Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
07-08-2020
05:29 AM
2 Karma
@summeruraGlad you got them to work! You can use cont=f option with timechart to show only the dates which have data. Also do up vote the comments that helped 🙂
... View more
07-08-2020
04:19 AM
@Stives Request you to post what you tried which fixed the issue. Accept the answer to mark the question as answered.
... View more
07-08-2020
04:17 AM
1 Karma
@summerura Following are two run anywhere example based on the Sample Data and SPL you have provided. So if the option is not working for you please provide the SPL you have tried and the final output results you are getting. Option 1 | gentimes start=-10
| eval _time=starttime
| fields _time
| eval Date=strftime(_time,"%Y/%m/%d"), diskUsageTB=replace(substr(tostring(random()),1,3),"(\d{1})(\d{2})","\1,\2")
| stats max(diskUsageTB) as TB by Date
| eval TB=replace(TB,",","") Option 2 | gentimes start=-10
| eval _time=starttime
| fields _time
| eval diskUsageTB=replace(substr(tostring(random()),1,3),"(\d{1})(\d{2})","\1,\2")
| timechart span=1d max(diskUsageTB) as TB
... View more
07-07-2020
11:40 PM
@yvassilyeva I think it is difficult to capture your exact use case, problem and data. Please add more details if you can with sample data, current behavior and expected behavior (screenshots). If you notice I just have moved your second panel SPL to first panel base search as a sub-search, which returns only End Offices. So it is supposed to work as per requirement you have mentioned. So please add as much details and screenshots, sample data as possible. Please mock/anonymize any sensitive information before posting.
... View more
07-07-2020
12:52 PM
1 Karma
Ideally you should use a Link input (Radio and even Check Box should also work on similar lines) Following is a snippet for Link Inputs which can serve as links to separate dashboards (you need to provide the dashboard path relative/absolute depending on your use case). Please try out and confirm! <dashboard>
<label>Link Inputs</label>
<row>
<panel>
<html depends="$alwaysHideCSSOverride$">
<style>
div[id^="link_"] button{
width: 180px !important;
background: rgb(92,192,92,1);
padding: 10px;
border-radius: 10px;
color: white !important;
}
</style>
</html>
<input id="link_1" type="link" token="tokLink1" searchWhenChanged="true">
<label></label>
<choice value="link1">Link 1</choice>
<change>
<condition value="link1">
<link target="_blank">yourLink1PathGoesHere</link>
<unset token="form.tokLink1"></unset>
</condition>
</change>
</input>
<input id="link_2" type="link" token="tokLink2" searchWhenChanged="true">
<label></label>
<choice value="link2">Link 2</choice>
<change>
<condition value="link2">
<link target="_blank">yourLink2PathGoesHere</link>
<unset token="form.tokLink2"></unset>
</condition>
</change>
</input>
<input id="link_3" type="link" token="tokLink3" searchWhenChanged="true">
<label></label>
<choice value="link3">Link 3</choice>
<change>
<condition value="link3">
<link target="_blank">yourLink3PathGoesHere</link>
<unset token="form.tokLink3"></unset>
</condition>
</change>
</input>
</panel>
</row>
</dashboard>
... View more
- Tags:
- link input
07-07-2020
12:41 PM
If Dropdown and inputs move on the left side (without mock up of expected output I am assuming stacked vertcally) then what will be on the right side? Empty space? For us to assist you better please provide a mock screenshot of the layout you need. Whiteboard image or paint image will also do.
... View more
07-07-2020
12:37 PM
@yvassilyeva First off, filter should be applied in search as early as possible. In your case in the same pipe as index. So your panel 1 query should be something like the following: index=migration sourcetype=source7 "Tandem CLLI"="$tandemtoken$"
[| search index=migration sourcetype=source6 PA=$npatoken$ NXX="$nxxtoken$" "End Office"="$endofficetoken$"
| stats count by "End Office"
| fields "End Office"]
| table "Tandem CLLI" LATA "End Office" "End Office Company Name" Also, if you want Panel 1 results to be populated based on "End Office" values returned by the second panel, then does it mean Panel 1 must wait 2nd panel search to complete and give all possible End Office names?
... View more
07-07-2020
12:17 PM
1 Karma
@summerura your TB field seems to have comma in its value, which means it will not be treated as numeric. One of the options is to not to create the Date field and use timechart instead of stats: <yourBaseSearch>
| timechart span=1d max(diskUsageTB) as TB Second option in case you want to use Stats with your custom Date field then you can try the following to remove comma from TB value. PS: While using string date you should use %Y/%m/%d and not %m/%d/%Y as string date can go out of sequence. | eval Date=strftime(_time,"%Y/%m/%d")
| stats max(diskUsageTB) as TB by Date
| eval TB=replace(TB,",","") Preferred option is Option 1. But please try out and confirm!
... View more
07-05-2020
02:38 AM
1 Karma
Which version of Splunk are you on? Have you tried the following: https://community.splunk.com/t5/Splunk-Enterprise/How-to-use-iframe-in-Splunk-8-x/td-p/467598
... View more
07-03-2020
08:25 AM
@richielynch89 I have posted a reply to your other question. Can you please try and confirm? https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-highlight-table-cells-that-can-either-be-multi-value/m-p/471787#M30971
... View more
07-03-2020
08:13 AM
@richielynch89 can you try the following updated JS and confirm? require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/simplexml/ready!'
], function (_, $, mvc, TableView) {
mvc.Components.get('highlight').getVisualization(function (tableView) {
tableView.on('rendered', function () {
setTimeout(function () {
$('div#highlight table td[data-cell-index="1"] div.multivalue-subcell,td[data-cell-index="1"]').each(function () {
var strMultiValueTest = $(this).text();
if(strMultiValueTest.length>8){
// DO NOTHING - td for multivalue need not be handled.
}
else if (strMultiValueTest < "05:00:00") {
$(this).css("background-color", "green");
}
else if (strMultiValueTest >= "05:00:00" && strMultiValueTest <= "16:00:00") {
$(this).css("background-color", "orange");
} else {
$(this).css("background-color", "red");
}
});
}, 100);
});
});
}); While selecting the Table Cell I have added condition for td being highlighted if it is not a multi-value field. (Assuming multivalue cell will have length >8 because of multiple HH:MM:SS format.) Also replace Existing Simple XML CSS override with the following: <html>
<style>
#highlight td[data-cell-index="1"]{
padding: 0px;
text-align: center;
}
</style>
</html>
... View more
07-03-2020
05:32 AM
@SagarSplunk what do you mean by but the challenge here we are unable to split single value panel ? If you have written query for individual then are they not separate already? Do you need gap between the panels? If so you need to make sure you use <panel><single></single></panel><panel><single></single></panel>... kind of layout and not <panel><single></single><single></single>...</panel> Please elaborate your issue for the community to assist you better.
... View more
07-03-2020
12:52 AM
3 Karma
@avni26 this is ideally an easy use case for html input with Simple XML JS Extension. However, since your question is asking for Simple XML CSS extension alone (NO JS required). Let me answer this with the help of Link Input and CSS Extension using run anywhere example below. Please try out and confirm! Panel Expand and Collapse using Link input and CSS Following is the Simple XML code for example above: <form theme="dark">
<label>Expand Collapse Panel</label>
<init>
<set token="showExpandLink1">true</set>
<set token="showExpandLink2">true</set>
</init>
<fieldset submitButton="false">
<input type="time" token="tokTime" searchWhenChanged="true">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row depends="$alwaysHideCSSStyleOverride$">
<panel>
<html>
<html>
<style>
div[id^="linkCollapse"],
div[id^="linkExpand"]{
width: 32px !important;
float: right;
}
div[id^="linkCollapse"] button,
div[id^="linkExpand"] button{
flex-grow: 0;
border-radius: 25px;
border-width: thin;
border-color: lightgrey;
border-style: inset;
width: 32px;
padding: 0px;
}
div[id^="linkCollapse"] label,
div[id^="linkExpand"] label{
display:none;
}
div[id^="panel"].fieldset{
padding: 0px;
}
</style>
</html>
</html>
</panel>
</row>
<row>
<panel id="panel1">
<title>Splunkd Errors by Component - Trending</title>
<input id="linkCollapse1" type="link" token="tokLinkCollapse1" searchWhenChanged="true" depends="$showCollapseLink1$">
<label></label>
<choice value="collapse">-</choice>
<change>
<condition value="collapse">
<unset token="showCollapseLink1"></unset>
<set token="showExpandLink1">true</set>
<unset token="form.tokLinkCollapse1"></unset>
</condition>
</change>
</input>
<input id="linkExpand1" type="link" token="tokLinkExpand1" searchWhenChanged="true" depends="$showExpandLink1$">
<label></label>
<choice value="expand">+</choice>
<change>
<condition value="expand">
<set token="showCollapseLink1">true</set>
<unset token="showExpandLink1"></unset>
<unset token="form.tokLinkExpand1"></unset>
</condition>
</change>
</input>
<chart rejects="$showExpandLink1$">
<search>
<query>index=_internal sourcetype=splunkd log_level!=INFO
| timechart count by component useother=f usenull=f limit=5</query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
</search>
<option name="charting.axisY.abbreviation">auto</option>
<option name="charting.axisY.scale">log</option>
<option name="charting.chart">area</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row>
<panel id="panel2">
<title>Splunkd Errors by Log Level - Trending</title>
<input id="linkCollapse2" type="link" token="tokLinkCollapse2" searchWhenChanged="true" depends="$showCollapseLink2$">
<label></label>
<choice value="collapse">-</choice>
<change>
<condition value="collapse">
<unset token="showCollapseLink2"></unset>
<set token="showExpandLink2">true</set>
<unset token="form.tokLinkCollapse2"></unset>
</condition>
</change>
</input>
<input id="linkExpand2" type="link" token="tokLinkExpand2" searchWhenChanged="true" depends="$showExpandLink2$">
<label></label>
<choice value="expand">+</choice>
<change>
<condition value="expand">
<set token="showCollapseLink2">true</set>
<unset token="showExpandLink2"></unset>
<unset token="form.tokLinkExpand2"></unset>
</condition>
</change>
</input>
<chart rejects="$showExpandLink2$">
<search>
<query>index=_internal sourcetype=splunkd log_level!=INFO
| timechart count by log_level useother=f usenull=f limit=5</query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
</search>
<option name="charting.axisY.abbreviation">auto</option>
<option name="charting.axisY.scale">log</option>
<option name="charting.chart">area</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</form>
... View more
07-02-2020
11:14 PM
1 Karma
@brhicke747 If you have the access to upload asset you can navigating to Manage App. Please try the following where you need to change your Splunk URL and Splunk App Name. If you have access to upload static file, you should be able to upload image. https://<yourSPLUNKURL>/en-US/manager/launcher/apps/local/<yourAppName>?action=edit The static file/s uploaded through above approach sits in the following folder: $SPLUNK_HOME/etc/apps/<yourAppname>/appserver/static
... View more
07-01-2020
09:48 AM
1 Karma
@Barty if your intent is to run the following search by using results from inputlookup index=syslog source=*rsa* (fiacjro OR lv14447 OR lv14839 OR lv14989 OR lv15961) Map should work. You should use single $ sign if you are running the SPL in Search UI, and two $$ if your are running the same inside a dashboard to escape the dollar sign $ Following are three options. You would need to escape $ for return or map approach. The third option with table in the subsearch does not need escaping as there is no $ sign. Please try out and confirm! <dashboard>
<label>Run Subsearch based on lookup results</label>
<row>
<panel>
<title>Option 1 : Using return command</title>
<event>
<search>
<query>index=syslog source=*rsa* earliest=-15m
[| inputlookup team_vpn_list.csv where Team="Heritage Products"
| fields team_lvnos
| rename team_lvnos as search
| return 1 $$search ]</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="list.drilldown">none</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.sortDirection">asc</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
</event>
</panel>
</row>
<row>
<panel>
<title>Option 2: Using map command</title>
<table>
<search>
<query>| inputlookup team_vpn_list.csv where Team="Heritage Products"
| map search="search index=syslog source=*rsa* earliest=-15m $$team_lvnos$$" maxsearches=1</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
<panel>
<title>Option 3 : Using table in SubSearch</title>
<event>
<search>
<query>index=syslog source=*rsa* earliest=-15m
[| inputlookup team_vpn_list.csv where Team="Heritage Products"
| fields team_lvnos
| head 1
| rename team_lvnos as search
| table search ]</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="list.drilldown">none</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.sortDirection">asc</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
</event>
</panel>
</row>
</dashboard>
... View more
06-26-2020
09:45 AM
1 Karma
Actually reverse perform timechart to get daily data hoping even if you are querying 1 year of data it will be 365 rows. Then apply eval index=perfmon host=ServerName eventtype=perfmon_windows NetShare14
| timechart span=24h avg(Free_Megabytes) as GB_Free
| eval GB_Free=round(GB_Free,2) Read more about eval command in Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval
... View more
06-26-2020
06:34 AM
1 Karma
@johnward4 with the question I assumed you wanted real-time monitoring. If you want historical data that might be right approach. However, REST API would be fastest if you want to know what is down right now. Also with the SPL you are using I think following does the same and would perform better: index=wineventlog host=* source="WinEventLog:System" EventCode=6013
| fields host Message
| rex field=Message "The system uptime is (?<SystemUpTime>\d+) seconds."
| dedup host
| search SystemUpTime>86400
| eval UpTime=round(SystemUpTime/86400,2)
| sort - UpTime
| table host UpTime
| eval UpTime=UpTime." Days" Also move the rex command to Field Extraction.
... View more
06-26-2020
06:15 AM
Glad you got it working, do upvote the answers if they helped!
... View more
06-25-2020
11:54 AM
For second panel try the following search where $tokField2$ is the field2 token value from the text box in first panel. index=example sourcetype=xyz
[| search index=example sourcetype=abc field2="$tokField2$"
| table field1]
| table field1 somethingElse
... View more
06-25-2020
11:43 AM
1 Karma
@johnward4 you are possibly looking for the /deployment/server/clients rest endpoint. (Refer to Splunk Documentation for details: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTdeploy#deployment.2Fserver.2Fclients) | rest splunk_server=local /services/deployment/server/clients
| fieldformat lastPhoneHomeTime=strftime(lastPhoneHomeTime,"%Y/%m/%d %H:%M:%S.%3N")
... View more
06-25-2020
10:50 AM
That is because you did not have table in your snippet 😛 Move the table to second row. Keep inputs in single row single panel and my solution will work. That is exactly the code that was shared in the question. Other option would be to create two panels in one row as input panels one with Splunk input, other with html input and format as per need using CSS. If not you might have to share the screenshot of issue with code and anonymize any sensitive information in both.
... View more
06-24-2020
09:14 AM
1 Karma
Fixed slices means each Location on map must show same no. of series for example Type of HTTP methods as GET and POST values. However, like I mentioned you can have different number of slices as per screenshot attached and sometimes only single circle with no slice. So you may have to try out the Map+ viz.
... View more
06-23-2020
02:47 PM
1 Karma
@genesiusj this is happening because you seem to have Custom Y-Axis data label set as Cert. Change from Custom to Default and it should work as expected.
... View more
06-23-2020
02:17 PM
1 Karma
@abhishekkalokhe this would be a limitation of built in Cluster Map viz, where you can not fetch Split field values if there are multiple slices of the pie for the same location. i.e. if you use $click.name$ or $click.value$ , it would work for single slice pie, but for pie with multiple slices it will return only the first row data. If you had fixed number of slices, you could still be able to fetch the details. But looking at the screenshot you don’t seem to have one. Please try out Map+ custom visualization and see if fits the need.https://splunkbase.splunk.com/app/3124/
... View more
