Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
05-11-2020
04:18 AM
@email2vamsi your comment above If a hostname has 45 dates for the last 30 days is not obvious as per the original question or screenshot. More than one event per host per day means you will have multi-value result.
All you need to change in my query is latest(date1) should be changed with values(date1) .
Also whether you have 1 host, 100s or 1000s or more hosts they will be handled by by hostname clause of chart command.
On second note, using Col as the Date, you will always have 1 column per day, if you query last 30 days you will get 30 columns and if you query last 7 days you will get 7 columns.
Just change latest() aggregation with values() aggregation in my comment above and confirm if your issue is resolved.
... View more
05-11-2020
03:40 AM
@brandy81 what is your current SPL, what is the final output for your chart? Can you share Simple XML code and sample screenshot of existing output? Please mask any sensitive information before posting.
Have you already configured all the required configuration from Splunk Documentation for Data Truncation? https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartDisplayissues#Data_truncation
PS: 4K*3K=12000000 .
Are you seeing any UI warning like (based on your configuration) This visualization is configured to display a maximum of 10000 results per series ? Are you using Post-Processing, Custom Visualization or seeing any Browser Console errors?
... View more
05-11-2020
03:25 AM
To be specific Post Processing Best Practices.
The reason for use of transforming commands in base search is so that you reduce the number of rows by using some aggregation field/s and have base search pull only required (reduced) rows and colums. However, if only eventstats and streamstats are used you will still have original no. or rows and will not be reducing the total number of events.
As far as performance is concerned depends upon factors like:
1. Your Splunk environment specs and configs
2. How much data is getting pulled in your base search.
3. Use loadjob vs. post-processing.
4. Other Acceleration techniques like metrics index, data model acceleration etc.
... View more
05-11-2020
03:02 AM
@pgadhari one option would be to use Splunk Dashboard App (Beta) from Splunkbase if you want pixel perfect image layout and complete control of the grid.
If you want this to be fixed within Simple XML Dashboard, you will have to provide your dashboard code with the panel and viz structure that you have used and will have to mask/anonymize any sensitive information.
... View more
05-11-2020
02:58 AM
@email2vamsi as per the data/details provided seems like your use case is that Daily you will have one host reported only once and you want per host the time at which the host reported daily.
If the above is your use case, can you try the following
base search from JSON..
| eval Col=strftime(_time,"%Y-%m-%d"),date1=strftime(_time,"%Y-%m-%d %H:%M:%S")
| chart latest(date1) as date1 by hostname Col
Following is a run anywhere search based on Splunk's _internal index:
index=_internal sourcetype=splunkd
| eval Col=strftime(_time,"%Y-%m-%d"),date1=strftime(_time,"%Y-%m-%d %H:%M:%S")
| chart latest(date1) as date1 by log_level Col
Please try out and confirm!
... View more
05-11-2020
02:48 AM
Like I said for Cloud Native application you can check out Splunk Cloud Services.
Dashboard Beta will anyways not support extensions!
... View more
05-11-2020
02:45 AM
@hrs2019 if you want purely CSS based approach you can try the following, where colorPalette map is used to assign Green or Red Color based on Connected or Disconnected
<format type="color" field="CLevel">
<colorPalette type="map">{"Disconnected":#DC4E41,"Connected":#53A051}</colorPalette>
</format>
and Glow animation is always shades of Grey (static).
@-webkit-keyframes glowing {
0% {opacity: 0.5; -webkit-box-shadow: 0 0 3px #F7F8FA;}
50% {opacity: 0.7; -webkit-box-shadow: 0 0 40px #E1E6EB;}
100% {opacity: 1; -webkit-box-shadow: 0 0 3px #F7F8FA;}
}
If you want both rendering and glow to be as per CLevel field value, you will have to use Simple XML JS Extension to apply appropriate classes to each cell and have glowing CSS override according to the class. You can refer to Splunk Dashboard Examples app or several answers on Splunk Answers Table Cell rendering to see how you can access Table Cell value in JS and assign Class as per the table cell. For example: https://answers.splunk.com/answers/637615/why-is-the-table-cell-highlighting-not-reading-the.html
Following is the complete Simple XML Code:
<dashboard script="panel_tooltip.js" theme="dark">
<label>Table with Flashing Buttons</label>
<row>
<panel depends="$alwaysHideCSSOverride$">
<html>
<style>
#tableWithGlowingButtons table td:nth-child(3) {
border-radius: 10px;
border: none;
cursor: pointer;
display: inline-block;
font-family: Arial;
font-size: 12px;
margin: 5px;
padding: 5px 10px;
text-align: center;
text-decoration: none;
-webkit-animation: glowing 1500ms infinite;
}
@-webkit-keyframes glowing {
0% {opacity: 0.5; -webkit-box-shadow: 0 0 3px #F7F8FA;}
50% {opacity: 0.7; -webkit-box-shadow: 0 0 40px #E1E6EB;}
100% {opacity: 1; -webkit-box-shadow: 0 0 3px #F7F8FA;}
}
</style>
</html>
</panel>
<panel>
<title>Status</title>
<table id="tableWithGlowingButtons">
<search>
<query>| makeresults
| eval ApName="CCP,SSD,FF,DDD,RT","Area CP Name"="test"
| makemv ApName delim=","
| mvexpand ApName
| eval CLevel=if(like(ApName,"%CCP%"), "Connected", "Disconnected")
| table ApName "Area CP Name" CLevel</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="CLevel">
<colorPalette type="map">{"Disconnected":#DC4E41,"Connected":#53A051}</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
... View more
05-11-2020
01:36 AM
@punithjigali there should be two series one under Threshold and second with threshold breaches. Once you create that you can have a connected chart on lines similar to the answer below: https://answers.splunk.com/answers/662654/how-to-create-highchart-zones-that-change-the-colo.html
If this is not what you are looking for, please add more context to your question/use case with anonymized data sample, current output and expected output and SPL used!
... View more
05-11-2020
01:29 AM
@aldrichb were you able to try the above? Is your issue resolved?
... View more
05-10-2020
11:54 PM
@richielynch89 above is a generic example for Cell Rendering for multivalued-cells within table. If you want specific rendering depending on cell type you will have to pass on the cell field names and take actions accordingly. Following is an example of Table Cell rendering extension: https://answers.splunk.com/answers/637615/why-is-the-table-cell-highlighting-not-reading-the.html
You Should also check out Splunk Dashboard Examples app from Splunkbase for getting familier with Splunk JS Stack and Simple XML JS Extensions.
... View more
05-10-2020
11:23 PM
@paulerlong installing Custom Visualization will follow the steps same as how you would install any other App within Splunk. Depending on the environment setup the answer to the exact question may differ. So do following Splunk Documentation for the App setup on your SH/SHC.
... View more
05-08-2020
10:46 PM
@neuroredvio refer to one of my older answers that post 6.6 you would need to add setTimeout() for Table Render to ensure Row highlighing works properly: https://answers.splunk.com/answers/614788/splunk-dashboard-examples-table-row-highlighting-b.html
Also refer to another answer with purely Simple XML version using colorPalette expression to color table Row without any JS: https://answers.splunk.com/answers/820403/how-to-change-font-color-based-on-a-condition-for.html
... View more
05-08-2020
10:12 PM
@neuroredvio I am afraid that kind of customization is currently not possible in Splunk Dashboard Beta. If your app is cloud native you can explore Splunk Cloud Services where you can extend the visualizations through React: https://www.splunk.com/en_us/blog/tips-and-tricks/reintroducing-splunk-dashboards.html
You can also submit your idea on https://ideas.splunk.com/ from where it can be picked up by Splunk Development team based on number of votes each idea gets.
Navigation is Apps & Add Ons> Supported Apps > Dashboard (Beta)
PS: The expected behavior of Table with Vertical Scroll is possible in Simple XML Dashboard with CSS Extension if you are interested: Refer to the answer by @vnravikumar https://answers.splunk.com/answers/581682/fix-table-header-and-add-vertical-scrollbar-using-1.html
... View more
05-08-2020
08:52 AM
@krunoslav if your intent is to play around with Vue.js or ReactUI framework, you should be trying your hands on the new dashboard framework (Most of it is Cloud native though). Only Splunk Dashboard Beta is available with Enterprise but does not allow extensions.)
https://www.splunk.com/en_us/blog/tips-and-tricks/reintroducing-splunk-dashboards.html
... View more
05-07-2020
08:49 AM
@aldrichb Seems like the value of host will be All by default and this is your change event handler so you should try this "$value$" :
<change>
<eval token="host">if("$value$" == "All", "xx$env$01xx-$service$*", $value$)</eval>
</change>
Refer to Splunk Documentation for accessing default input tokens in the input's <change> event handler: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Predefined_tokens_for_accessing_labels_and_values_of_form_inputs
... View more
05-07-2020
12:53 AM
@jasonmadesomething tell the purpose of your SPL, why you need two searches? Are you querying different data set (like index/sourcetype) or different timeline? Seems like you dont need subsearch at all.
... View more
05-07-2020
12:05 AM
@aldrichb will you be able to share host dropdown code? Do you set the label as All or even the value is All ? Most of the time for Dropdown label All the value is actually * . You can also print the $host$ token value in any of the panel to ensure the value is getting set as expected.
If you want your logic to be based on dropdown label All and not the dropdown value which may be different, you can try the following:
<change>
<set token="tokHost">$label$</set>
</change>
The use token $tokHost$ in your dashboard instead of $host$ .
PS: If the Label and Value for host for values other than All changes then above approach might not work, for which you may need to provide your host dropdown code and some dummy sample values/labels if it is created dynamically through SPL.
... View more
05-06-2020
11:51 PM
@ssuzano if the dots . define the end of line for Notification column, you can try the following to make Notification field a multivalue field so that each line takes a new line.
| eval Notification=split(replace(Notification,"\.",".|"),"|")
... View more
05-06-2020
09:42 AM
@Shashank_87, what do you mean by 2 row and 1 row? As per the stats command creates row using the split by field which in my code is referer. If you need one row your by clause should have that field instead.
Is the field requested_content is the page that you are referring to in your question? Which field represents asset ? Can you add some sample data and more details for the community to assist you better?
... View more
05-06-2020
08:26 AM
Thanks for that hard work. Had missed out the more recent changes! 🙂
... View more
05-06-2020
08:22 AM
@Shashank_87, have you tried the following?
<yourCurrentSearch>
| stats sum(size) as "Total Size" by referer
... View more
05-06-2020
08:15 AM
@aaloisi please accept the answer if your issue is resolved!
... View more
05-06-2020
05:47 AM
I dont think @gilmanc that Network Diagram Viz writes name for the path/connector.
... View more
05-06-2020
02:01 AM
@punithjigali how about
1. Graphviz: https://splunkbase.splunk.com/app/4346/
2. Flow Map Viz: https://splunkbase.splunk.com/app/4657
... View more
