Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
06-19-2020
11:29 AM
There was a JIRA Ticket TAB-2979 raised internally for it in Feb but no progress or update!
... View more
06-18-2020
02:24 PM
@Chiddarthan you would also need to enable searchWhenChanged="true" for the dropdown <input type="dropdown" token="serviceNamedropdown" searchWhenChanged="true"> Rest all code remains the same as you originally posted.
... View more
06-18-2020
02:10 PM
@davidharter take a backup of existing Advanced XML dashboard like memory_pool_info_by_set_type and create a new Dashboard with the same name i.e. "Memory Pool Info by Set Type" and create a panel with the reference to existing report Following is an Example of new memory_pool_info_by_set_type.xml , <dashboard>
<label>Memory Pool Info by Set Type</label>
<row>
<panel>
<title>Panel From Report</title>
<table>
<search ref="Your Corresponding Memory Pool Report Name Goes Here"></search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</dashboard>
... View more
06-18-2020
02:01 PM
1 Karma
@LogUx you should be able to do that using REST API (running as script or custom command). You can refer to following app from Splunkbase: https://splunkbase.splunk.com/app/4692/ Since it is neither Appinspect passed nor updated after first time upload, you can try to check out the logic and build one yourself. If you want to start on your own, use REST API endpoint for saved searches with POST command you can set the disabled to 1 and Disable either all saved searches or specific: https://docs.splunk.com/Documentation/Splunk/8.0.4/RESTREF/RESTsearch#saved.2Fsearches
... View more
06-18-2020
01:21 PM
1 Karma
@amcb90 if you do not want to use JS you can also create and anchor html tag which would reload itself in the same browser, hence resetting the form tokens. Try by adding the following html panel in your existing dashboard and test. <panel id="panelRefresh">
<html>
<div style="float:right">
<a href="/app/$env:app$/$env:page$" style="display:flex">
<i class="icon-rotate"/>
<div style="padding-left:5px;">Reset</div>
</a>
</div>
</html>
</panel> If it works you can format the panel content as per your needs and then create a pre built panel as per one of my older answers: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-unset-tokens-for-all-filters-and-set-to-their-default/td-p/500443
... View more
06-18-2020
12:10 PM
2 Karma
@cornemrc try something like the following. SPL is used to create servername as delimited string after combining servername with locationname. Using <eval> to split the servername set the tokens servername and location name using $label$ on <change> of input value. <input type="dropdown" token="serverlocation">
<label>Server/Location</label>
<fieldForLabel>locationname</fieldForLabel>
<fieldForValue>servername</fieldForValue>
<selectFirstChoice>true</selectFirstChoice>
<search>
<query>| inputlookup serverlocations.csv
| fields servername locationname
| eval servername=servername."|".locationname</query>
</search>
<change>
<eval token="servername">mvindex(split($value$,"|"),0)</eval>
<set token="locationname">$label$</set>
</change>
</input>
... View more
06-16-2020
10:23 PM
Hi @pipipipi I used Browser Inspector to identify the CSS Selector. You can refer to one of my older answers with the steps: https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-update-panel-color-in-Splunk-using-CSS/td-p/364590 Also do read the Clara-fication blog by @cmerriman on CSS in Simple XML Dashboards demystification!
... View more
06-16-2020
12:27 PM
@DEADBEEF the reason why hardcoded | eval threshold=512000 works after timechart is that it creates a new threshold field using eval expression. Based on your query, if you want something similar in effect you would need to place an eval for aggregating max of current_size field before the timechart command (not max_size field as it does not exist as per your SPL). This is because timechart command drops fields not used in aggregation or split. index=_internal host=hf_1 group=queue name=tcpout_foo
| fillnull value=0 ingest_pipe
| eval threshold=max(current_size)
| timechart max(threshold) as threshold avg(current_size) by ingest_pipe However as per your question seems like you are trying to calculate average size by each ingestion pipeline and then draw the maximum of average of each pipeline as threshold for corresponding average. Which should use the following SPL: index=_internal host=* group=queue name=*
| fillnull value=0 ingest_pipe
| timechart avg(current_size) by ingest_pipe useother=f usenull=f limit=0
| eventstats max(*) as max_*
... View more
06-16-2020
11:53 AM
@shrinkhalarana Try one of my answers using Link Input displayed as Tabs. This way you can set/unset tokens on Link input <change> event handler and then use depends and rejects for respective tabs/panels/underlying search query. All using Simple XML with CSS extension (no JS required) https://community.splunk.com/t5/Dashboards-Visualizations/How-can-we-create-Tabs-using-Link-List-in-Splunk-with-only-CSS/td-p/485176
... View more
06-16-2020
11:49 AM
how about timechart with cont=f, for example: <yourCurrentSearch>
| timechart count by Application cont=f Or use stats to plot _time like <yourCurrentSearch>
| bin _time span=1h
| stats count by _time Application Both these approach will plot for only the Time for which data is present hence your chart should not have gap!
... View more
06-16-2020
08:51 AM
1 Karma
@srizan you would need to add trim if you are plotting it on chart as regular split with your data will have space around response value. | eval response=trim(mvindex(fields,13))
... View more
06-16-2020
06:24 AM
When you want to Group Columns in a table together, do you have fixed no. of fields for each group? If not what is the logic for grouping? Can the logic be handled in code (SPL or JS)?
... View more
06-16-2020
06:15 AM
1 Karma
How are you currently updating your KV Store or refreshing the page through JS? One of those can have the code to unset the token. Also unset token code is something like the following: tokens.unset("yourTokenName"); Besides depending on your use case you may want to unset both default and submitted token model. Further, you would need to ensure that unsetting the token does not trigger unwanted execution of token change event which you may already have.
... View more
06-16-2020
06:11 AM
@pipipipi you can use CSS Style override like the one mentioned below where id of your heat map chart is #mychart (PS: I have used grey fill color as it is visible in both Light and Dark theme. You can try white if your dashboard will always have dark theme.) <panel>
<html depends="$hideCSSStyleOverride$">
<style>
#mychart g.apexcharts-xaxis-texts-g text{
fill: grey !important;
}
</style>
</html>
<viz id="mychart" type="heat-map-viz.heat-map-viz"> However, since the chart is handling all other elements in the Dark Theme, it would be better to contact Developer Daniel Sapvin though the contact he has provided for raising bug.
... View more
06-16-2020
05:37 AM
1 Karma
@spkriyaz Refer to one of older post that while using Table render() function you many need to add a minor setTimeout() for version 6.6 and above. https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Dashboard-Examples-Table-Row-highlighting-bug/m-p/342616#M41366 Also, instead of document ready() function you can also code. $(document).on("click","#mybutton",function(){
...
Your Click Handler Code goes here
...
});
... View more
06-15-2020
12:18 AM
If you put it in any other CSS file like my_own_styles.css you need to add script="my_own_styles.css" to all dashboards where you want your CSS to be applied. If you think you have the right CSS, for the community to assist you better 1. Can you add the Simple XML snippet for buttons in your dashboard? 2. CSS style override that you need to apply? 3. Also does the color need to change on Click or Hover or need to be applied by default? 4. Can you add sample screenshot of what is expected vs what you have right now?
... View more
06-02-2020
05:16 PM
Sorry was in some session entire day (rather night as per IST).
You could have just hidden the text instead of making background color and font color same.
... View more
06-01-2020
10:43 AM
@pgadhari since I was trying to help you with this and was not sure whether end result will work for you, I had not converted my comment to answer. So that your question remains unanswered and open for other Splunkers to assist with any other alternative if possible. Please accept the answer if your issue is resolved!
Happy Splunking!
... View more
06-01-2020
02:08 AM
@Reddi694325 if you do not want JS, you can use one Link input per panel as title using CSS Override and then set the token as per the link clicked. Refer to one of my answers to use Link input as Tab in Simple XML Dashboard with CSS extension: https://answers.splunk.com/answers/819869/how-can-we-create-tabs-using-link-list-in-splunk-w.html
Other option would be to use JS extension to code click event handler on panel title to set/unset tokens to display/hide respective panel!
... View more
05-30-2020
10:21 AM
Step 1 is for table and step 2 is for table. Step 2 makes table cell appear as single value. There is no single value viz required for this solution.
... View more
05-30-2020
10:12 AM
@sudeep5689 if you want to create Tabs using Simple XML (CSS but no JS), you can use Link Input to create that kind of view. Refer to a recent answer of mine: https://answers.splunk.com/answers/819869/how-can-we-create-tabs-using-link-list-in-splunk-w.html
... View more
05-30-2020
10:10 AM
charting.seriesColors is available for all charts. When you don't do transpose or eval(count(field)) as field you have only one series (which is shown as legend, in above case count ). So there will be only one color for only one series i.e. count.
Think what are you plotting, how would chart know what is your x-axis and y-axis. Usually first column goes as x-axis and Other column names make the series/legend.
For example for if you do | timechart count by field , _time becomes x-axis and field values make the series or legends.
Hope it clarifies stuff! 🙂
... View more
05-30-2020
09:49 AM
@marone besides applying the expression string from multiselect as token, you will also need to ensure that table visualization is refreshed every time multiselect value is changed (this can be done through JS). So, instead I am giving a Link input as submit button which resets the token so that search is re-run and table gets refreshed.
Following is the Simple XML run anywhere example which you can try and confirm!
<form>
<label>Highlight Selected values in Table</label>
<fieldset submitButton="false">
<input type="multiselect" token="chosenAdmin" searchWhenChanged="true">
<label>Select User to Highlight in the table</label>
<delimiter> </delimiter>
<change>
<unset token="refresh"></unset>
</change>
<fieldForLabel>user</fieldForLabel>
<fieldForValue>user</fieldForValue>
<search>
<query>| makeresults
| fields - _time
| eval user="UserA,UserB,UserC,UserD,UserE,UserF,UserG,UserH"
| makemv user delim=","
| mvexpand user</query>
</search>
</input>
<input id="button_submit1" type="link" token="tokLinkSubmit" searchWhenChanged="true">
<label></label>
<choice value="submit">Submit</choice>
<change>
<condition value="submit">
<set token="refresh">true</set>
<unset token="form.tokLinkSubmit"></unset>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<html depends="$alwaysHideCSSPanel$">
<style>
div[id^="button_submit"] div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{
width:40% !important;
}
div[id^="button_submit"] button[data-test="option"]{
padding: 6px 15px;
font-weight: 500;
background-color: #5cc05c;
border: transparent;
}
div[id^="button_submit"] span[data-test="label"]{
color: white !important;
}
div[id^="button_submit"] span[data-test="label"]:hover{
color: #3c444d !important;
}
</style>
</html>
<table>
<search depends="$refresh$">
<query>| makeresults
| fields - _time
| eval user="UserA,UserB,UserC,UserD,UserA,UserE,UserC,UserF,UserA,UserB,UserG,UserH"
| makemv user delim=","
| mvexpand user</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">20</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="user">
<colorPalette type="expression">if (like("$chosenAdmin$",value),"#DC4E41","#FFFFFF")</colorPalette>
</format>
</table>
</panel>
</row>
</form>
... View more
05-30-2020
08:40 AM
They are not options... They are step 1 and step 2
... View more
05-30-2020
07:37 AM
@pgadhari expression option was for <table> viz to be used as Single Value, not for <single> .The example is a run anywhere sample which you can execute to test.
... View more
