Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
05-21-2020
02:24 PM
I feel Splunk Answers does solve We're all here to learn together. I had been active on Splunk Answers for past 4 years, and every single day I have spent on Splunk Answers I have definitely learnt something new. Sometimes we do use Splunk Answers to log our answers similar to blog but with history so that version specific changes can also be documented.
If you have other expectation/views you can definitely mention!
... View more
05-21-2020
10:27 AM
@pgadhari Enhanced Timeline custom visualization seems to be very old App which was built on 6.4 which uses previous Custom Visualization API not the latest. So any specific reason for not using the Timeline Custom visualization by Splunk or Event Timeline custom visualization which is compatible with latest Splunk version and App Inspect passed?
... View more
05-21-2020
10:12 AM
@payton_tayvion for the community to assist you better please provide more details on the data and your drilldown use case? Do you want to set three tokens from your site i.e. Region, Business Unit and Asset?
Also what it the breakup for site? In your example ABC-DEF-PRIV-APJ-AU-SYD is first position ABC always Business Unit? Is 4th position APJ always region? Where is asset? What is position 2, 3, 5 and 6?
Seems like you need Simple XML <eval> with split() and mvindex() on $row.site$ to set the required tokens. But we will not be able to assist you better without further details.
On a different note: Second | where seems expensive. move vulnAge to main search. Also for 10K+ results you want to use Pie Chart? Either switch to a different viz or use Trellis Layout.
... View more
05-21-2020
09:56 AM
@hrs2019 table border seems to be visible in attached screenshot what is the intended output? If you want border to be more visible you can change border color or border width. Not sure what exactly are you looking for. So if you have any mock screenshot please attach for the community to assist you better, paint or even whiteboard would do.
... View more
05-21-2020
09:43 AM
@MERBAG it is not workaround it is the possible solution based on expected behavior or <eval> to set token in Simple XML using relative_time() . Have you tried changing the Logged in User's timezone to GMT and whether issue is still observed or not?
... View more
05-21-2020
09:39 AM
If you want static color CSS override can be used for CSS selector for the tooltip text. Refer to Clarafication Blog for Simple XML CSS Extension for identifying the CSS selector for tooltip text that needs to be overridden: https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-clara-fication-customizing-simplexml-dashboards-with-inline-css.html
Let us know if you need further details!
... View more
05-17-2020
10:36 AM
Hi @pgadhari please try the following approach:
Step 1 Use one of my old answers to color table row based on expression (SimpleXML with CSS, but you can use JS as well): https://answers.splunk.com/answers/820403/how-to-change-font-color-based-on-a-condition-for.html
Step 2 Then use the other answer to format the table as Single Value as per this answer: https://answers.splunk.com/answers/529004/is-there-a-way-to-display-more-than-20-charts-at-a.html
Second option could be to try this with JS. Let me know if above does not work!
... View more
05-17-2020
06:32 AM
@hrs2019 Unicode is the only option as I have mentioned above. Dark Mode will not work. Please try out and confirm!
... View more
05-16-2020
06:04 AM
Can you try the following?
<dashboard theme="dark">
<label>Panel layout alignment</label>
<search>
<query>|makeresults | eval total="2200 U / 3200 U" | table total
</query>
<done>
<set token="tokTotal">$result.total$</set>
</done>
<earliest>-1s</earliest>
<latest>now</latest>
</search>
<row>
<panel id="overall_u">
<title>Current Overall Used</title>
<viz type="horseshoe_meter_app.horseshoe_meter">
<search>
<query>|makeresults | eval count="25" | table count | rename count as U-Space</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="height">117</option>
<option name="horseshoe_meter_app.horseshoe_meter.backgroundColor">#212527</option>
<option name="horseshoe_meter_app.horseshoe_meter.caption">%</option>
<option name="horseshoe_meter_app.horseshoe_meter.dialColor">#D0D3D4</option>
<option name="horseshoe_meter_app.horseshoe_meter.maxRangeColor">#b44441</option>
<option name="horseshoe_meter_app.horseshoe_meter.maxRangeThreshold">80</option>
<option name="horseshoe_meter_app.horseshoe_meter.maxValue">100</option>
<option name="horseshoe_meter_app.horseshoe_meter.midRangeColor">#fbcd2f</option>
<option name="horseshoe_meter_app.horseshoe_meter.midRangeThreshold">60</option>
<option name="horseshoe_meter_app.horseshoe_meter.minRangeColor">#53a051</option>
<option name="horseshoe_meter_app.horseshoe_meter.minValue">0</option>
<option name="horseshoe_meter_app.horseshoe_meter.thresholdStyle">percentage</option>
<option name="horseshoe_meter_app.horseshoe_meter.useRangemap">true</option>
<option name="horseshoe_meter_app.horseshoe_meter.valueColor">#53a051</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">small</option>
</viz>
<html id="html_footer_stats">
<style>
#html_footer_stats .panel-body.html{
padding:0px;
}
</style>
<div style="display:flex;height:20px;justify-content: center;">
<div style="padding-right:10px"><i class="icon-info"></i></div>
<div>$tokTotal$</div>
</div>
</html>
</panel>
<panel>
<title>Current PDU Used</title>
<viz type="horseshoe_meter_app.horseshoe_meter">
<search>
<query>|makeresults | eval count="37.0" | table count</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="height">118</option>
<option name="horseshoe_meter_app.horseshoe_meter.backgroundColor">#212527</option>
<option name="horseshoe_meter_app.horseshoe_meter.caption">%</option>
<option name="horseshoe_meter_app.horseshoe_meter.dialColor">#D0D3D4</option>
<option name="horseshoe_meter_app.horseshoe_meter.maxRangeColor">#b44441</option>
<option name="horseshoe_meter_app.horseshoe_meter.maxRangeThreshold">80</option>
<option name="horseshoe_meter_app.horseshoe_meter.maxValue">100</option>
<option name="horseshoe_meter_app.horseshoe_meter.midRangeColor">#fbcd2f</option>
<option name="horseshoe_meter_app.horseshoe_meter.midRangeThreshold">60</option>
<option name="horseshoe_meter_app.horseshoe_meter.minRangeColor">#53a051</option>
<option name="horseshoe_meter_app.horseshoe_meter.minValue">0</option>
<option name="horseshoe_meter_app.horseshoe_meter.thresholdStyle">percentage</option>
<option name="horseshoe_meter_app.horseshoe_meter.useRangemap">true</option>
<option name="horseshoe_meter_app.horseshoe_meter.valueColor">#53a051</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
<panel>
<title>Current Network Used</title>
<viz type="horseshoe_meter_app.horseshoe_meter">
<search>
<query>|makeresults | eval count="64" | table count</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="height">118</option>
<option name="horseshoe_meter_app.horseshoe_meter.backgroundColor">#212527</option>
<option name="horseshoe_meter_app.horseshoe_meter.caption">%</option>
<option name="horseshoe_meter_app.horseshoe_meter.dialColor">#D0D3D4</option>
<option name="horseshoe_meter_app.horseshoe_meter.maxRangeColor">#b44441</option>
<option name="horseshoe_meter_app.horseshoe_meter.maxRangeThreshold">80</option>
<option name="horseshoe_meter_app.horseshoe_meter.maxValue">100</option>
<option name="horseshoe_meter_app.horseshoe_meter.midRangeColor">#fbcd2f</option>
<option name="horseshoe_meter_app.horseshoe_meter.midRangeThreshold">60</option>
<option name="horseshoe_meter_app.horseshoe_meter.minRangeColor">#53a051</option>
<option name="horseshoe_meter_app.horseshoe_meter.minValue">0</option>
<option name="horseshoe_meter_app.horseshoe_meter.thresholdStyle">percentage</option>
<option name="horseshoe_meter_app.horseshoe_meter.useRangemap">true</option>
<option name="horseshoe_meter_app.horseshoe_meter.valueColor">#53a051</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
<panel id="image_overlay_panel">
<title>Overall Used (%)</title>
<html>
<div class="ingestion_pipeline">
<div class="image"/>
</div>
<div class="network">
<a href="" target="_blank">$network$</a>
</div>
<div class="system">
<a href="" target="_blank">$system$</a>
</div>
<div class="planned">
<a href="" target="_blank">$planned$</a>
</div>
<div class="partner">
<a href="" target="_blank">$partner$</a>
</div>
<div class="waste">
<a href="" target="_blank">$waste$</a>
</div>
<div class="free">
<a href="" target="_blank">$free$</a>
</div>
</html>
</panel>
</row>
</dashboard>
... View more
05-16-2020
05:37 AM
@hawifaris try the following CSS which is applied using map with id="map_with_light_tooltip_background" . I have changed the color to grey in the example.
<html depends="$alwaysHideCSSPanel$">
<style>
#map_with_light_tooltip_background div.leaflet-popup-pane div.leaflet-popup div.leaflet-popup-content-wrapper{
background: grey !important;
}
</style>
</html>
<map id="map_with_light_tooltip_background">
... View more
05-15-2020
07:16 AM
1 Karma
@jjofret can you try the following
<yourCurrentSearch>
| stats list("tipo de red") as "tipo de red" list(FW) as FW by Entorno
If you want Table Formatting also the way in your example you can try the following CSS Style override where table_multivalue_with_format is the id of the table
<html depends="$alwaysHideCSS$">
<style>
#table_multivalue_with_format table tbody tr td {
padding: 1px !important;
text-align: center !important;
}
#table_multivalue_with_format table tbody tr td div.multivalue-subcell{
border-top-style: solid;
border-left-style: solid;
border-right-style: solid;
text-align: center !important;
border-width: thin;
}
#table_multivalue_with_format table tbody tr td div.multivalue-subcell:last-child{
border-bottom-style: solid;
}
</style>
</html>
Following is a run anywhere example based on Sample Data Provided:
<dashboard>
<label>Table with Multivalue</label>
<row>
<panel>
<html depends="$alwaysHideCSS$">
<style>
#table_multivalue_with_format table tbody tr td {
padding: 1px !important;
text-align: center !important;
}
#table_multivalue_with_format table tbody tr td div.multivalue-subcell{
border-top-style: solid;
border-left-style: solid;
border-right-style: solid;
text-align: center !important;
border-width: thin;
}
#table_multivalue_with_format table tbody tr td div.multivalue-subcell:last-child{
border-bottom-style: solid;
}
</style>
</html>
<table id="table_multivalue_with_format">
<search>
<query>| makeresults
| eval data="test,dmz,yes;test,dmz,no;test,ian,yes;production,dmz,yes;production,dmz,no;production,ian,yes;production,ian,no;"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval Entorno=mvindex(data,0),"tipo de red"=mvindex(data,1),FW=mvindex(data,2)
| table Entorno "tipo de red" FW
| stats list("tipo de red") as "tipo de red" list(FW) as FW by Entorno</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard>
... View more
05-14-2020
06:22 AM
1 Karma
@hrs2019 If you want table with icon (built-in or custom), you should try Splunk Dashboard Examples app which has Table Icon Set (Rangemap) specifically for such use case. You can also try out the following blogs: https://www.splunk.com/en_us/blog/tips-and-tricks/custom-icons-in-splunk-6-tables.html
You can also add your own glow animation as per your question:
Following is a run anywhere example.
Simple XML Dashboard:
<dashboard script="table_glowing_icons.js" theme="dark">
<label>Table with Glowing Icons</label>
<row>
<panel>
<html>
<style>
td.icon {
text-align: center;
}
td.icon i {
font-size: 25px;
}
td.icon .severe {
color: red;
}
td.icon .elevated {
color: orangered;
}
td.icon .low {
color: #006400;
}
td.icon i.severe::before,
td.icon i.elevated::before{
-webkit-animation: glowing 1500ms infinite;
}
@-webkit-keyframes glowing {
0% {opacity: 0.1;font-size:medium;text-shadow: 0 0 3px #DC4E41;}
25% {opacity: 0.7;font-size:large;text-shadow: 0 0 10px #DC4E41;}
75% {opacity: 1;font-size:x-large;text-shadow: 0 0 30px #DC4E41;}
100% {opacity: 0.7;font-size:large;text-shadow: 0 0 10px #DC4E41;}
}
.icon-inline i {
font-size: 18px;
margin-left: 5px;
}
.icon-inline i.icon-alert-circle {
color: #ef392c;
}
.icon-inline i.icon-alert {
color: #ff9c1a;
}
.icon-inline i.icon-check {
color: #5fff5e;
}
</style>
</html>
<table id="table1">
<search>
<query>| makeresults
| eval ApName="CCP,SSD,FF,DDD,RT","Area CP Name"="test"
| makemv ApName delim=","
| mvexpand ApName
| streamstats count as sno
| eval CLevel=case(sno%2==0, "low",sno%3==0, "severe",true(),"elevated")
| table ApName "Area CP Name" CLevel</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard>
Required JS file: table_glowing_icons.js
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView) {
var RangeMapIconRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Only use the cell renderer for the CLevel field
return cell.field === 'CLevel';
},
render: function($td, cell) {
// Create the icon element and add it to the table cell
$td.addClass('icon').html(_.template('<i class="icon-alert-circle <%- CLevel %>" title="<%- CLevel %>"></i>', {
CLevel: cell.value,
}));
}
});
mvc.Components.get('table1').getVisualization(function(tableView){
// Register custom cell renderer, the table will re-render automatically
tableView.addCellRenderer(new RangeMapIconRenderer());
});
});
PS: If you dont want JS and are fine without using Dark Theme, you can try out Unicode Icon in Table like
https://emojipedia.org/large-orange-circle/
https://emojipedia.org/large-red-circle/
https://emojipedia.org/large-green-circle/
Refer to answers:
https://answers.splunk.com/answers/681268/one-rangemap-column-for-multiple-values.html
https://answers.splunk.com/answers/755100/how-to-add-icons-for-the-multiple-fields-in-splunk.html
... View more
05-14-2020
04:57 AM
@hrs2019 Glad it worked. Do up vote the comments/answers that helped!
... View more
05-14-2020
12:15 AM
@hrs2019, refer to the following question, where my answers has an option with depends and rejects , based on $job.resultCount$ (which basically tells whether search returned results or not) to toggle between your actual data panel vs. your custom panel/message.
The same is also described in Splunk Documentation and Splunk Dashboard Examples App. Please go through them to grasp the concepts.
https://answers.splunk.com/answers/582253/replacing-no-results-found-with-0.html
... View more
05-14-2020
12:09 AM
@HattrickNZ Except <row> and viz like <table> other comments are retained even on editing. Can you please add code snippet of which place/s are you trying comments? Before and after code?
For me on 8.0.3 only <row> comment got removed and <table> comment got replaced to a place before <options> .
Following is initial code:
<dashboard>
<label>Dashboard with Comment</label>
<!-- Some Comment Top -->
<row>
<!-- Some Comment Row -->
<panel>
<!-- Some Comment Panel -->
<table>
<!-- Some Comment Viz -->
<search>
<!-- Some Comment Search -->
<query>
<!-- Some Comment Query -->
| makeresults count=5
| eval data=random()</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<done>
<!-- Some Comment Search Handler -->
<set token="tokResult">$job.resultCount$</set>
</done>
</search>
<!-- Some Comment Options -->
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<!-- Some comment Drilldown -->
<set token="tokTest">$click.value2$</set>
</drilldown>
</table>
</panel>
</row>
</dashboard>
Following is simple XML after search was edited from UI. Which means, I can retain most information through comments even if I edited from front-end.
<dashboard>
<label>Dashboard with Comment</label>
<!-- Some Comment Top -->
<row>
<panel>
<!-- Some Comment Panel -->
<table>
<search>
<!-- Some Comment Search -->
<done>
<!-- Some Comment Search Handler -->
<set token="tokResult">$job.resultCount$</set>
</done>
<query>| makeresults count=5
| eval data=random()
| fields - _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<!-- Some Comment Viz -->
<!-- Some Comment Options -->
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<!-- Some comment Drilldown -->
<set token="tokTest">$click.value2$</set>
</drilldown>
</table>
</panel>
</row>
</dashboard>
Please add more details if your issue is different. Will recommend you to open a support ticket or submit and idea for better commenting.
... View more
05-13-2020
11:53 PM
@iamsplunker31 by JavaScript do you mean Simple XML JS Extension or HTML Dashboard?
... View more
05-13-2020
10:01 PM
2 Karma
@nsnelson402 you can try bin command on _time and then use stats for the correlation with multiple fields including time. Finally use eval {field}=aggregation to get it Trellis ready.
In your case try the following (span is 1h in example, but it can be made dynamic based on time input, but keeping example simple):
<yourCurrentSearch>
| bin _time span=1h
| stats count by _time ip fw_name
| eval {fw_name}=count
| fields - fw_name count
Then choose the aggregation as you want to split through Trellis
Following is a run anywhere example based on Splunk's _internal index:
index=_internal sourcetype=splunkd
| bin _time span=5min
| stats count by _time component log_level
| eval {log_level}=count
| fields - log_level count
Following is the Simple XML Code for attached screenshot that you can play with.
<dashboard theme="dark">
<label>Trellis with Time and Two aggregation</label>
<row>
<panel>
<chart>
<search>
<query>index=_internal sourcetype=splunkd
| bin _time span=5min
| stats count by _time component log_level
| eval {log_level}=count
| fields - log_level count</query>
<earliest>-60min</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">collapsed</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">zero</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">seriesCompare</option>
<option name="charting.legend.placement">none</option>
<option name="charting.lineWidth">2</option>
<option name="height">575</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="trellis.scales.shared">0</option>
<option name="trellis.size">medium</option>
<option name="trellis.splitBy">log_level</option>
</chart>
</panel>
</row>
</dashboard>
... View more
05-13-2020
08:53 PM
@hrs2019 In the example in the answer above depends has been added to the row. depends can be added to <row> , <panel> , <viz> and even <search> to control the behavior depending on whether the token is set or not. Just add depends with the token which is needs to be set for the search to run.
For examples:
<panel depends="$mytoken$">
<table>
<search>
<query>| makeresults
| fields - _time
| eval temp="$mytoken$"
</query>
</search>
<table>
</panel>
... View more
05-12-2020
11:55 PM
@jfederline Version 6.0.0 of the Splunk Add-on for ServiceNow , released on May 8, 2020, supports Orlando . Refer to Release Notes. You can get the latest Splunk Add On for Service Now from Splunkbase.
... View more
05-12-2020
09:37 AM
1 Karma
@prettysunshinez chart will not allow three field aggregation so you may have to stats with eval {field2}= aggregation
<yourCurrentSearch>
| stats count by field1 field2 field3
| eval {field2}=count
| fields - field2 count
Then choose trellis by field3
Following is a run anywhere example based on Splunk's _internal index that can be used to split by component and display count over date_hour by log_level
index=_internal sourcetype=splunkd log_level!=INFO
| stats count by date_hour log_level component
| eval {log_level}=count
| fields - count log_level
... View more
05-12-2020
04:57 AM
@punithjigali here are some of the custom visualizations that you can check out:
Graphviz: https://splunkbase.splunk.com/app/4346/
Network Topology - Custom Visualization: https://splunkbase.splunk.com/app/3762/
Flow Map Viz: https://splunkbase.splunk.com/app/4657/
3D Graph Network Topology Visualization: https://splunkbase.splunk.com/app/4611/
Force Directed App: https://splunkbase.splunk.com/app/3767/
If you want to build your own, you can try out Splunk Custom Visualization API and integrate your visualization source code.
... View more
05-12-2020
12:36 AM
@darls15 , if now is your field you can try the following to round off hours time. However some case() may need to be added/changed as per your use case.
<yourCurrentSearch>
| rex field=now "(?<Hour>[^:]+):(?<Minute>[^:]+):(?<Seconds>\d+)"
| eval rounded_hour=case(Seconds>30 AND Minute>29,Hour+1,
Minute>30,Hour+1,
true(),Hour).":00".":00"
Following is run anywhere example you can use to test:
| makeresults
| eval now="14:36:18"
| rex field=now "(?<Hour>[^:]+):(?<Minute>[^:]+):(?<Seconds>\d+)"
| eval rounded_hour=case(Seconds>30 AND Minute>29,Hour+1,
Minute>30,Hour+1,
true(),Hour).":00".":00"
Above computes 09:29:31 as 09:00:00 ,
09:30:00 as 09:00:00 ,
09:30:30 as 09:00:00
but 09:30:31 as 10:00:00 .
09:31:00 as 10:00:00 ,
and 09:31:31 as 10:00:00
So in case your expectations are different. Please change as per your needs.
... View more
05-11-2020
11:49 PM
2 Karma
That's why best practices.
A chain of only Map-Reduce commands can leverage processing of reduced data set on each Search Peer. Divide and Conquer 🙂 https://docs.splunk.com/Documentation/Splunk/latest/Search/Writebettersearches#Parallel_processing_example
On my personal laptop I ran following SPL to generate 15M events: This search has completed and has returned 15,000,000 results by scanning 0 events in 95.403 seconds
| makeresults count=5000
| streamstats count as sno
| eval label="event_".sno, event=mvrange(1,3001,1)
| stats count by event label
| eval label=label."_".event,data=random()
| fields label data
... View more
05-11-2020
09:44 PM
@to4kawa use case is a use case. We would not be able to recommend more than 1000 data points in a chart as we would not be able to interpret. But there could be ML/IoT/Research based use cases where 4K*3K correlation is required to be visualized. So this is not a question of worst practice, it is a question on use case!
This is the answer where I have made that recommendation: https://answers.splunk.com/answers/821286/horizontal-scroll-bar-in-column-chart.html#answer-820293
... View more
05-11-2020
04:18 AM
@email2vamsi your comment above If a hostname has 45 dates for the last 30 days is not obvious as per the original question or screenshot. More than one event per host per day means you will have multi-value result.
All you need to change in my query is latest(date1) should be changed with values(date1) .
Also whether you have 1 host, 100s or 1000s or more hosts they will be handled by by hostname clause of chart command.
On second note, using Col as the Date, you will always have 1 column per day, if you query last 30 days you will get 30 columns and if you query last 7 days you will get 7 columns.
Just change latest() aggregation with values() aggregation in my comment above and confirm if your issue is resolved.
... View more
