Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
03-10-2020
07:13 AM
Can you whiteboard your output? Even pen and paper output with some example is fine.
... View more
03-09-2020
10:58 PM
@genesiusj less than and greater than sign needs to be escaped in Dashboard code. On answers it resolves to the actual character hence you are not seeing & lt ; or & gt ; (purposely added space so that they do not get replaced on Answer).
Refer to w3schools link for using Espace sequence for the less than and greater than characters and replace the same in your dashboard code... https://www.w3schools.com/html/html_entities.asp
... View more
03-09-2020
11:50 AM
1 Karma
@shocko please refer to one of my older answers to apply table cell color for multi-value field: https://answers.splunk.com/answers/694420/is-it-possible-to-highlight-a-value-within-a-multi-1.html
PS: I have not tested this on 6.1 (and wont be able to test), but should work as far as single value table cell color is working for you on 6.1. Please try and confirm!
... View more
03-09-2020
11:43 AM
Can you try version 7.3.4 as I am suspecting issue with 7.3.3 (SPL-180371, SPL-175319)
https://answers.splunk.com/answers/789945/how-to-include-css-in-dashboards-with-the-latest-s.html
If not can you please try Browser Inspector to see any JavaScript Console errors?
... View more
03-09-2020
11:05 AM
3 Karma
[UPDATED ANSWER] as per mock screenshots provided. Please refer to updated screenshot and code below. You can play with CSS and SPL as per your actual needs.
PS: No changes to JS. So only SPL query , CSS <Style> and <html> panel has been changed.
1. SPL has been changed to bring data for specific printer in one cell and all the Printers in one row.
2. As per your need nested <div> sections were required for responsive table design where data is in single row but wraps to the subsequent row if width of the view is reduced. Previous example was built using <table> hence it was not responsive.
@genesiusj, is there a reason why you want table kind of view but not Splunk table?
I have converted my answer to build a table for five fields printer, status, statusNum, timeConvDate, timeConvTime as per your question. In order to pass the data from Search results to JS the token tokResultsInHTML has been set in <done> search event handler and the field name from search SPL i.e. htmlData is passed using predefined search token $result. htmlData$ .
As compared to the previous example with <div> section (where request was for single field to be displayed in four columns), I have created <table> with row <tr> and cell .
PS: CSS Style override has been changed as per table structure (each element has id # and class . added for specific customization). I have overridden few as example kindly change as needed. Central text alignment has been applied for each table cell.
Please try out and confirm!
Following is the run anywhere example Simple XML code:
<dashboard script="display_token_with_html_content.js">
<label>Table with HTML data</label>
<search>
<query>| makeresults
| eval status="printing,deleting,error;printing,error;door open,error;restarted;printed,deleting;error,offline;error,offline;spooling,paused"
| makemv status delim=";"
| mvexpand status
| eval delta=500
| streamstats count as sno
| eval printer="printer".sno
| eval delta=delta*sno
| eval _time=_time-delta
| fields - delta sno
| eval timeConvDate=strftime(_time,"%a %m-%d-%Y")
| eval timeConvTime=strftime(_time,"%H:%M:%S")
| eval statusClass=case(status="printing,deleting,error","status_fatal",status="error,toner low","status_fatal",status="printing,error","status_fatal",status="paper jam","status_fatal",status="no toner","status_fatal",status="error,offline","status_fatal",status="error","status_fatal",
status="door open,error","status_critical",status="spooling,paused","status_critical",status="paused","status_critical",status="out of paper","status_critical",status="error,out of paper","status_critical",status="offline","status_critical",status="door open","status_critical",
status="toner low","status_low",status="restarted","status_low",
status="printing,deleting","status_info",status="printed,deleting","status_info",status="printing,printed,deleting","status_info",status="error,warming up","status_info",status="spooling,printing","status_info",status="error,offline","status_info",status="spooling","status_info",status="printing","status_info",status="normal","status_info")
| sort - statusClass, status
| table printer, status, statusClass, timeConvDate, timeConvTime
| eval htmlData="<div class=\"html_table_column ".statusClass."\"><div class=\"html_column_printer html_div_center\">".printer."</div><div id=\"column_status\" class=\"html_div_center\">".status."</div>"."<div id=\"column_timeConvDate\" class=\"html_div_center\">".timeConvDate."</div>"."<div id=\"column_timeConvTime\" class=\"html_div_center\">".timeConvTime."</div></div>"
| stats list(htmlData) as htmlData
| eval htmlData="<div class=\"html_table_row\">".mvjoin(htmlData," ")."</div>"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<done>
<set token="tokResultsInHTML">$result.htmlData$</set>
</done>
</search>
<row>
<panel>
<html>
<style>
div#html_table div.html_table_row{
display: flex;
flex-wrap: wrap;
}
div#html_table div.html_table_row div.html_table_column{
width:15%;
text-align:center;
text-align: center;
color: white;
margin-right: 10px;
margin-bottom: 10px;
padding-top: 10px;
padding-bottom: 10px;
}
div#html_table div.html_table_row div.status_fatal{
background:red;
}
div#html_table div.html_table_row div.status_critical{
background:orange;
}
div#html_table div.html_table_row div.status_low{
background:blue;
}
div#html_table div.html_table_row div.status_info{
background:green;
}
div#html_table div.html_table_row div.html_column_printer{
font-weight:bold;
font-size:120%;
}
</style>
$tokResultsInHTML$
</html>
</panel>
</row>
<row>
<panel>
<title>Format Data as desired output and show as html</title>
<html>
<div id="html_table">
</div>
</html>
</panel>
</row>
</dashboard>
Following is the required JS display_token_with_html_content .js
require([
"jquery",
"splunkjs/mvc",
"splunkjs/mvc/simplexml/ready!"
], function (
$,
mvc
) {
var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:tokResultsInHTML", function (model, tokResultsInHTML, options) {
if (tokResultsInHTML !== undefined) {
$("#html_table").html(tokResultsInHTML);
}
});
});
The mvc.Components is predefined Splunk JS object/class notation so kindly don't confuse with the component column which was used in the previous example. I have changed the example SPL, you can replace commands from | makeresults till | fields - delta sno with your index query and use the remaining pipes as is.
... View more
03-09-2020
03:02 AM
@sahabhi606 this seems to be the duplicate of your previous question https://answers.splunk.com/answers/791943/tabs-in-dashboard.html . As suggested have you implemented the updated version of tabs js files?
Refer to the following answer as well: https://answers.splunk.com/answers/791943/tabs-in-dashboard.html
... View more
03-08-2020
10:53 PM
@prashantku you can try out Timeline Custom Visualization built by Splunk.
... View more
03-07-2020
05:43 AM
@njohnson7 please consider the 10th topic of @jconger 's .Conf Presentation 10 Tips, Tricks and Hacks for Better Dashboards in Splunk, which is about Event Handler + Token + Table Cell Render + Modal + Splunk Web Framework . If you follow his code you will find the working example of opening a Chart as Modal pop-up based on click on a table cell.
Please try out and confirm!
... View more
03-07-2020
05:33 AM
@to4kawa @woodcock this is not a behavior of Splunk, this is a behavior or html table so I dont think issue fix would be there in Splunk.
Refer to this bare-minimal pure html table which still adds whitespace after each cell values. Save as <yourHTMLFileName>.html and open in any browser. When you perform select all you will notice extra space against each values.
<html>
<body>
<table>
<thead>
<tr>
<th><a href="#">sourcetype</a></th>
<th><a href="#">count</a></th>
</tr>
</thead>
<tbody>
<tr>
<td>mongod</td>
<td>130</td>
</tr>
<tr>
<td>scheduler</td>
<td>20</td>
</tr>
<tr>
<td>splunk_archiver-too_small</td>
<td>16</td>
</tr>
<tr>
<td>splunk_web_access</td>
<td>35</td>
</tr>
<tr>
<td>splunk_web_service</td>
<td>236</td>
</tr>
<tr>
<td>splunkd</td>
<td>266434</td>
</tr>
<tr>
<td>splunkd_access</td>
<td>778</td>
</tr>
<tr>
<td>splunkd_conf</td>
<td>1</td>
</tr>
<tr>
<td>splunkd_stderr</td>
<td>1</td>
</tr>
<tr>
<td>splunkd_ui_access</td>
<td>833</td>
</tr>
</tbody>
</table>
</body>
</html>
... View more
03-05-2020
07:03 AM
Anytime 🙂
... View more
03-05-2020
06:29 AM
1 Karma
Try the following:
| timechart span=1h count as "thisistheerrormessage"
... View more
03-04-2020
11:56 PM
@splumtk1, if this is JSON data have you turned on INDEXED_EXTRACTION=json? If so are you using tstats in the query?
... View more
03-04-2020
11:56 PM
@utk123 refer to one of my older answers on similar lines. You would need to create JS based solution to update KV Store using Splunk REST API. https://answers.splunk.com/answers/682183/how-to-add-a-textbox-as-a-cell-in-a-splunk-table.html
... View more
02-21-2020
05:22 PM
@aaronzabell I tried to feed the sample data you provided to a run anywhere search and spath extracted the fields including User Name and IP address correctly. So not sure what is going wrong with your config. Have you checked the field name for username as Event.UserData.EventInfo.Username and IP Address as Event.UserData.EventInfo.IpAddress ?
You can run the following run anywhere example to check the fields yourself.
| makeresults
| eval _raw=" <Event xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\" xml:lang=\"en-US\">
<System>
<Provider Name=\"Microsoft-Windows-TerminalServices-Gateway\" Guid=\"{4D5AE6A1-C7C8-4E6D-B840-4D8080B42E1B}\" />
<EventID>200</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>2</Task>
<Opcode>30</Opcode>
<Keywords>0x4020000001000000</Keywords>
<TimeCreated SystemTime=\"2020-02-21T18:54:19.913701800Z\" />
<EventRecordID>1219</EventRecordID>
<Correlation ActivityID=\"{BEA11342-474B-47DE-907D-F2FBEBD40000}\" />
<Execution ProcessID=\"5480\" ThreadID=\"8416\" />
<Channel>Microsoft-Windows-TerminalServices-Gateway/Operational</Channel>
<Computer>gatewayserver.domain.com</Computer>
<Security UserID=\"S-1-5-20\" />
</System>
<UserData>
<EventInfo xmlns=\"aag\">
<Username>domain\username</Username>
<IpAddress>173.x.x.x</IpAddress>
<AuthType>NTLM</AuthType>
<Resource />
<ConnectionProtocol>HTTP</ConnectionProtocol>
<ErrorCode>0</ErrorCode>
</EventInfo>
</UserData>
<RenderingInfo Culture=\"en-US\">
<Message>The user \"domain\username\", on client computer \"173.x.x.x\", met connection authorization policy requirements and was therefore authorized to access the RD Gateway server. The authentication method used was: \"NTLM\" and connection protocol used: \"HTTP\".</Message>
<Level>Information</Level>
<Task />
<Opcode />
<Channel />
<Provider />
<Keywords>
<Keyword>Audit Success</Keyword>
</Keywords>
</RenderingInfo>
</Event>"
| spath
... View more
02-21-2020
06:55 AM
@bhavlik is there only one Timechart in the Scheduled Dashboard or multiple?
... View more
02-21-2020
06:03 AM
@jip31, it is expected to be within the x-axis data label since the ticks on x-axis and y-axis is applied dynamically along with data labels. Since your x-axis labels are fixed you can definitely tweak the position of x-axis ticks/data label using CSS override (as per your actual panel width, monitor/browser resolution etc). However, I would suggest better leave it dynamic.
For the average part seems like your logic happens in the macro CPU , so for assisting you further we would need to look at the macro definition and possibly some raw sample data which is processed by the macro.
... View more
02-20-2020
08:20 PM
@bhavlik try the depends and rejects solution from one of my older answers which toggles the display of custom No results found message using html panel when no result is found.... https://answers.splunk.com/answers/595248/timechart-with-no-data-gives-no-results-found.html
PS: In order for above to work you would need to take out | appendpipe section from your SPL. So that search returns 0 result count for depends/rejects to work. If you read along the above answer, you will see that append/appendpipe approach is for timechart to always show up with no data to be plotted. However, seems like that is not what you need.
... View more
02-20-2020
11:07 AM
@albertmi since you have normalized raw data match with your own pattern name, there is no raw data pattern value available for timechart drillown. During drilldown you would need to write <condition> blocks similar to the case statement you have, in order to thet the raw data match for your drilldown search.
For example if $click.name$ is Failed delivery , then the search query link will have value Failed delivery for sent as hard coded value as that is the reverse mapping of the case statement you have used to derive Failed delivery .
Final <condition> block without any match is the default condition when non of the patterns described are present in the
conditions. Similar default section should be applied to case() SPL as well using true() statement depending on the use case. If not required it can be removed.
<drilldown>
<condition match="$click.name2$=="Failed delivery"">
<set token="tokClickedName">$click.name2$</set>
<set token="tokRawDataClicked">Failed delivery for</set>
</condition>
<condition match="$click.name2$=="DB-connection errror"">
<set token="tokClickedName">$click.name2$</set>
<set token="tokRawDataClicked">Error connecting to database</set>
</condition>
<condition match="$click.name2$=="JMS message listener invoker failed"">
<set token="tokClickedName">$click.name2$</set>
<set token="tokRawDataClicked">Setup of JMS message listener invoker failed for destination</set>
</condition>
<condition>
<set token="tokClickedName">$click.name2$</set>
<set token="tokRawDataClicked">Other</set>
</condition>
</drilldown>
Following is a run anywhere example with 3 values from your case statement. PS: You can try using lookup file for this mapping and make the output dynamic, both for case() in SPL and drilldown <condition> .
PS: searchmatch() function can be used instead of match() when querying _raw data.
<dashboard>
<label>Drilldown token</label>
<row>
<panel>
<title>FMDS Errors</title>
<chart>
<search>
<query>| makeresults
| eval raw="Failed delivery for,Error connecting to database,Setup of JMS message listener invoker failed for destination,Failed delivery for,Error connecting to database,Failed delivery for,Error connecting to database"
| makemv raw delim=","
| mvexpand raw
| rename raw as _raw
| eval delta=300
| accum delta
| eval _time=_time-delta
| timechart span=5min count(eval(match(_raw, "Failed delivery for"))) as "Failed delivery"
count(eval(searchmatch("Error connecting to database"))) as "DB-connection errror"
count(eval(searchmatch("Setup of JMS message listener invoker failed for destination"))) as "JMS message listener invoker failed"</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<drilldown>
<condition match="$click.name2$=="Failed delivery"">
<set token="tokClickedName">$click.name2$</set>
<set token="tokRawDataClicked">Failed delivery for</set>
</condition>
<condition match="$click.name2$=="DB-connection errror"">
<set token="tokClickedName">$click.name2$</set>
<set token="tokRawDataClicked">Error connecting to database</set>
</condition>
<condition match="$click.name2$=="JMS message listener invoker failed"">
<set token="tokClickedName">$click.name2$</set>
<set token="tokRawDataClicked">Setup of JMS message listener invoker failed for destination</set>
</condition>
<condition>
<set token="tokClickedName">$click.name2$</set>
<set token="tokRawDataClicked">Other</set>
</condition>
</drilldown>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">log</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">top</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
<row>
<panel>
<html>
tokRawDataClicked: $tokRawDataClicked$<br/></br>
tokClickedName: $tokClickedName$
</html>
</panel>
</row>
</dashboard>
... View more
02-20-2020
06:44 AM
@temuulen if give your Single Value id of my_single_value you can try the following Simple XML CSS Extension, you may have to play a bit with CSS as per your needs:
#my_single_value .delta-label{
font-size:300% !important;
}
#my_single_value g.delta-indicator {
transform: translateY(-60px);
}
Following is the run anywhere Simple XML example.
<dashboard>
<label>Single Value with Trend Indicator Font</label>
<row>
<panel>
<html>
<style>
#my_single_value .delta-label{
font-size:300% !important;
}
#my_single_value g.delta-indicator {
transform: translateY(-60px);
}
</style>
</html>
<single id="my_single_value">
<search>
<query>index=_internal sourcetype=splunkd log_level!=INFO
| timechart count as error</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">trend</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
</dashboard>
... View more
02-20-2020
06:19 AM
@landen99 if you put back the SPL for macro wildfire do the other macros work? Have you checked permission/app for other macros and compare them with wildfire in case others work?
... View more
02-20-2020
06:10 AM
@ShagVT if you know the JSON structure like the root node or some other unique pattern, you can use the same to parse and send unwanted data/events to nullQueue (or a separate index) then you can get stats of events pushed to null queue or separate index/sourcetype. https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues
... View more
02-20-2020
06:02 AM
@tyhopping1, I dont think that would be possible without JS Extension. Community will be able to assist you with JS/CSS based solution if possible. Let us know! You can also refer to one of my older answers for highlighting row based on duration: https://answers.splunk.com/answers/581747/change-row-color-when-the-field-time-value-increas.html
If you just need to show Job Name with color based on Actual Start Time vs Expected Start Time you can also check out Status Indicator Custom visualization with some CSS Override it can output like the following:
Following is the Run anywhere example SimpleXML code (CSS Override done from within SImple XML):
<dashboard>
<label>Status Indicator Trellis</label>
<description>Color Job by delay in Actual Start vs Expected Start Status Indicator Trellis</description>
<row>
<panel>
<html>
<style>
#my_status_indicator1 .facet-label{
position: relative !important;
top: 90px !important;
font-size: xx-large !important;
color: white !important;
}
#my_status_indicator1 div[id="status_indicator_app.status_indicator"].splunk-status-indicator{
font-size: 0px !important;
}
#my_status_indicator1 div[id="status_indicator_app.status_indicator"].lazy-custom-visualization{
height: 80% !important;
}
</style>
</html>
<viz id="my_status_indicator1" type="status_indicator_app.status_indicator">
<search>
<query>| makeresults count=20
| streamstats count as sno
| eval msg.jobName="Job".sno
| eval StartTime=random(),StartTime="-".substr(StartTime,1,1)
| eval ExpectedStartTime=random(),ExpectedStartTime="-".substr(ExpectedStartTime,1,1)
| eval ActualStart=relative_time(now(),StartTime),
ExpectedStart=relative_time(now(),ExpectedStartTime)
| eval diff=round(ActualStart-ExpectedStart,0)
| table msg.jobName diff
| stats last(diff) as diff by msg.jobName
| eval color=if(diff>=0,"#53a051","#dc4e41")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="height">675</option>
<option name="refresh.display">progressbar</option>
<option name="status_indicator_app.status_indicator.colorBy">field_value</option>
<option name="status_indicator_app.status_indicator.fillTarget">background</option>
<option name="status_indicator_app.status_indicator.fixIcon">warning</option>
<option name="status_indicator_app.status_indicator.icon">field_value</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">3</option>
<option name="status_indicator_app.status_indicator.staticColor">#dc4e41</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
<option name="trellis.enabled">1</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">small</option>
</viz>
</panel>
</row>
</dashboard>
... View more
02-20-2020
04:06 AM
@Gayathri95 if you are seeing only one series color (only one legend like count) and that is changing by applying seriesColors configuration, then you might need to transpose your data so that each bar becomes a series.
Refer to one of my older answers with transpose: https://answers.splunk.com/answers/548161/how-to-change-colour-of-graphs.html
... View more
02-20-2020
03:58 AM
@jip31 instead of transpose use eval{fieldname} expression after sort command in your current query. Try the following and confirm:
`CPU`
| fields process_cpu_used_percent host
| eval host=upper(host)
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100")
| chart dc(host) as "Number" by cpu_range
| append
[| makeresults
| fields - _time
| eval cpu_range="0-20,20-40,40-60,60-80,80-100"
| makemv cpu_range delim=","
| mvexpand cpu_range
| eval "Number"=0]
| dedup cpu_range
| sort cpu_range
| fields cpu_range Number
| eval {cpu_range}=Number
| fields - Number
For the 3rd point 3- I need to do an average on process_cpu_used_percent field you need to perform average on process_cpu_used_percent by which field?
... View more
02-20-2020
02:50 AM
@dannyze if you want a different approach with REST API you can try the following however commands like tstats, metadata, eventcount and dbinspect are specifically useful while trying to query index related stuff. Since the following approach uses REST API you can output results similar to how you see it in Settings> Data > Indexes view (bring in or filter based on other fields like app name, access etc.
| rest /servicesNS/-/-/data/indexes
| fields title maxTime
| rename title as index
| eval _time=strptime(maxTime,"%Y-%m-%dT%H:%M:%S+%z"), "Last event indexed age"=now()-_time
| where 'Last event indexed age'>=3600 OR isnull('Last event indexed age')
| eval "Last event indexed age"=if(isnull('Last event indexed age'),"No Data",
replace(replace(tostring('Last event indexed age',"duration"),"\+"," days "),"(\d+)\:(\d+)\:(\d+)\.\d+","\1 hr \2 min \3 sec"))
| fields - maxTime _time
... View more
