Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
03-13-2020
08:08 PM
@sbhatnagar88 post your own answer for 7.3 tab focus which worked as an answer to this question and post a separate question for highlighting the selected tabs. From what I understand you need bread-crum kind of view and highlight the traversed path which is a completely different use case compared to the present one where only one tab opens at a time. It can be randomly any tab out of available tabs and the code need not maintain which previous tab was clicked. With bread-crum you can proceed in a specific sequence and traversing back removed the progress. All the above logic need to be coded. So please post a new question with your use case and necessary details so that community can help. By any chance is this App setup kind of navigation because that is already available?
... View more
03-13-2020
06:00 AM
Glad to know. Do let us know if you need further help!
... View more
03-13-2020
12:57 AM
@gjanders seems like there are multiple duplicates of this question posted on Answers. The original question (difficult to find because of several duplicates and fact that two user IDs have been used to post these question) seems to be https://answers.splunk.com/answers/809361/issues-with-tab-focus-in-post-splunk-733-upgrade.html
I had already suggested updated code by Luke Murphy. So we would need to understand what has been tried and what seems to be broken.
I have converted your answer to comment. But will reach out to Community Specialists to how to restrict duplicates and keep the correct Question going on until we find the actual issue and fix.
... View more
03-13-2020
12:54 AM
1 Karma
@sbhatnagar88 please dont post the same question everyday also do not use multiple IDs to post same question. If you want your existing post to get proper attention please use the original question and post any updates that you have.
Consider Splunk Answers Question as an email thread where you can post comments and converse with Splunk community experts. Until there is an answer posted against your question, it will still flag as unanswered and can be Featured based on views so that it gets appropriate attention.
Do understand that the assisting Splunkers in the community is purely passion for Community Experts and we all tend to spend time on Answers during leisure time or after work. Please anticipate delays in responses, but rest assured an unanswered question with correct updates and necessary details gets proper attention.
If you need urgent help I would request you to reach out to Splunk Support or Professional Service or contact the developer (do it on original question using @ mention).
https://answers.splunk.com/answers/809361/issues-with-tab-focus-in-post-splunk-733-upgrade.html
... View more
03-13-2020
12:44 AM
If your issue is resolved please accept the answer which you are using. I will also request you to upvote the answers and comments here that you found useful 🙂
... View more
03-13-2020
12:43 AM
@vinothn if you want the JS based approach I would suggest you to read jQuery Selector and jQuery Click event coding on W3Schools which should be hardly 10 min each.
If you are not well versed with JS/jQuery and want SimpleXML based approach, refer to other two answers (one with Unicode character has code as screenshot try this second after you have tried one without Unicode). The Simple XML code also displays how you can set token. $click.value$ is used to access all values in the multivalue cell as comma separated values (you can use <eval> to set token using split() and mvindex() chained eval functions).
If you are only interested in specific value clicked you can try $click.value2$ . The example has a run anywhere Simple XML code which you can copy paste and test. Please try out and confirm.
... View more
03-13-2020
12:35 AM
@genesiusj statusNum did not add any value when it was displayed as table cell. So I converted to statusClass which has meaning for Color code applied.
... View more
03-13-2020
12:34 AM
@genesiusj if you see $click.value$ screenshot attached, no matter where you click, you will get all the values. You can use eval with split() and mvindex() to get specific value you are interested in.
... View more
03-12-2020
08:12 AM
If data does not have overlap, keep null values as null and keep the chart disconnected. You should see dots and not line.
But even if chart line is connected you can use CSS Override to hide the line drawn for series.
... View more
03-12-2020
06:59 AM
2 Karma
Little bit tweak to the above code with Unicode characters and I dont need Status Indicator anymore.
Refer to one of my older answers with Unicode characters in the table: https://answers.splunk.com/answers/681268/one-rangemap-column-for-multiple-values.html
As per the previous code only unicode icons in SPL and colorPalette expression have been changed. Since Splunk Answers does not allow all Unicode characters to be posted posting screenshot of the code.
... View more
03-12-2020
05:51 AM
2 Karma
@genesiusj @vinothn
Turns out this is purely Simple XML problem (with CSS override if required ). No <html> table and JS Extension required .
I used the following approach:
Build a Splunk table with Multi-value cells (You can arrange as single Row or single column). For each Printer multiple values are Printer Name, Status, Status Type, Date and Time .
Apply color to table cell using expression color palette based on regex match for Status Type. Since case() is not available nested if() can be applied for setting more than two color ranges. Refer to answer. Refer to older answer: https://answers.splunk.com/answers/668588/how-to-add-custom-color-to-blank-cell.html
Enable table drilldown. $click.value$ gives all values in the multi-value cell clicked with each value separated by comma and $click.value2$ gives specific value in the multi-valued cell clicked.
Apply custom CSS to format Table cell look as a tile as per the requirement.
Following is the Simple XML code required.
PS: Supports drilldown and requires no JS. Also supports sorting by Printer Name by default table sorting property :)
<dashboard>
<label>Table with Color and Format</label>
<row>
<panel>
<html>
<style>
#table_tile table tbody{
display:flex;
flex-wrap: wrap;
}
#table_tile table tbody tr{
margin-right:10px;
margin-bottom:10px;
}
#table_tile table tbody tr td{
width: 180px;
text-align: center;
}
</style>
<div>
<div>Clicked Value in Cell (click.value):$click.value$</div>
<div>Clicked Cell Values (click.value2):$click.value2$</div>
</div>
</html>
<table id="table_tile">
<search>
<query>| makeresults
| eval status="printing,deleting,error;printing,error;door open,error;restarted;printed,deleting;error,offline;error,offline;spooling,paused"
| makemv status delim=";"
| mvexpand status
| eval delta=500
| streamstats count as sno
| eval printer="printer".sno
| eval delta=delta*sno
| eval _time=_time-delta
| fields - delta sno
| eval timeConvDate=strftime(_time,"%a %m-%d-%Y")
| eval timeConvTime=strftime(_time,"%H:%M:%S")
| eval statusClass=case(status="printing,deleting,error","status_fatal",status="error,toner low","status_fatal",status="printing,error","status_fatal",status="paper jam","status_fatal",status="no toner","status_fatal",status="error,offline","status_fatal",status="error","status_fatal",
status="door open,error","status_critical",status="spooling,paused","status_critical",status="paused","status_critical",status="out of paper","status_critical",status="error,out of paper","status_critical",status="offline","status_critical",status="door open","status_critical",
status="toner low","status_low",status="restarted","status_low",
status="printing,deleting","status_info",status="printed,deleting","status_info",status="printing,printed,deleting","status_info",status="error,warming up","status_info",status="spooling,printing","status_info",status="error,offline","status_info",status="spooling","status_info",status="printing","status_info",status="normal","status_info")
| sort - statusClass, status
| table printer, status, statusClass, timeConvDate, timeConvTime
| eval "Printer Info"=printer."###".status."###".statusClass."###".timeConvDate."###".timeConvTime
| fields "Printer Info"
| makemv "Printer Info" delim="###"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Printer Info">
<colorPalette type="expression">if (match(value,"status_fatal"), "#DC4E41", if(match(value,"^status_critical"),"#F8BE34", if(match(value,"status_low"),"#62B3B2","#B6C75A")))</colorPalette>
</format>
<drilldown>
<set token="click.value">$click.value$</set>
<set token="click.value2">$click.value2$</set>
</drilldown>
</table>
</panel>
</row>
</dashboard>
... View more
03-12-2020
04:20 AM
1 Karma
@vinothn since the html panels have their unique ids, you can code custom drilldown from html panel using jQuery. Refer to an older answer of mine on similar lines: https://answers.splunk.com/answers/741114/how-to-drill-down-from-custom-result-value-1.html
Please try out and confirm. Do upvote the answers and comments that helped.
... View more
03-12-2020
01:49 AM
drilldown to a tile or drilldown from tile to something else?
... View more
03-12-2020
12:48 AM
@anooshac why not CSS? Also what if Data Labels overlap? Can you whiteboard what kind of viz you are anticipating?
... View more
03-12-2020
12:36 AM
1 Karma
@liberty5 refer to Splunk Docs you can pass specific part of events which match regex
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest
For example in your case try out with this regex (may change as per your exact data):
https://regex101.com/r/yaUNdY/1
... View more
03-11-2020
06:45 PM
@premranjithj correct approach would be to name the multi select object in JS separately as mvc.Components.get() is invoked only once hence only the second multi select in your code would work.
Ideally, you should create an array of multiselect IDs like ALL_RESET , SERVER_RESET and loop through IDs to identify on change event handler for each. However, I will let you figure that out first. Meanwhile try the following code and confirm.
var multiAll = splunkjs.mvc.Components.getInstance("ALL_RESET");
multiAll.on("change", function(){
var selection = [];
// get the current selection
selection = multiAll.val();
// check if there is more than one entry and one of them is "*"
if (selection.length > 1 && ~(selection.indexOf("*"))) {
if (selection.indexOf("*") == 0) {
// "*" was first, remove it and leave rest
selection.splice(selection.indexOf("*"), 1);
multiAll.val(selection);
multiAll.render();
} else {
// "*" was added later, remove rest and leave "*"
multiAll.val("*");
multiAll.render();
}
}
});
var multiServer = splunkjs.mvc.Components.getInstance("SERVER_RESET");
multiServer.on("change", function(){
var selection = [];
// get the current selection
selection = multiServer.val();
// check if there is more than one entry and one of them is "*"
if (selection.length > 1 && ~(selection.indexOf("*"))) {
if (selection.indexOf("*") == 0) {
// "*" was first, remove it and leave rest
selection.splice(selection.indexOf("*"), 1);
multiServer.val(selection);
multiServer.render();
} else {
// "*" was added later, remove rest and leave "*"
multiServer.val("*");
multiServer.render();
}
}
});
... View more
03-11-2020
06:39 PM
1 Karma
If each of cRecords is your event you should be considering props and transforms configuration so that each cRecords section logs in as an individual event rather than multiple cRecords in one event. As you can see currently you will end up the path of multivalued field and multi-value commands which would eventually turn out to be resource consuming. If you are under the process of Data Ingestion and initial setting up of the system ensure that data is ingested correctly. For example bDate should be the timestamp (_time) of each event and each event should be a cRecords nested JSON.
... View more
03-11-2020
11:05 AM
@genesiusj I have updated my answer. Refer to screenshot and new code. Please try out and confirm. You may have to change SPL and CSS as per your needs.
... View more
03-11-2020
09:03 AM
@ricotries if we do not know the sequence, we would have to know the pattern to use Regular Expression. Please add more details with sample values (mock up any sensitive information before posting on Splunk Answers) for the community to assist you better.
... View more
03-11-2020
08:35 AM
@vinothn for the community to assist you better could you please add a screenshot or whiteboard mock up of what you need to be displayed?
Each row with different customization ... please elaborate.
What is the row value based color decision you want to take? Can you add examples?
If each row is a Tile, does that mean you want to show N no. or rows in the table? Like ... | head 5 or ...| head 10 ? This should be straight forward with a token to be passed to SPL.
Refer to one of my recent answers and see if it fits your needs: https://answers.splunk.com/answers/809414/issue-with-css-html-js-formatting-search-output.html?childToView=809434#answer-809434
... View more
03-11-2020
06:24 AM
Great to hear 🙂 Keep breaking those barriers!
... View more
03-11-2020
06:22 AM
1 Karma
Anytime. Field names prefixed with underscore was a trick I learnt from @woodcock 🙂
... View more
03-11-2020
01:02 AM
@niyaz006 you can submit an idea for Selection event to be made available in Bubble Chart similar to Line Chart. https://ideas.splunk.com/
Alternatively, you can extend the highcharts JS library using Splunk Custom Visualization API to code your own selection event. https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomVizTutorial
... View more
03-10-2020
11:22 PM
@liberty5 since the remaining part of your query seem to be fine and you are getting 0 count, you must check the spath pipe to ensure that you are getting bDate field and that the conversion to epoch time for all three are working fine. Please sample only one row and instead of filtering using the where condition just manually compare the three epoch dates.
Not sure if the following helps but try putting path in double quotes
| spath output=bDate path="cRecords{}.bDate"
Following is a run anywhere example as per your question, which generated bDate from 05/15 to 05/18 as a JSON with root node as cRecords and bDate as nested array JSON and reports the count of dates that fall between 05/16 and 05/17.
| makeresults
| eval _raw="{
\"cRecords\":[
{\"bDate\":\"05\/15\/2019\"}
]
}"
| append [| makeresults
| eval _raw="{
\"cRecords\":[
{\"bDate\":\"05\/16\/2019\"}
]
}"]
| append [| makeresults
| eval _raw="{
\"cRecords\":[
{\"bDate\":\"05\/17\/2019\"}
]
}"]
| append [| makeresults
| eval _raw="{
\"cRecords\":[
{\"bDate\":\"05\/18\/2019\"}
]
}"]
| spath path="cRecords{}.bDate" output=bDate
| eval beginDate = strptime("05/16/2019","%m/%d/%Y"),
endDate = strptime("05/17/2019","%m/%d/%Y"),
thisDate = strptime(bDate, "%m/%d/%Y")
| where thisDate >= beginDate AND thisDate <= endDate
| stats count(bDate)
If the spath is not working for you then please re-evaluate the JSON structure and correct spath.
... View more
03-10-2020
10:26 PM
@etoombs you can use an independent search to process the check box selection and prepare a dummy SPL to rename each selected field name prefixed with underscore _ . This way fields prefixed with underscore will be hidden from Table fields however, at the same time they will be available for drill-down using $row._yourHiddenFieldName$
Please try out and confirm the following run anywhere example based on Splunk's _internal index, where default hidden fields are mongod, splunkd and splunkd_ui_access.
<form>
<label>Checkbox Based Table Field Filter with Drilldown</label>
<!-- Indepedent Search to process Check Box selection and create hidden table fields using underscore prefix fieldnames-->
<!-- For Example:
"mongod" selection in checkbox results in SPL "| rename mongod as _mongod"
"mongod splunkd" selection in checkbox results in "| rename mongod as _mongod, splunkd as _splunkd"
PS: Splunk search result fields prefixed with underscore "_" are hidden from table. But can be used for drilldown using $row._fieldname$ for example $row._mongod$ or $row._splunkd$
-->
<search>
<query>
| makeresults
| fields - _time
| eval originalSelection=split("$tokSourceTypes$"," ")
| mvexpand originalSelection
| streamstats count as rowNum
| eventstats max(rowNum) as maxRowNum
| eval hiddenSelection=if(maxRowNum==rowNum," ".originalSelection." as _".originalSelection,
" ".originalSelection." as _".originalSelection. ",")
| stats list(hiddenSelection) as hiddenSelection
| nomv hiddenSelection
| eval hiddenSelection="rename ".hiddenSelection
</query>
<done>
<set token="tokSelectedFields">$result.hiddenSelection$</set>
</done>
</search>
<fieldset submitButton="false">
<input type="checkbox" token="tokSourceTypes" searchWhenChanged="true">
<label>Sourcetypes</label>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>| tstats count where index=_internal by sourcetype
| fields sourcetype</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<default>mongod,splunkd,splunkd_ui_access</default>
<delimiter> </delimiter>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| tstats count where index=_internal by sourcetype
| transpose 0 column_name="sourcetype" header_field="sourcetype"
| $tokSelectedFields$ </query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="tokMongod">$row._mongod$</set>
<set token="tokSplunkd">$row._splunkd$</set>
<set token="tokSplunkdUIAccess">$row._splunkd_ui_access$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<div>
<h2>Drilldown to see Hidden Column Values (default hidden fields are mongod, splunkd and splunkd_ui_access)</h2>
<div>mongod: $tokMongod$</div>
<div>splunkd: $tokSplunkd$</div>
<div>splunkd_ui_access: $tokSplunkdUIAccess$</div>
</div>
</html>
</panel>
</row>
</form>
... View more
