Seems like you are running into known issue with 6.6+ where TableView needs slight delay in rendering. So setTimeout needs to be added. Refer to one of previous answers: https://answers.splunk.com/answers/614788/splunk-dashboard-examples-table-row-highlighting-b.html ... View more

@greggz if the workaround resolved your issue please accept to mark this question as answered. ... View more

try <yourCurrentSearch> | eval Time=strftime(_time,"%F %T") | fields - _time ... View more

Hey Series Compare shows value on right side next to the Legend names. Refer to one of my older answer with CSS overridd to make series compare value more prominent. https://answers.splunk.com/answers/710781/how-do-you-deal-with-visualization-disparities-in.html ... View more

I forgot about where clause. Getting old! ... View more

I don't get it. If you keep the height fixed, axis labels will not be visible. Also with fixed height what do you expect to scroll? In the above solution the height of chart is increased so that there is enough width to display axis labels. However panel width is never changed so that you can scroll to see complete chart. You always have result count based dynamic approach. In case your concern is too many condition blocks, you can always handle the height with JS extension depending on result count. If you are looking for something else possibly a mock up will help. If not better look for a different representation. Bar chart with 1000 data point in 220px height does not make sense to me and neither does the concept of scroll bar if bar chart height is also fixed. ... View more

@pgadhari also wanted you to check out one of other answers with a Table Tile based approach which is purely Simple XML with CSS override and does not require JS Extension if that is your requirement: https://answers.splunk.com/answers/529004/is-there-a-way-to-display-more-than-20-charts-at-a.html#answer-816673 ... View more

@to4kawa thanks I know something new now 🙂 By the way good question with great answers! By the way Splunk takes Unicode Character directly, however, Splunk Answers does not print it. So limitation is only while posting code here. With printf() approach it will work at both the places which is good to know! ... View more

@ksarpol @DalJeanis @woodcock @pgadhari @to4kawa @rob_jordan @rich7177 @efavreau If more than 20 trellis viz is required for Single Value or Status Indicator kind of viz (i.e. Icon, color, text kind of viz) and not for Column, Bar or any other chart following Table based hack can be used instead which is based on one of my recent answers: https://answers.splunk.com/answers/809414/issue-with-css-html-js-formatting-search-output.html?childToView=809434#answer-809434 Following are the steps used to create Table results as Tile with Color, Icon and Value: Step 1: Create a Table with required data like in the example host, cpu and threshold for color ( can also be used for dynamic icon refer to above answer). Step 2: Create multi-value field for label (field to be displayed need to be added. Even for color format) Step 3: Fields required for drilldown only can be hidden using underscore prefix. Step 4: Apply CSS Override to convert Table layout to responsive Tile (i.e. tiles should overflow to next row based on browser width). Step 5: Apply dynamic CSS size override based on Tile size selection i.e. Small, Regular or Large (more can be added or only static one can be used as per use case) Step 6. Since Table value is Multi-Valued field, CSS override can be added based on index. For example index 0 is the threshold, which needs to be used for Tile color but not to be displayed. Also Tile Icon needs to be of larger size compared to Tile Label. Step 7: Apply Table Cell color based on colorPalette expression . Step 8: Create drilldown. Example uses required hidden fields but drilldown can use more dynamic default tokens like $click.value$ and $click.value2$ . Refer to above answer for examples/discussion. Once we create Table with Tiles, Icon and Color, we can obviously also set the number of rows (tiles) to be displayed in the table (for example some max value like 50, 100, 500 etc ). I have used Text box to generate 25 Tiles by default which also sets no of rows to 25 (default example) . <option name="count">$tokHosts$</option> Following is the Simple XML Code, please try out and confirm. PS: Since Unicode Icons can not be attached to Splunk Answers, you would need to manually need to replace &lt;ICON&gt; in the Splunk search with required unicode like Desktop in this example. from https://emojipedia.org/desktop-computer/ <form> <label>Table with Unicode Character and Drilldown</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="link" token="tokTileSize" searchWhenChanged="true"> <label>Tile Size</label> <choice value="small">Small</choice> <choice value="regular">Regular</choice> <choice value="large">Large</choice> <default>regular</default> <change> <condition value="small"> <set token="tokIconTopPadding">initial</set> <set token="tokLabelTopPadding">initial</set> <set token="tokIconFontSize">initial</set> <set token="tokLabelFontSize">initial</set> <set token="tokTileWidth">120px</set> </condition> <condition value="regular"> <set token="tokIconTopPadding">40px</set> <set token="tokLabelTopPadding">25px</set> <set token="tokIconFontSize">600%</set> <set token="tokLabelFontSize">200%</set> <set token="tokTileWidth">180px</set> </condition> <condition value="large"> <set token="tokIconTopPadding">60px</set> <set token="tokLabelTopPadding">35px</set> <set token="tokIconFontSize">800%</set> <set token="tokLabelFontSize">300%</set> <set token="tokTileWidth">240px</set> </condition> </change> </input> <input type="text" token="tokHosts" searchWhenChanged="true"> <label>No. of Hosts (TESTING)</label> <default>25</default> </input> <html> <style> #table_tile table tbody{ display:flex; flex-wrap: wrap; } #table_tile table th{ display: none !important; } #table_tile table tbody tr{ margin-right:10px; margin-bottom:10px; } #table_tile table tbody tr td{ width: $tokTileWidth$; text-align: center; background: #fff; } #table_tile table tbody tr td div[data-mv-index="0"].multivalue-subcell{ display:none; } #table_tile table tbody tr td div[data-mv-index="1"].multivalue-subcell{ padding-top: $tokIconTopPadding$; font-size: $tokIconFontSize$; } #table_tile table tbody tr td div[data-mv-index="2"].multivalue-subcell{ padding-top: $tokIconTopPadding$; font-size: $tokLabelTopPadding$; } </style> </html> <table id="table_tile"> <search> <query>| makeresults count=$tokHosts$ | fields - _time | streamstats count as sno | eval host="host".sno | fields - sno | eval cpu=substr(tostring(random()),1,2) | eval _cpu_kpi_threshold=case(cpu>=0 AND cpu<40,"normal", cpu>=40 AND cpu<80,"medium", cpu>=80 AND cpu<90,"high", true(),"critical" ) | eval _cpu=cpu | eval server=_cpu_kpi_threshold."|"."<ICON>️️" ."|".host | makemv server delim="|" | eval _host=host | fields - host cpu</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">$tokHosts$</option> <option name="refresh.display">progressbar</option> <format type="color" field="server"> <colorPalette type="expression">if (match(value,"critical"), "#DC4E41", if(match(value,"high"),"#F1813F", if(match(value,"medium"),"#F8BE34","#B6C75A")))</colorPalette> </format> <drilldown> <set token="tokServer">$row._host$</set> <set token="tokCPU">$row._cpu$</set> <set token="tokCPUThreshold">$row._cpu_kpi_threshold$</set> </drilldown> </table> </panel> </row> <row> <panel> <title>Replace <ICON> in the Simple XML with Unicode Desktop character from https://emojipedia.org/desktop-computer/</title>; <html> <div>Selected Server: $tokServer$</div> <div>Server CPU: $tokCPU$</div> <div>Server CPU KPI Threshold: $tokCPUThreshold$</div> </html> </panel> </row> </form> PS: Also attaching the snippet of Simple XML search SPL where Unicode character needs to be replaced in the above code as Splunk Answers does not allow unicode character. ... View more

@Sukisen1981 try the following where sort by - AVG_DURATION is used to find top APPIDs using streamstats and filter results based on top 3: <yourCurrentSearch> | fields _time APPID DURATION | eventstats avg(DURATION) as AVG_DURATION by APPID | sort - AVG_DURATION | streamstats dc(AVG_DURATION) as RANK_BY_AVG | search RANK_BY_AVG IN (1,2,3) | timechart avg(DURATION) as AVG_DURATION by APPID Following is a run anywhere search based on the sample data provided ( cont=f added to timechart for example perspective ) : | makeresults | eval delta=300 | accum delta | eval _time=_time-delta | fields - delta | eval data="appid1,10;appid2,20;appid3,30;appid1,40;appid1,50;appid4,60;appid2,70;appid4,80;appid3,90;appid2,100" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval APPID=mvindex(data,0), DURATION=mvindex(data,1) | fields _time APPID DURATION | eventstats avg(DURATION) as AVG_DURATION by APPID | sort - AVG_DURATION | streamstats dc(AVG_DURATION) as RANK_BY_AVG | search RANK_BY_AVG IN (1,2,3) | timechart avg(DURATION) as AVG_DURATION by APPID cont=f Please try out and confirm! ... View more

@lycollicott when you trid this did it work or not? I've even tried disabling then re-enabling the embedding of the source report then using the fresh iframe code over on my SHC dashboard. Also, I never had to do any of the embedSecret or allowEmbedTokenAuth changes I see other people referring to. which post or answer are you referring to? Have you checked in server.conf or btool what are the settings for embedSecret and allowEmbedTokenAuth options in 8.x did the later change to false by any chance? https://docs.splunk.com/Documentation/Splunk/latest/Report/Optionalconfigurationforembeddedreports I would think you should reach out to Splunk Support if any embedding feature is not working as documented/expected. ... View more

@pgadhari were you able to try the above solution? ... View more

@sarvesh_11 like mentioned above, best approach for you would need to handle click event already present in visualization.js to assign to your custom tokens like clickedValue and clickedLabel so that they always get assigned without coding for each and every donut/slice. The above is just workaround example for you to handle drilldown. If you notice, the DOM selector for drilldown in Donut slice is the label of slice which is clicked for example if CRITICAL slice is clicked then the DOM selector target name is the following: c3-target-CRITICAL . So instead of having specific CSS Selector you can have generic CSS Selector and extract the label name from selector i.e. CRITICAL. The value can always be generically assigned to Value token. This way you can have single JS for for all Donut drilldown. Also you can perform click handler for array of Donut Chart by Ids like [#donut1, #donut2...] or else take out ID based selector completely. However this will depend on your dashboard use case. Ideally first approach is the best. Although visualization.js has already been created for donut chart along with click handler (it currently only logs to console, does not pass back to Splunk Token Model), you can refer to Custom Visualization API for better understanding of how it works. https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomVizTutorial Please try out and confirm as this is the maximum help/hint I can provide rather than writing the code for you! ... View more

@uveys please accept/upvote the answer if it helped! ... View more

When any donut Slice is clicked, it set the slice name as tokLabel and value as tokValue . It is very much specific to series name for example the series NORMAL will have jQUery selector #my_donut g.c3-chart-arc.c3-target-NORMAL . Nothing seem to be working is difficult to solve please add more details on what you have tried and what is the issue you see. Are you comfortable with JS? Can you debug JS code for issue? The above code is run anywhere example so it should work if you put JS in the right place (it may require debug/refresh/restart Splunk instance and also clear browser history). ... View more

I am thinking Image Overlay with token range based token values should still do the trick. Something on the lines of https://wiki.splunk.com/User_talk:Niketnilay#Topic_1:_Image_Overlay_with_Icons_Example:_Extends_Image_Ovelay_with_Single_Values_example_from_Splunk_6.x_Dashboard_Examples_Splunk_App May I know what determines the height of each heatmap overlay in the above image? For example white section is longer rectangle and brown section is smaller square? ... View more

@cheriemilk were you able to try and confirm the above solution? ... View more

@danielransell I think you referred to the following Splunk blog: https://www.splunk.com/en_us/blog/tips-and-tricks/dashboard-digest-series-episode-4.html However, I am still not clear on exactly what is your requirement. As per the blog you can use the Shapester app for drawing required polygon in you want heatmap overlaid on field. If you want heatmap within table that is also possible through Table Cell Formatting and Coloring option. Please let me know which option are you interested in. A hand drawn sketch of final output is also fine. Also, would like you to check out Splunk Dashboard App (Beta) for you to try out your use case: https://splunkbase.splunk.com/app/4710/ Or Heat Map viz app from Splunkbase: https://splunkbase.splunk.com/app/4460/ ... View more

@purushot1234 use the Splunk Add On Builder app from Splunkbase to create data input to Splunk using REST or Scripted input. Check out documentation on Splunk Add On Builder app. ... View more

@pgoldweic I think it may not work for Scheduled dashboard as it has custom CSS and token. You can try once with Smart PDF Exporter for Splunk app, but I have personally not tried that. ... View more

@danielransell would you be able to provide a mock screenshot or whiteboard image of what you need as output? ... View more

@HattrickNZ I have posted an answer to @somesoni2 's question posted above. https://answers.splunk.com/answers/116018/splunk-6-simple-xml-dataoverlaymode-on-table-can-we-specify-which-column-to-show-heatmap-on.html?childToView=815297#answer-815297 Please refer to one of my older answer on similar lines which also explains both approaches: https://answers.splunk.com/answers/686288/how-do-you-highlight-a-table-cell-based-on-a-field.html Do upvote the other answers if you find them useful! ... View more