Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
05-05-2020
08:33 AM
2 Karma
@vinothn, showing too much of information with scroll bar may not be the right approach. You may want to try combination of these approaches based on my previous answers:
1. Hide/Show Series Labels which is/are required (provided there are fixed no. of series and sequence: https://answers.splunk.com/answers/759277/how-to-create-static-baseline-on-chart-without-sho.html
2. Rotate Data Labels Vertically: https://answers.splunk.com/answers/662786/can-we-turn-on-the-data-values-in-order-to-see-the-1.html
3. Reconsider your Dashboard requirements , like use of Y-Axis Log Scale to separate data points based on variances or show only enough information with Labels that users can consume, otherwise dynamic Tooltips are better for specifics. May be other approach.
Having said above, try the following CSS Style override where chart id is manager_chart . The CSS Style override doubles the width of the chart 200% and adds x-axis scroll bar.
#manager_chart div.viz-panel{
width: 200% !important;
}
#manager_chart div.facets-container{
overflow-x:scroll !important;
overflow-y:hidden !important;
}
Following is a run anywhere example for screenshot attached:
<dashboard>
<label>Chart with Horizontal Scroll</label>
<row>
<panel>
<html>
<style>
#manager_chart div.viz-panel{
width: 200% !important;
}
#manager_chart div.facets-container{
overflow-x:scroll !important;
overflow-y:hidden !important;
}
</style>
</html>
<chart id="manager_chart">
<title>Column Chart with Vertical Scroll</title>
<search>
<query>index=_internal sourcetype=splunkd
| timechart count by component where max in top5 useother=f</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">log</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</dashboard>
... View more
05-05-2020
08:06 AM
@Inayath_khan I have converted my comment to answer. Please accept if your issue has been resolved!
... View more
05-05-2020
05:57 AM
@mark8awar following could be some of your options:
Option 1. Use Splunk JS Extension to assign arrays as token include the JS file your dashboards and then use the tokens in your Dashboard to set chart configurations.
Option 2. Push the JS code for above mentioned approach, to dashboard.js , so that every dashboards in your app will already have the JS file included by default and you just need to use the token to set the Chart configurations as per your needs.
Option 3. Create a pre-built Panel with an independent search to set the token/s as per your need. Include the pre-built panel to your dashboards so that tokens can be used for Chart configuration.
Option 4. Add an init section in each dashboard to set the required arrays as tokens to be used in your dashboards.
Option 1, requires a new JS file to be created and included in all your dadhboards.
Option 2, does not need dashboard.js to be explicitly included all your dashboard, but you must ensure that your code does not break or lead to performance issues in your existing app (all other dashboards).
Option 3, does not require JS approach however, you must ensure prebuilt-panel is hidden as it does not have any UI component. It is just used to set initialization tokens, through one point of configuration.
Option 4. will require init section to be manually created/updated/deleted for each dashboard in case your threshold changes.
Please weigh in your option and you should be able to find all 4 approach in Splunk Docs and Splunk Answers.
... View more
05-05-2020
05:42 AM
@812456 while posting code on Splunk Answers use the Code button ( 101010 ), or shortcut Ctrl+K to ensure that special characters do not escape.
I think the better approach for you would be to use the Table Search Manager to get the list of fields you want to iterate and pass to the Cell Render extension as a string array. Refer to one of my older answers, see if it fits your needs: https://answers.splunk.com/answers/618930/how-can-i-get-the-table-cell-colorization-renderin-1.html
... View more
05-04-2020
10:36 PM
@renjujacob88 it is actually http://<splunkURLPort>/en-US/debug/refresh . For Development or Non-prod instances, _bump , debug refresh or Development mode settings are recommended.
Following is the URL to turn on Development Mode settings with no caching: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomVizTutorial#Development_mode_settings
... View more
04-30-2020
07:40 PM
@paulerlong one of the ways would be to use Horizon Chart Custom Visualization
Within Splunk Dashboard you can try out the JS based approach proposed by @rjthibod https://answers.splunk.com/answers/568487/dynamic-syncing-of-timechart-zoom-and-time-picker.html
Based on your use case try out the approaches and confirm!
... View more
04-30-2020
06:29 AM
Just to document a different approach using Simple XML with CSS Extension to create Tab in Splunk Dashboard without the need of JS Extension : https://answers.splunk.com/answers/819869/how-can-we-create-tabs-using-link-list-in-splunk-w.html?childToView=819873#answer-819873
... View more
04-30-2020
06:11 AM
16 Karma
Following is a run anywhere example based on Splunk's _internal index.
Step 1. Create a panel with Link Input as per the requirement of tabs. In above example Sourcetype, Component, Log Level are three tabs.
Step 2. Set the required token from Link input in SPL or through <change> event handler of the Link Input to change SPL or hide/show panel using depends respectively. For simplicity, this example changes underlying SPL, there are several examples of depends/rejects on Splunk Docs, Blogs and Splunk Answers.
Step 3. Add <html> panel with horizontal line <hr> to mark border of Link input.
Step 4. Apply CSS override (can be through dashboard <style> section for testing/simplicity or prebuilt-panel, or static CSS file)
PS: CSS applied as per 7.1.x + and may also need some tweaking for Dark Theme vs Light Theme (white Border is used in the Dark Theme example).
Following is the run anywhere dashboard example using Simple XML and CSS (NO JS REQUIRED) . Please try out and let me know any feedback 🙂
<form theme="dark">
<label>Tabs using Links</label>
<!-- Base Search to Pull Error Data -->
<search id="bAllErrorData">
<query>index=_internal
| bin _time span=1h
| stats count by _time sourcetype component date_hour log_level
</query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
</search>
<fieldset submitButton="false">
<input id="input_time" type="time" token="tokTime">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel id="panel_layout">
<input id="input_link_split_by" type="link" token="tokSplit" searchWhenChanged="true">
<label></label>
<choice value="sourcetype">Sourcetype</choice>
<choice value="component">Component</choice>
<choice value="log_level">Log Level</choice>
<default>log_level</default>
</input>
<html>
<style>
/* This Layout Panel Bottom Padding removed to merge Link Input with horizontal line */
#panel_layout .fieldset{
padding: 10px 12px 0px 12px !important;
}
/* Increase width of Link input to have options in Single Line */
#input_link_split_by.input-link{
width: 720px !important;
}
/* Change from flex to -webkit-box for side by side layout */
#input_radio_split_by.input-link div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{
display: -webkit-box !important;
}
/* Create Button Border to make them appear as Tabs */
#input_link_split_by.input-link button{
width: 120px !important;
border-top-color: rgb(255, 255, 255);
border-top-style: solid;
border-top-width: 1px;
border-right-color: rgb(255, 255, 255);
border-right-style: solid;
border-right-width: 1px;
border-left-color: rgb(255, 255, 255);
border-left-style: solid;
border-left-width: 1px;
border-top-left-radius: 10px;
border-top-right-radius: 10px;
}
/* Hide link input bottom message section to merge with Horizontal line */
.dashboard-panel #input_link_split_by label,
#input_link_split_by .splunk-choice-input-message{
display: none !important;
}
/* Remove padding from horizontal line */
#panel_layout .panel-body.html{
padding: 0px !important;
}
</style>
<hr style="height:1px;border-width:0;color: black;background-color: white;margin: 0px;"/>
</html>
</panel>
</row>
<row>
<panel id="panel_single_snapshot">
<html depends="$alwaysHideCSSOverrideForDashboard$">
<style>
#panel_chart_line_error_trend{
width: 70% !important;
}
#panel_chart_pie_error_split{
width: 30% !important;
}
/* Font Size Color Adjustment for Series Compare in Chart Legend */
div#chart_line_error_trending svg g.highcharts-legend g.highcharts-legend-item text tspan:nth-child(2){
font-size: 120% !important;
fill: cyan !important;
font-weight: bold !important;
}
/* Trellis Layout CSS */
#single_snapshot #facet-viz_groupby_field_log_level_groupby_value_INFO rect{
fill: #006D9C !important;
}
#single_snapshot #facet-viz_groupby_field_log_level_groupby_value_WARN rect{
fill: #F8BE34 !important;
}
#single_snapshot #facet-viz_groupby_field_log_level_groupby_value_WARNING rect{
fill: #F8BE34 !important;
}
#single_snapshot #facet-viz_groupby_field_log_level_groupby_value_ERROR rect{
fill: #DC4E41 !important;
}
</style>
</html>
<single id="single_snapshot">
<search base="bAllErrorData">
<query>
| stats count by $tokSplit|s$</query>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="height">275</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="trellis.enabled">1</option>
<option name="trellis.size">small</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
<row>
<panel id="panel_chart_line_error_trend">
<chart id="chart_line_error_trending">
<search base="bAllErrorData">
<query>
| timechart count by $tokSplit|s$</query>
</search>
<option name="charting.fieldColors">{"INFO":"#006D9C","WARN":"#F8BE34","WARNING":"#F8BE34","ERROR":"#DC4E41"}</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">area</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">zero</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">seriesCompare</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
<panel id="panel_chart_pie_error_split">
<chart id="chart_pie_errors">
<search base="bAllErrorData">
<query>
| stats count by $tokSplit|s$</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">zero</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{"INFO":"#006D9C","WARN":"#F8BE34","WARNING":"#F8BE34","ERROR":"#DC4E41"}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">seriesCompare</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</form>
... View more
04-30-2020
05:48 AM
6 Karma
The Splunk Dev Blog by Luke Murphy provides details on Making a dashboard with tabs (and searches that run when clicked). It uses Simple XML CSS and JS extensions to create Tabs in Splunk Dashboard through Splunk Dashboard Tabs Example code shared on Github.
This question is more to document a different approach with the use of Splunk Link List input with CSS Override and Link List change event handler to make it appear and function like a Tab in Splunk. This does so without using JS 🙂
You can have many Link Lists within same Dashboard which implies many tabs within same Dashboard as per your need and implementation. Hope you find this useful 🙂
... View more
04-29-2020
03:01 AM
1 Karma
@hrs2019 I have converted my comment to answer. If your issue is resolved please accept/up vote 🙂
... View more
04-28-2020
11:47 PM
2 Karma
@hrs2019 , it should look like the following instead of two separate <panel> sections.
<panel id="myTableStyle" depends="setid">
In your example seems like you need only one token dependency which as per your question should have been two. Nevertheless if you have multiple token dependency you can always add them as comma separated tokens. For example:
<panel id="myTableStyle" depends="token1,token2">
Please try out and confirm. If you have any other issue please add more details.
... View more
04-27-2020
06:48 AM
1 Karma
For changing table header color try the following answer of mine. This answer also shows use of Browser Inspector for CSS Style Override. You can check out existing DOM path and corresponding bootstrap css that you need to override.: https://answers.splunk.com/answers/593399/column-headers-color.html
Do install Splunk Dashboard Examples app from Splunkbase and check out Custom Layout Dark example with dark.css which lists a lot of CSS Style Selectors for various Splunk Elements including table.
For Splunk Style Guide including table , change your Splunk URL to the following location and check out which classes can be used for Bootstrap to work:
http://<yourSplunkServer>:8000/en-US/static/docs/style/style-guide.html#tables
For your specific query, add the following to your existing dashboard with table to test Table Header Color and Alternate row color CSS (PS: Table Cell color formatting will stop working because of this static CSS Style override):
<html depends="$alwaysHideCSSStyle$">
<style>
.table th {
background-image: linear-gradient(to bottom, #006297, #006297) !important;
text-shadow: none !important;
}
.table th a{
color: white !important;
}
table tr.odd td{
background: #7ED2FF !important;
}
table tr.even td{
background: #007ABD !important;
}
table tr td{
color: #fff !important;
}
</style>
</html>
Idea is to quickly test in Dashboard and once finalized move to actual CSS file.
Please try out and confirm!
... View more
04-27-2020
05:41 AM
Hyphen is for CSS when Space is used in actual slice. With your existing code that you have provided above CSS can be applied directly.
CSS Styles just styles the dashboard it's code will not be visible in the dashboard. Did you try to inspect existing slice in your donut and check the selected path name? When you have space in the slice name it will have hyphen in the selector as selector can not accept space or special character.
... View more
04-27-2020
01:02 AM
1 Karma
@sarvesh_11 you would need to convert space and special characters to hyphen. Refer the the following example for critical. Ideally you should use Browser Inspector to identify the correct path to apply CSS override. Refer to the following blog to understand all about Simple XML CSS extension: https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-clara-fication-customizing-simplexml-dashboards-with-inline-css.html
Following is incorrect CSS Selector
#toklabel g.c3-shapes.c3-shapes-"Critical | Hosts conut with >10 For Today" path.c3-shape.c3-arc-"Critical | Hosts conut with >10 For Today"{
fill:red !important;
}
Which Should actually be:
#toklabel g.c3-shapes.c3-shapes-Critical---Hosts-conut-with--10-For-Today path.c3-shape.c3-arc-Critical---Hosts-conut-with--10-For-Today{
fill:red !important;
}
Please try out and confirm!
... View more
04-27-2020
12:18 AM
@PowerPacked this is a very old question from 2016 to bump, however you should be able to apply table row coloring based on String values as well. Following is an olde answer of mine: https://answers.splunk.com/answers/581747/change-row-color-when-the-field-time-value-increas.html
or https://answers.splunk.com/answers/583047/can-i-color-a-cell-based-on-condition.html
You would need to ensure to add a setTimeout() function if you are running Splunk 6.6 or higher . Refer to another answer: https://answers.splunk.com/answers/614788/splunk-dashboard-examples-table-row-highlighting-b.html
Finally also wanted to show you purely SimpleXML based approach for table row coloring based on expression colorPalette format.: https://answers.splunk.com/answers/820403/how-to-change-font-color-based-on-a-condition-for.html
Please upvote the respective answer/s if you find them helpful 🙂
... View more
04-26-2020
10:25 PM
What was not working? Did you place JS file in the right location? Did you bump, refresh or restart Splunk (depending on environmental where you are trying)? Did you enable console logs in JS file to see whether you are getting any errors. Try manually setting/unsetting the token through dashboard code and see whether tooltip appears and hides as expected or not.
... View more
04-26-2020
09:44 PM
@hrs2019 refer to one of my older answers: https://answers.splunk.com/answers/236389/adding-tooltip-to-panel-on-a-hover.html , will require Simple XML JS extension to handle panel hover event and setting/unsetting tokens based on the same!
... View more
04-26-2020
09:28 PM
@yaozelin refer to one of my older answers to add HTML Date input in the Dashboard which required Simple XML JS Extension to handle HTML Date input selection and change: https://answers.splunk.com/answers/627432/jquery-datepicker-in-splunk.html
... View more
04-26-2020
12:04 AM
1 Karma
@Inayath_khan correct answer to your question depends on what is your use case. If you want your input to show values as Q1, Q2... Current year Q3 and Q4 have not come. So ideally
(1) Either You should either Show, Current Quarter and Previous Quarter etc kind of information which keep on rolling as per current quarter.
(2) Or have first selection of year and then display the quarters which are valid as per current year quarters.
Also once you select a quarter do you want to pass on EPOCH time as earliest and latest filter or Quarter name directly to your SPL. This will depend on your data (EPOCH time should always work provided _time extraction is correct in your data).
Following the SPL that you can try for
1) Option 1:
| makeresults
| fields - _time
| eval Label="Current Quarter", TimeEarliest=relative_time(now(),"@q-1q"),TimeLatest=relative_time(now(),"@q")
| append
[| makeresults
| fields - _time
| eval Label="1 Quarter Ago",TimeEarliest=relative_time(now(),"@q-2q"),TimeLatest=relative_time(now(),"@q-1q")
]
| append
[| makeresults
| fields - _time
| eval Label="2 Quarter Ago",TimeEarliest=relative_time(now(),"@q-3q"),TimeLatest=relative_time(now(),"@q-2q")
]
| append
[| makeresults
| fields - _time
| eval Label="3 Quarter Ago",TimeEarliest=relative_time(now(),"@q-4q"),TimeLatest=relative_time(now(),"@q-3q")
]
and Option 2)
| makeresults
| fields - _time
| eval Label="Q1 (prev year)", TimeEarliest=relative_time(now(),"-1y@y+0q"),TimeLatest=relative_time(now(),"-1y@y+1q-1s")
| append
[| makeresults
| fields - _time
| eval Label="Q2 (prev year)",TimeEarliest=relative_time(now(),"-1y@y+1q"),TimeLatest=relative_time(now(),"-1y@y+2q-1s")
]
| append
[| makeresults
| fields - _time
| eval Label="Q3 (prev year)",TimeEarliest=relative_time(now(),"-1y@y+2q"),TimeLatest=relative_time(now(),"-1y@y+3q-1s")
]
| append
[| makeresults
| fields - _time
| eval Label="Q4 (prev year)",TimeEarliest=relative_time(now(),"-1y@y+3q"),TimeLatest=relative_time(now(),"-1y@y+4q-1s")
]
... View more
04-25-2020
12:52 PM
@rarangarajansplunk you can try table row highlighting example from Splunk Dashboard Examples app : https://splunkbase.splunk.com/app/1603/
However from Splunk 6.6+ version you need setTimeout inside render() function. Refer to one of my older answers for the same.
https://answers.splunk.com/answers/614788/splunk-dashboard-examples-table-row-highlighting-b.html
... View more
04-25-2020
09:56 AM
Yes seems like case works in Splunk 8.x . Not sure which version onward it started working.
... View more
04-25-2020
09:55 AM
As pointed out by @jeffland seems like 8.x version supports case statement. Not sure which version onward this started working.
Following answer used case with match for applying colorPalette based on expression :
https://answers.splunk.com/answers/820403/how-to-change-font-color-based-on-a-condition-for.html
... View more
04-25-2020
09:51 AM
Documenting another answer for the Pure Simple XML based Table Cell coloring based another cell with delimited value (NO JS Required) . Refer to the following answer for approach of converting delimited field into multi-value field and then color based on second index value and finally hiding the second div of multi-value which is used only for applying color and not for display.
Refer to the answer for details: https://answers.splunk.com/answers/820403/how-to-change-font-color-based-on-a-condition-for.html
... View more
04-25-2020
09:38 AM
4 Karma
@rarangarajansplunk this row color, that too text not background, wont be possible without JS.
Your only alternative to color text for entire row (not background) depending on particular cell without JS would be to convert to html dashboard but that will have loads of downsides as you can not take advantage of SimpleXML and several features of Simple XML dashboards will stop working. HTML dashboard allows JS to be included in the dashboard code but entire dashboard converts to SplunkJS and you would need to code JS afterwards.
If you are ok to do ** Table Row color by a particular Cell value using pure SimpleXML- NO JS Required ** you can try the following example where you will have to write <format> option for each of the 50 fields (can only be avoided by JS). Following is the approach:
Suffix the cell value which needs to deicide coloring to each of the other fields which need to be colored along with a delimiter. For example | eval field1=field1."|".log_level . I have used foreach command to do this for all fields including log_level.
Using split() eval function split the table cell values into two rows based on delimiter. In the example pipe symbol is the delimiter: |
Use colorPalette with expression in the table format option for each of the 50 fields you have. I have only few fields in the example. Expression allows you to kind of perform eval on table cell values for color formatting.
Use Simple XML CSS extension, that can also be applied using hidden <html> panel with <style> tag, to hide the multivalued field created for cell color using split() function on delimited log_level value.
Following is the Simple XML code with run anywhere example based on Splunk's _internal index where log_level field has three values i.e. INFO, ERROR, WARN
<dashboard>
<label>Table with Simple XML color</label>
<row>
<panel>
<title>Only SimpleXML no JS required</title>
<html>
<style>
#tableRowColorWithoutJS table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table id="tableRowColorWithoutJS">
<title>Color Row by log_level: ERROR INFO and WARN</title>
<search>
<query>index=_internal sourcetype=splunkd
| stats count last(date_hour) as date_hour last(date_minute) as date_minute last(date_second) as date_second last(component) as component by log_level
| foreach * [| eval "<<FIELD>>"='<<FIELD>>'."|".log_level]
| foreach * [| eval "<<FIELD>>"=split('<<FIELD>>',"|")]</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="date_hour">
<colorPalette type="expression">case (match(value,"ERROR"), "#DC4E41",match(value,"WARN"), "#F8BE34",match(value,"INFO"),"#53A051",true(),"#C3CBD4")</colorPalette>
</format>
<format type="color" field="date_minute">
<colorPalette type="expression">case (match(value,"ERROR"), "#DC4E41",match(value,"WARN"), "#F8BE34",match(value,"INFO"),"#53A051",true(),"#C3CBD4")</colorPalette>
</format>
<format type="color" field="date_second">
<colorPalette type="expression">case (match(value,"ERROR"), "#DC4E41",match(value,"WARN"), "#F8BE34",match(value,"INFO"),"#53A051",true(),"#C3CBD4")</colorPalette>
</format>
<format type="color" field="component">
<colorPalette type="expression">case (match(value,"ERROR"), "#DC4E41",match(value,"WARN"), "#F8BE34",match(value,"INFO"),"#53A051",true(),"#C3CBD4")</colorPalette>
</format>
<format type="color" field="log_level">
<colorPalette type="expression">case (match(value,"ERROR"), "#DC4E41",match(value,"WARN"), "#F8BE34",match(value,"INFO"),"#53A051",true(),"#C3CBD4")</colorPalette>
</format>
<format type="color" field="count">
<colorPalette type="expression">case (match(value,"ERROR"), "#DC4E41",match(value,"WARN"), "#F8BE34",match(value,"INFO"),"#53A051",true(),"#C3CBD4")</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
Please change as per your use case!
... View more
04-20-2020
01:57 PM
1 Karma
Yes indeed 🙂
... View more
