Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
05-30-2020
07:34 AM
@nagar57, try the following:
index=<> sourcetype=<> source=<> channel IN ("A","B","C")
| stats count by channel
| transpose 3 header_field=channel
Or else if you want to stick to your query, try the following:
index=<> sourcetype=<> source=<> channel IN ("A","B","C")
| stats count(eval(channel="A")) as A count(eval(channel="B")) as B count(eval(channel="C")) as C
| eval channel="count"
| fields channel A B C
... View more
05-30-2020
07:27 AM
@sarithapguptha can you add the mock screenshot of what you need? Also what is your current dashboard snippet for inputs?
... View more
05-30-2020
07:25 AM
1 Karma
@nagar57 please try the following ... you missed adding table id #all_req_table to .table td
#all_req_table .table th,
#all_req_table .table td {
text-align: left !important;
font-weight: bold !important;
}
... View more
05-27-2020
01:27 PM
1 Karma
Actually Status Indicator gives you access to a lot of icons from the Font Awesome library ( it will not be the latest version though). So you need to test and see which one are actually available.
https://fontawesome.com/icons?d=gallery
There are several Splunk Answers or font awesome custom icons.
... View more
05-27-2020
12:59 PM
@nitzan_b what is the logic that you need to apply for table cell color palette? If it is based on Range have you tried threshold based colorPalette ? Following is an example:
<format type="color" field="data">
<colorPalette type="list">[#53A051,#B6C75A,#006D9C,#62B3B2,#F8BE34,#EC9960,#F1813F,#DC4E41]</colorPalette>
<scale type="threshold">0,20,40,60,80,90,95</scale>
</format>
<format type="number" field="data">
<option name="unit">%</option>
</format>
If the logic is different and not covered by any of mechanism provided in Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsXML#Color_palette_types_and_options, then, please add details for the community to assist!
... View more
05-27-2020
09:45 AM
@thaara if you are using the following query I dont see how other subfolder will show up as you have not used * in the mn filter
index=" " sourcetype= " " mn IN ("/","/var")
... View more
05-27-2020
08:10 AM
1 Karma
I have already updated my answer. Did you try with | eval sort_field=printf("%2d",sort_field) ?
... View more
05-27-2020
08:09 AM
I prefer transaction when for scenarios where I need to drilldown with a particular session_id or for more complex scenarios where things like maxpause and other conditions are in place. A good guide to Event Grouping and Correlation is this Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation
However, there is more to correlation and commands like union, multisearch also needs to be considered under specific circumstances.
... View more
05-27-2020
05:24 AM
@HattrickNZ, if you are on Splunk 6.5 or higher , you can enable Summary Row using table which shows Total as the final row in the table: https://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsFormatting#Totals_summary_row
... View more
05-27-2020
04:57 AM
1 Karma
@andrewcg which are the fields you want to stitch together after transaction command?
You should ideally try stats for your correlation instead of transaction . There are several examples of stats for transaction on Splunk Answers.
<yourCurrentSearch>
| fields _time, session_id, field1, field2, field3
| eval Time=_time
| bin _time span=30s
| stats count as eventcount list(*) as list_* by _time session_id
| eval maxTime=mvindex(list_Time,0),minTime=mvindex(list_Time,eventcount-1), duration=maxTime-minTime
| fields - minTime maxTime
Following is a runanywhere example based on Splunk's _internal index just to generate some data and correlate using component (similar to session_id )
index=_internal sourcetype=splunkd
| fields _time, component, log_level, date_hour, date_minute, date_second
| eval Time=_time
| bin _time span=30s
| stats count as eventcount list(*) as list_* by component _time
| eval maxTime=mvindex(list_Time,0),minTime=mvindex(list_Time,eventcount-1), duration=maxTime-minTime
| fields - minTime maxTime
Please try out and confirm!
... View more
05-27-2020
04:16 AM
@zovinchong image did not get uploaded so try uploading to any image sharing site and share the link using <img> button or shortcut Ctrl+G
... View more
05-27-2020
04:12 AM
@cuongnguyen112 you can refer to Custom Visualization API of Splunk where you can integrate JS based visualizations: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomVizTutorial
... View more
05-27-2020
04:05 AM
1 Karma
[UPDATED ANSWER] As per original question there were only four splits, however, if there are more then padding is required to override alphanumeric sorting as per our need. If you have data till two digits precision following will be required | eval sort_field=printf("%2d",sort_field) , where %2 , takes care of ensuring up to 99 splits sorting will work fine! If you need sorting till 999 , you would need to use %3
| streamstats count as sort_field
| eval sort_field=printf("%2d",sort_field), indicators=sort_field.". ".indicators
| stats sum(value) as value last(icon) as icon by indicators
@pgadhari try the following as the only workaround I know right now:
<yourCurrentSearch>
| eval indicators=sort_field.". ".indicators
| stats sum(value) as value last(icon) as icon by indicators
... View more
05-26-2020
11:43 AM
@woodcock how about this answer: https://answers.splunk.com/answers/529004/is-there-a-way-to-display-more-than-20-charts-at-a.html#answer-816673
... View more
05-26-2020
04:58 AM
CSS can definitely be applied. However, I am skeptical downloading an app that is so old! Reason for it being Up & Down is to ensure they dont overlap when the Timeline windows are too small and may be the names are too big. Are you sure you will not run into that situation?
... View more
05-26-2020
02:17 AM
@rendie for Splunk Enterprise you can try out Splunk Dashboards App (Beta)
... View more
05-25-2020
09:46 AM
@pipipipi check out the accum command in Splunk Documentation. You just need to add | accum c as d to your existing search. However, there can be some performance improvements (refer below):
<yourSearchToFetchData>
| fields a b date
| stats sum(a) as a sum(b) as b by date
| eval c=a-b
| accum c as d
... View more
05-24-2020
01:04 PM
@verbal_666 if you want to have dynamic single values for each host in the lookup, please try the Trellis Layout feature and confirm. Following is the Splunk Documentation
https://docs.splunk.com/Documentation/Splunk/latest/Viz/VisualizationTrellis
You will find several examples on Splunk Answers if you search for Trellis Single Value.
... View more
05-24-2020
05:55 AM
@verbal_666 the one panel per host is table or any chart? Can you elaborate? If they are chart you can definitely try Trellis layout!
... View more
05-23-2020
12:06 PM
@fish111 have you checked Splunk Cloud Gateway Supported Visualization documentation to ensure you are using supported viz and no Custom Visualization is present in your dashboard? Also check to ensure any of other limitations are not being hit.
One other test would be to create a dashboard with only one line chart or pie chart (no input/tokens other custom components) and see how they behave in your connected device.
Work with Splunk Support if the issue is not resolved.
... View more
05-23-2020
11:53 AM
@premranjithj can it be uploaded to your Splunk app's appserver/static folder?
Sample path like below:
$SPLUNK_HOME/etc/apps/yourAppName/appserver/static/helpfile/newdocument/document.pdf
If not, by default browser will not allow you to load local resources as it will expose malicious activity, you will have to host Help pdf file on a server and anchor should point to that http/https URL.
... View more
05-23-2020
11:37 AM
@splunkian table row expansion is not working or cell renderer? Also when you expand table row which is the viz you are using?
Can you check out if setTimeout helps?
https://answers.splunk.com/answers/614788/splunk-dashboard-examples-table-row-highlighting-b.html
... View more
05-23-2020
11:30 AM
2 Karma
@prats84 if you want SimpleXML option you can try Link Input with CSS override to make them appear as Submit button. If you want JS approach you can check out Octo Insight blog There can be only one ... Submit Button? by @rjthibod.
Following is a run anywhere example with pure Simple XML approach using built in Splunk Link input as button , which runs respective panel chart query only after respective input is selected following respective submit button being clicked. Each time an input is changed the chart is reset and search is unset.
Following is the approach used:
Step 1: Using Link input <change> event handler set the token when the submit link is clicked. Unset the link form input.
Step 2: Pass the token set in above step as depends to <chart> or any other viz to hide if token is unset and show if token is set.
Step 3: Pass the token set in above step as depends to <search> to stop search from being dispatched if token is unset and run search only when the token is set.
Step 4: On change of respective panel input unset the token set by respective submit link so that chart gets hidden and search is stopped from being dispatched again and requires submit click to re-run the search.
Step 5: Use CSS Style override for making Links appear as Button. PS: For demo example's simplicity CSS Style has been overridden through Simple XML dashboard code through hidden <html> panel. Use CSS Stylesheet in production or actual use case.
<form>
<label>Panel with Submit Button</label>
<fieldset submitButton="false"></fieldset>
<row depends="$alwaysHideCSSPanel$">
<panel>
<html>
<style>
#link1 div[data-test="radio-bar"],
#link2 div[data-test="radio-bar"]{
width: 120px !important;
background-color: #5CC05C;
}
#link1 div[data-test="radio-bar"] button[data-test="option"] span[data-test="label"],
#link2 div[data-test="radio-bar"] button[data-test="option"] span[data-test="label"]{
color: #FFFFFF !important;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<title>Panel 1</title>
<input type="time" token="time1">
<label></label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
<change>
<unset token="submit1"></unset>
</change>
</input>
<input id="link1" type="link" token="link1" searchWhenChanged="true">
<label></label>
<choice value="submit">Submit</choice>
<change>
<condition value="submit">
<set token="submit1">true</set>
<unset token="form.link1"></unset>
</condition>
</change>
</input>
<chart depends="$submit1$">
<title>Chart 1</title>
<search depends="$submit1$">
<query>| tstats count where index=_internal sourcetype=splunkd by _time span=1h</query>
<earliest>$time1.earliest$</earliest>
<latest>$time1.latest$</latest>
</search>
<option name="charting.chart">line</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<title>Panel 2</title>
<input type="time" token="time2">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
<change>
<unset token="submit2"></unset>
</change>
</input>
<input id="link2" type="link" token="link2" searchWhenChanged="true">
<label></label>
<choice value="submit">Submit</choice>
<change>
<condition value="submit">
<set token="submit2">true</set>
<unset token="form.link2"></unset>
</condition>
</change>
</input>
<chart depends="$submit2$">
<title>Chart 2</title>
<search depends="$submit2$">
<query>| tstats count where index=_internal sourcetype=splunkd by _time span=1h</query>
<earliest>$time2.earliest$</earliest>
<latest>$time2.latest$</latest>
</search>
<option name="charting.chart">line</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</form>
... View more
05-23-2020
10:14 AM
@roopatvs91 if you have used https://answers.splunk.com/answers/236389/adding-tooltip-to-panel-on-a-hover.html to come up with Panel 1 tooltip, please extend the same to second panel with ID.
<html id="htmlToolTip2" depends="$tokToolTipShow2$">
<!-- Style for Tooltip Text for center alignment with panel -->
<style>
#htmlToolTip2{
margin:auto !important;
width: 20% !important;
}
</style>
<div class="tooltip fade top in">
<div class="tooltip-arrow"/>
<div class="tooltip-inner">$tokToolTipText2$</div>
</div>
</html>
and in JS add the following for panel 2 with id panel2
//On mouseover() event set the show token for the Tooltip
$('#panel2').on("mouseover",function(){
var tokens = mvc.Components.get("submitted");
tokens.set("tokToolTipShow2", "true");
});
//On mouseout() event unset the show token for the Tooltip to hide the same.
$('#panel2').on("mouseout",function(){
var tokens = mvc.Components.get("submitted");
tokens.unset("tokToolTipShow2");
});
Depending on your use case actual code may change. So please add further details if above does not resolve your use case!
... View more
