@pgadhari please upvote the other answer if worked for you. Also accept this answer if your issue is resolved! 🙂 ... View more

@kartm2020 your logic will still remain the same. Instead of assigning tokFilter to strFilterText, you will need to Use string array and iterate through it to assign to filter text loop OR Split comma separated values and iterate through filter text loop. This would be pure JavaScript code nothing related to Splunk, so if you are good with JS figure out yourself or have a JS coder look into the same. Unfortunately our intent is to give pointers to solution not to spoon-feed. Keep Splunking and Keep Learning! Please accept/upvote the answer if it helped. ... View more

@hawifaris please refer to one of my older answer to achieve this using independent search as a workaround since earliest and latest token do not work as expected: https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html There are two option based on similar approach. Please try out and confirm! ... View more

@efavreau and you did not tell me about your session 😛 So where is the recording link? ... View more

@indeed_2000 try making use of Splunk's internal fields date_mday and date_hour. Following is a run anywhere example based on Splunk's _internal index. index=_internal sourcetype=splunkd earliest=-1d@d latest=now component IN ("UIAuth","WatchedFile","Metrics","PeriodicHealthReporter","LMStackManager") | eval date_hour=printf("%02d",date_hour) | stats count by date_hour date_mday component | eval date_mday=if(date_mday!=strftime(now(),"%Y/%m/%d"),"Yesterday","Today") In your case try the following and confirm! index="myindex" | eval date_hour=printf("%02d",date_hour) | stats count by date_hour date_mday code | eval date_mday=if(date_mday!=strftime(now(),"%Y/%m/%d"),"Yesterday","Today") ... View more

@Hemant1 can you try the following? | rest /servicesNS/-/-/itoa_interface/glass_table While I have not tested, following is the documentation I referred: https://docs.splunk.com/Documentation/ITSI/latest/RESTAPI/ITSIRESTAPIreference#ITOA_Interface Enter the usercontext and appcontext in place of above two hyphens to be more specific. ... View more

@cosm0630 please provide more details on the context like sample data, output what are you seeing and what you want. Is dvc_name PAN or Pillar. What is the other field in your data? Last 8 days is for search or you want in Result as well? Please provide more details for the community to help you better. ... View more

@rarangarajansplunk what is the logic of dividing 10 columns into 2 column sets? Is it based on divide by 2 logic or based on Column name? Why each of 3 rows became 6 column in your output? What is the logic of Row 1 column between Column Set 1 and Column Set 2 ? Please provide more details and context for the community to assist you better. ... View more

@alucarddjin could you please add a little more details with example as to what you are trying to do in Splunk Dashboards? Also mock-up if possible. ... View more

@nick405060 Here is the Splunk App for Zoom (Splunk Works) and Splunk Connect for Zoom Addon (Splunk) on Splunkbase! ... View more

@leesahic please confirm whether the solution worked for you or not. ... View more

Thanks for pointing it out @nplamondon . I have corrected the default limit 🙂 ... View more

@itsmevic you were so close that I am sure you would have got it yourself after tea/coffee or may be a nap 🙂 Keep Splunking!!! ... View more

@aravindpadmin can you please confirm whether the above option worked for you? ... View more

@Nadhiyaa could you please confirm whether one of above options worked for you or not? ... View more

[UPDATE] Table Cell Renderer can be applied to all the tables present in a dashboard dynamically using the solution approach from one of my recent answer: https://answers.splunk.com/answers/815883/javascript-with-xml-coding.html?childToView=816803#answer-816803 @email2vamsi please try out and confirm! ... View more

Table Cell Renderer can be applied to all the tables present in a dashboard dynamically using the solution approach from one of my recent answer: https://answers.splunk.com/answers/815883/javascript-with-xml-coding.html?childToView=816803#answer-816803 ... View more

@robertlynch2020 refer to one of my recent answers to dynamically apply custom table renderer to all tables present in a SimpleXML Dashboard. https://answers.splunk.com/answers/815883/javascript-with-xml-coding.html?childToView=816803#answer-816803 ... View more

@kartm2020 if this is based on my previous answer: https://answers.splunk.com/answers/636948/how-to-add-css-class-to-table-field-by-input-in-sp.html, then that was created only for Single Table using specific table ID i.e. table1 . var tableView=mvc.Components.get("table1"); In case you want to apply the same logic to multiple tables, you can try the following approaches: 1. In JS keep is string array of table IDs and iterate through table IDs to access respective TableView and add your custom cell renderer. Simple but required JS change each time new table is added or removed. 2. If you want to keep the logic dynamic for all table ( ** I am documenting this approach to iterate through all tables in SimpleXML and to extended each one of them using SimpleXML JS Extension and SplunkJS dynamically ** ) a) You would need to iterate through all Splunk Elements using mvc.Components.getInstances() . Refer to older answer: https://answers.splunk.com/answers/129142/changing-multiple-tables-in-simplexml-using-splunkjs.html b) You would need to identify whether it is TableView element. If so, extend the Base Cell Renderer, when text box value is changed. c) In order to refresh the table add a dummy token dependency each time custom Cell Renderer is added. There are several examples and ways to do this. One such example for reference: https://answers.splunk.com/answers/667232/how-to-force-rerendering-tableview-from-javascript.html PS: Since the search is re-run for table re-render on changing the text box value, consider loadjob kind of option to display the results in table then refresh using token set in JS on Extending the Table Cell Render. Or else the solution will have to be purely jQuery based assuming Queries complete before Text Box value is changed. Following is the Simple XML Dashboard code: <form script="highlightToken.js"> <label>Highlight selected text in all tables</label> <init> <set token="tokRefresh">true</set> </init> <fieldset submitButton="true" autoRun="false"> <input type="time" token="field1" searchWhenChanged="false"> <label></label> <default> <earliest>-1h@h</earliest> <latest>now</latest> </default> </input> <input type="text" token="tokFilter" searchWhenChanged="false"> <label>Search Word</label> <default>splunk*</default> <initialValue>searchword</initialValue> </input> </fieldset> <row> <panel> <table id="highlightTable1"> <search id="highlightSearch1"> <query>index=_internal | stats count by sourcetype | fields - "$tokRefresh$"</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <refresh>1m</refresh> <refreshType>delay</refreshType> </search> <option name="count">5</option> <option name="drilldown">none</option> </table> </panel> <panel> <table id="highlightTable2"> <search id="highlightSearch2"> <query>index=_internal | stats count by sourcetype | head 5 | fields - "$tokRefresh$"</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <refresh>30s</refresh> <refreshType>delay</refreshType> </search> <option name="count">5</option> <option name="drilldown">none</option> </table> </panel> </row> <row> <panel> <table id="highlightTable3"> <search id="highlightSearch3"> <query>index=_internal | stats count by sourcetype | head 5 | fields - "$tokRefresh$" </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">5</option> <option name="drilldown">none</option> </table> </panel> <panel> <table id="highlightTable4"> <search id="highlightSearch4"> <query>index=_internal sourcetype="splunkd" | stats count by sourcetype | head 5 | fields - "$tokRefresh$" </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">5</option> <option name="drilldown">none</option> </table> </panel> </row> <row> <panel> <table id="highlightTable5"> <search id="highlightSearch5"> <query>index=_internal | stats count by sourcetype | head 5 | fields - "$tokRefresh$" </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> Following is the required JS file highlightToken.js to be placed under your Splunk app's appserver/static folder. require([ "underscore", "jquery", "splunkjs/mvc", "splunkjs/mvc/tableview", "splunkjs/mvc/simplexml/ready!" ], function(_, $, mvc, TableView) { var submittedTokenModel = mvc.Components.get("submitted"); var tableView; var tokRefresh = "refreshCounter1" var refreshCounter = 0; var strRefresh = "refresh1"; var strFilterText = "" var CustomHighlightRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { //Applied to message column in the Table return cell.field === "sourcetype"; }, render: function($td, cell) { var strText = cell.value; var regEx = new RegExp(strFilterText, "gi"); //Apply regular expression to replace Filter Text with html content bold font and red color strText = strText.replace(regEx, '<b style="color:red;">$&</b>'); // Add html content to table cell of string class $td.addClass('string').html(_.template(strText)); } }); // When Text box input value changes handle tokFilter submittedTokenModel.on("change:tokFilter", function(newtokFilter, tokFilter, options) { // Only if tokFilter has value apply Custom Table Render // Since token tokFilter is used in table query Table is supposed to render again if (tokFilter !== undefined || tokFilter !== "$value$") { strFilterText = tokFilter; $.each(mvc.Components.getInstances(), function(i, tableView) { if (tableView instanceof TableView) { // Register custom cell renderer, the table will re-render automatically var customRenderer = tableView.getCellRenderers(); tableView.removeCellRenderer(customRenderer); tableView.addCellRenderer(new CustomHighlightRenderer()); if (refreshCounter == 2) { refreshCounter = refreshCounter + 1; strRefresh = strRefresh + refreshCounter.toString(); } else { refreshCounter = 1; strRefresh = strRefresh + refreshCounter.toString(); } submittedTokenModel.set("tokRefresh", strRefresh); } }); } }); }); ... View more

@sarvesh_11 can you see if Sendresults App from Splunkbase solves your need: https://splunkbase.splunk.com/app/1794/ ... View more

@keldridg2 that is a very old app which is not supported. You should build your own custom visualization using Spunk Custom Visualization API: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomVizTutorial By the way what is the exact viz you want to integrate in Splunk Dashboard? Have you checked out existing Custom Visualizations? Like 3D Graph Visualization app: https://splunkbase.splunk.com/app/4611/ Flow Map viz: https://splunkbase.splunk.com/app/4657/ Force Directed Graph: https://splunkbase.splunk.com/app/3767/ Network Diagram Viz: https://splunkbase.splunk.com/app/4438/ Network Topology: https://splunkbase.splunk.com/app/3762/ JointJS Diagram - Custom Vizualisation: https://splunkbase.splunk.com/app/3379/ AfterGlow Visualization (Outside Splunkbase): https://splunkbase.splunk.com/app/277/ ... View more

Thanks! You 2! ... View more

Seems like you are running into known issue with 6.6+ where TableView needs slight delay in rendering. So setTimeout needs to be added. Refer to one of previous answers: https://answers.splunk.com/answers/614788/splunk-dashboard-examples-table-row-highlighting-b.html ... View more