consul_client"> <set token="Panel1">host!=*consul* OR servername!=*consul* earliest=-5m sourcetype=consul_log index=hcm_consul "[ERROR]" NOT ("rpc error making call: rpc error making call: Permission denied" OR "rpc error making call: Permission denied" OR "Newer Consul version available") | eval SEARCH_CRITERIA=case(like(_raw, "%Push/Pull with%"), "Push/Pull Error", like(_raw, "%Failed fallback ping%"), "Failed fallback ping Error", like(_raw, "%connection reset by peer%"), "Connection reset by peer Error", like(_raw, "%keepalive timeout%"), "Keepalive Timeout Error", like(_raw, "%i/o timeout%"), "I/O Timeout Error", like(_raw, "%lead thread didn't get connection%"), "Lead thread didn't get connection Error", like(_raw, "%failed to get conn: EOF%"), "Failed to get conn: EOF Error", like(_raw, "%rpc error making call: EOF%"), "RPC error making call: EOF Error", like(_raw, "%Permission denied%"), "Permission denied Error", like(_raw, "%Timeout exceeded while awaiting headers%"), "Timeout exceeded while awaiting headers Error", true(), "Other Error")| stats count by SEARCH_CRITERIA</set> <set token="Panel2">| gentimes start=-10 | eval _time=starttime | fields _time | eval client=random()</set> </condition> <condition value="consul_server"> <set token="Panel1">host=*consul* OR servername=*consul* earliest=-5m sourcetype=consul_log index=hcm_consul "[ERROR]" NOT ("rpc error making call: rpc error making call: Permission denied" OR "rpc error making call: Permission denied" OR "Newer Consul version available") | eval SEARCH_CRITERIA=case(like(_raw, "%Push/Pull with%"), "Push/Pull Error", like(_raw, "%Failed fallback ping%"), "Failed fallback ping Error", like(_raw, "%connection reset by peer%"), "Connection reset by peer Error", like(_raw, "%keepalive timeout%"), "Keepalive Timeout Error", like(_raw, "%i/o timeout%"), "I/O Timeout Error", like(_raw, "%lead thread didn't get connection%"), "Lead thread didn't get connection Error", like(_raw, "%failed to get conn: EOF%"), "Failed to get conn: EOF Error", like(_raw, "%rpc error making call: EOF%"), "RPC error making call: EOF Error", like(_raw, "%Permission denied%"), "Permission denied Error", like(_raw, "%Timeout exceeded while awaiting headers%"), "Timeout exceeded while awaiting headers Error", true(), "Other Error")| stats count by SEARCH_CRITERIA</set> <set token="Panel2">| gentimes start=-10 | eval _time=starttime | fields _time | eval server=random()</set> </condition> </change> <choice value="consul_client">Client</choice> <choice value="consul_server">Server</choice> <default>consul_client</default> </input> </fieldset> <row> <panel> <single> <title>Number of Errors in last 5 minutes</title> <search> <query>$Panel1$</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> <refresh>1m</refresh> <refreshType>delay</refreshType> </search> </single> </panel> </row> <row> <panel> <chart> <title>Error's Trendline for Nodes in last 60 minutes</title> <search> <query>$Panel2$</query> <earliest>-60m@m</earliest> <latest>now</latest> <refresh>1m</refresh> </search> <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option> <option name="charting.chart">line</option> </chart> </panel> </row> </form>   ... View more

@nadlurinadluri I think what is more important to know is that what do you want to do when you identify parent/child relationship recursively. If this is use case around visualizing the relationship,  the original from to data can plug in directly into so many visualizations built for Graph and Relationships. If we have better understanding of your actual use case the visualizations can be converted to the story of your choice. There are several Custom Visualization Apps that you can find on Splunkbase: Sankey Diagram Custom Visualization Parallel Coordinates - Custom Visualization Network Topology - Custom Visualization 3D Graph Network Topology Visualization Network Diagram Viz Flow Map Viz Graph Viz Force Directed App For Splunk And many more 🙂 Following is a run anywhere example with some of the Custom Visualizations from the above list. However each visualization is way more powerful than depicted depending on the Use Case. I have just used the from/to table provided in the question to build these.     Following is the Simple XML Code which will work only after respective Custom Visualization is installed. <dashboard> <label>Relationship Mapping</label> <row> <panel> <title>Sankey</title> <viz type="sankey_diagram_app.sankey_diagram"> <search> <query>| makeresults | fields - _time | eval data="parent,child1;parent,child2;parent,xyz;child1,son1;child1,daughter1;child2,son2;child2,daughter2;xyz,kid1;son1,kid1;son2,kid2" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval from=mvindex(data,0), to=mvindex(data,1) | fields from to</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="height">394</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> <panel> <title>Parallel Coordinates</title> <viz type="parallel_coordinates_app.parallel_coordinates"> <search> <query>| makeresults | fields - _time | eval data="parent,child1;parent,child2;parent,xyz;child1,son1;child1,daughter1;child2,son2;child2,daughter2;xyz,kid1;son1,kid1;son2,kid2" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval from=mvindex(data,0), to=mvindex(data,1) | table from to</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="height">393</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> <panel> <title>Force Directed Visualization</title> <viz type="force_directed_viz.force_directed"> <search> <query>| makeresults | fields - _time | eval data="parent,child1;parent,child2;parent,xyz;child1,son1;child1,daughter1;child2,son2;child2,daughter2;xyz,kid1;son1,kid1;son2,kid2" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval from=mvindex(data,0), to=mvindex(data,1) | fields from to</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="height">396</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> </row> <row> <panel> <title>Flow Map Viz</title> <viz type="flow_map_viz.flow_map_viz"> <search> <query>| makeresults | fields - _time | eval data="parent,child1;parent,child2;parent,xyz;child1,son1;child1,daughter1;child2,son2;child2,daughter2;xyz,kid1;son1,kid1;son2,kid2" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval from=mvindex(data,0), to=mvindex(data,1) | fields from to</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="height">354</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> <panel> <title>Network Diagram Viz</title> <viz type="network-diagram-viz.network-diagram-viz"> <search> <query>| makeresults | fields - _time | eval data="parent,child1;parent,child2;parent,xyz;child1,son1;child1,daughter1;child2,son2;child2,daughter2;xyz,kid1;son1,kid1;son2,kid2" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval from=mvindex(data,0), to=mvindex(data,1) | eval value=from | fields from to value</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="height">351</option> <option name="network-diagram-viz.network-diagram-viz.arrowLocation">none</option> <option name="network-diagram-viz.network-diagram-viz.canZoom">true</option> <option name="network-diagram-viz.network-diagram-viz.clusterBy">none</option> <option name="network-diagram-viz.network-diagram-viz.defaultNodeType">circle</option> <option name="network-diagram-viz.network-diagram-viz.draggableNodes">true</option> <option name="network-diagram-viz.network-diagram-viz.enablePhysics">true</option> <option name="network-diagram-viz.network-diagram-viz.hierarchy">true</option> <option name="network-diagram-viz.network-diagram-viz.hierarchyDirection">Top-Down</option> <option name="network-diagram-viz.network-diagram-viz.hierarchySortMethod">directed</option> <option name="network-diagram-viz.network-diagram-viz.linkTextLocation">bottom</option> <option name="network-diagram-viz.network-diagram-viz.linkTextSize">medium</option> <option name="network-diagram-viz.network-diagram-viz.nodeTextSize">medium</option> <option name="network-diagram-viz.network-diagram-viz.smoothEdgeType">dynamic</option> <option name="network-diagram-viz.network-diagram-viz.smoothEdges">true</option> <option name="network-diagram-viz.network-diagram-viz.tokenNode">nd_node_token</option> <option name="network-diagram-viz.network-diagram-viz.tokenToNode">nd_to_node_token</option> <option name="network-diagram-viz.network-diagram-viz.tokenToolTip">nd_tooltip_token</option> <option name="network-diagram-viz.network-diagram-viz.tokenValue">nd_value_token</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> </row> </dashboard>   ... View more

This seems to be straight forwards as per the details/screenshot provided. Could you please add what is not working for you right now? What do you mean by "If the user selects the All button and clicks on the submit button"? Would it be possible for you to add your Simple XML right now? and also what SPL you are trying to run?   ... View more

@chookp add the following to your dropdown change event handler to set/unset showPanel2 token and use the token as depends attribute for Panel 2 <panel> as well as <search> <change> <condition label="All"> <unset token="showPanel2"></unset> </condition> <condition> <set token="showPanel2">true</set> </condition> </change>   <panel depends="$showPanel2$"> <table> <title>Panel 2</title> <search depends="$showPanel2$"> Following is a run anywhere dashboard example based on the details provided for you to try and confirm! <form> <label>Hide Show panel based on Dropdown value</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="dropdown" token="ASSET_NAME" searchWhenChanged="true"> <label>ASSET_NAME</label> <choice value="*">All</choice> <choice value="a">Alpha</choice> <choice value="b">Beta</choice> <choice value="c">Charlie</choice> <default>*</default> <change> <condition label="All"> <unset token="showPanel2"></unset> </condition> <condition> <set token="showPanel2">true</set> </condition> </change> </input> </panel> <panel> <!-- EMPTY PANEL TO ALIGN INPUT PANEL WITH PANEL1 and PANEL2 below --> </panel> </row> <row> <panel> <table> <title>Panel 1</title> <search> <query>| makeresults | eval selectedValue="$ASSET_NAME$"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$showPanel2$"> <table> <title>Panel 2</title> <search depends="$showPanel2$"> <query>| makeresults | eval showPanel2="$showPanel2$"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   ... View more

@Noob_splunker Please explore Chart Event Annotation or Region Chart Viz Custom Visualization for your use case. Refer to one of my older answer with run anywhere example for both: https://community.splunk.com/t5/Dashboards-Visualizations/add-custom-name-in-chart-viz-for-empty-space/m-p/505390#M33512 ... View more

@brettcave try to have transforming search in your base search and also restrict to fields that are required. Do not use Post Processing to retain all event and fields as is to be used across the dashboard. Refer to one of my older answer around the same along with best practices for Post Processing: https://community.splunk.com/t5/Splunk-Search/Why-do-my-post-process-timecharts-display-quot-no-results-found/td-p/337951 ... View more

@anil15694 Please refer to one of my older answers with REST API /data/ui/views, that can be used to pull available dashboards based on App Context and User context. https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-a-dashboard-as-value-in-dropdown-of-another/td-p/327727 Please try out and confirm. If this does not solve, please provide additional details for your use case. ... View more

@AnilPujar can you point to which D3 Dendogram visualization are you using? I dont know if there is one that is recently built or supported. Is it your own custom viz?   Nevertheless, if you have the DOM selected for last-child from where you need to fetch the value, you can use jQuery Selector based Click handler in Simple XML JS extension with Splunk JS stack to set the required token that can be accessed in the UI. Following are some of my previous answers on similar lines but for different custom visualizations: Simple XML JS Extension based drilldown for Outlier Chart Simple XML JS Extension based drilldown for Donut Chart Simple XML JS Extension based drilldown for Status Indicator/Single Value html panel Do up vote the answers if they help you. If not let us know further details so that community can assist better. ... View more

@kunwarjit  by dashboard refresh do you mean using Refresh in the Browser or  Refresh option in the dashboard for example refresh="500" or refresh within search? ... View more

@limalbert you can try the following CSS override which applies background color to the row (with id="row_title") as opposed to applying it to header h2.   <row id="row_title"> <panel> <html> <style> #row_title .panel-element-row{ background-color:#485959; } #row_title .panel-element-row h1{ text-align:center; color: white; } </style> <h1>Transfer Review</h1> </html> </panel> </row>   Another option would be to use Dark Mode if you are on 7.2.x+  which will automatically apply dark background color. You will have to just apply h1 font color. Please try out and confirm! ... View more

@yvassilyeva try the following run any where example based on screenshot and data provided by you (It is always advisable to mask/anonymize any sensitive information before posting on Splunk Answers). While subsearch approach should also work, instead of running an additional search I have used Post Processing in an independent search which sets the list of available End Office as the token to be passed to the search query for Panel 1. Dummy query creates End Office as ABC001,DEF001,GHI001,JKL001, where as the Panel1 query has AAA001, BBB001, ABC001, GHI001 and ZZZ001. So filter should work and show results only based on Panel 2 End Offices. Text Box filter for End Office is applied for Panel 2 and Panel 2 End Office list is applied to Panel 1 as filter. PS: As first answer, for better query performance, do re-organize your Search to ensure filters happen while pulling data from index.   <form> <label>Pass Value from one Panel to Another</label> <!-- Independent Search to fetch the End Office list from Panel 2 and pass as token to panel 1 --> <search base="bMainData"> <query>| stats values("End Office") as "End Office" | eval "End Office"="\"".mvjoin('End Office',"\",\"")."\"" </query> <done> <set token="tokFilterOffice">$result.End Office$</set> </done> </search> <fieldset submitButton="false"> <input type="text" token="tandemtoken" searchWhenChanged="true"> <label>Tandem CLLI</label> <default>*</default> </input> <input type="text" token="endofficetoken" searchWhenChanged="true"> <label>End Office</label> <default>*</default> </input> <input type="text" token="npatoken" searchWhenChanged="true"> <label>Enter NPA</label> <default>*</default> </input> <input type="text" token="nxxtoken" searchWhenChanged="true"> <label>Enter NXX</label> <default>*</default> </input> </fieldset> <row> <panel> <title>LERG1 LERG7 LERG 7 SHA (tokFilterOffice: $tokFilterOffice$)</title> <table depends="$tokFilterOffice$"> <search> <query>| makeresults | eval data="AAA001T,500,AAA001,Some Description 1;BBB001T,500,BBB001,Some Description 2;ABC001T,500,ABC001,Some Description 3;GHI001T,500,GHI001,Some Description 4;ZZZ001T,500,ZZZ001,Some Description 5;GHI001T,500,GHI001,Some Description 6;" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval "Tandem CLLI"=mvindex(data,0),LATA=mvindex(data,1),"End Office"=mvindex(data,2),"End Office Company Name"=mvindex(data,3) | table "Tandem CLLI" LATA "End Office" "End Office Company Name" | search "Tandem CLLI"="$tandemtoken$" "End Office" IN ("$tokFilterOffice$")</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <title>LERG 6</title> <table> <search id="bMainData"> <query>| makeresults | eval data="ABC001,01, , ,262,287;DEF001,03, , ,262,285;GHI001,00, , ,262,281;JKL001,01, , ,262,278;" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval "End Office"=mvindex(data,0),SHA=mvindex(data,1),Status=mvindex(data,2),Effective_Date=mvindex(data,3),NPA=mvindex(data,4),NXX=mvindex(data,5) | table "End Office" SHA Status Effective_Date NPA NXX | search NPA=$npatoken$ NXX="$nxxtoken$" "End Office"="$endofficetoken$"</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form>   Do up vote the answers that helped! ... View more

May I know those additional tasks for JS, that can not be performed in Simple XML. I can surely help you with JS but a bit later (possibly over weekend). ... View more

@russellfavell  if the link provided above helped you, please accept the answer to mark this question as answered. Do upvote the answers that helpde! ... View more