Splunk Charts applies series colors to all charts. In fact if the series names are same, that is how all series will pick same color. If you notice in your screenshot, when you choose Categorical colors for the Timeline visualization, the Legends in the same sequence have the same colors as compared to other charts i.e. First color in your timechart as well TimeLine visualization is blue(0x1e93c6) and second is orange(0xf2b827)... and so on. Following are default series colors picked up by Splunk charts (charting.seriesColors😞 [0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f, 0xed8440, 0x3863a0, 0xa2cc3e, 0xcc5068, 0x73427f, 0x11a88b, 0xea9600, 0x0e776d, 0xffb380, 0xaa3977, 0x91af27, 0x4453aa, 0x99712b, 0x553577, 0x97bc71, 0xd35c2d, 0x314d5b, 0x99962b, 0x844539, 0x00b290, 0xe2c188, 0xa34a41, 0x44416d, 0xe29847, 0x8c8910, 0x0b416d, 0x774772, 0x3d9988, 0xbdbd5e, 0x5f7396, 0x844539] ... View more

If your data itself does not have granularity till milliseconds you will end up getting .000 in your visualization. Do you really want to show milliseconds when it is not present? You can choose Axis Time Format and Tool Tip Time Format as SECONDS instead of SUBSECONDS, to get your timeline visualization in sync with your data, otherwise resort to @woodcock 's solution of configuring your inputs.conf/props.conf to receive ms in _time. <option name="timeline_app.timeline.axisTimeFormat">SECONDS</option> <option name="timeline_app.timeline.tooltipTimeFormat">SECONDS</option> PS: You can do the same by Editing Timeline Chart in UI as well by setting Time format for Axis labels and Tooltips to HH:MM:SS ... View more

@robertlynch2020, please convert your comment as answer and accept the same 🙂 ... View more

Can you paste a screenshot... after masking sensitive information if any? ... View more

You can take advantage of Post Processing when you use transforming or statistical functions in your base search. You should not be trying to send raw data through Post Process. http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Post-process_limitations You can create a base search with combination all 10 sources in the single base search and perform sitimechart. Finally you can created 10 base searches one for each Panel. However, you would need to test the performance of your dahsboard with and without post-processing. As it has been mentioned in the document sometimes you are better of running same search multiple time. index=ecm sourcetype=sql source=source1 source=source2 ... source=source10 | <your remainining search> | sitimechart span=15m avg(QUEUE_DEPTH_PROD) by source ... View more

Most of Splunk correlation methods like transaction, join, append, subsearch, stats and lookup will work. Depends on your scenario. Are you trying to: 1) Pull up all failed login attempts by all disabled users (stats or lookup will be better) or 2) Do you have a disabled user for whom you need to find failed login attempts (transaction will be better)? Refer to Splunk documentation on which event correlation technique to be picked up under what scenario: https://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation IN order for the community yo assist you, can you provide one sample event from each of 639 and 531 Event IDs? Please make sure that you change actual name/ids and details with mock data so that we can assist you more with the correlation. Following is a sample query for guidance: Option with lookup: 1) Create lookup file through scheduled search via outputlookup command for Disabled Account (EventCode=639) and log meaningful details like Disabled User ID, Domain, Unique ID, Date of Deactivation etc. index="<Your_Index_Name>" sourcetype="WineventLog:Security" EventCode="639" Privileges="Disabled" CallerLogonID=* | table CallerLoginID _time <other meaningful fields> | outputlookup <your_lookup_file_or_table_name> Schedule can be as per your requirement like hourly once or daily once. 2) Performs Stats on Failed Login Attempts (EventCode=531) to capture details on frequency, number of failed attempts, source IPs, host/s and link with the lookup table and fill in the details. index="<Your_Index_Name>" sourcetype="WineventLog:Security" EventCode="531" CallerLogonID=* | stats count min(_time) as EarliestFailedLogin max(_time) as LatestFailedLogin values(host) as ServersAttempted by CallerLogonID | lookup <your_lookup_file_or_table_name> CallerLogonID OUTPUT _time as UserDisabledDate | where isnotnull(UserDisabledDate) Option with stats: (I think you meant sourcetype in your question not index, as your index name might be different). Assuming CallerLoginID as the joining field and Privileges=Disabled for disabled account. index="<Your_Index_Name>" sourcetype="WineventLog:Security" (EventCode="639" AND Privileges=Disabled)OR EventCode="531" CallerLogonID=* | stats count as eventcount min(_time) as EarliestTime max(_time) as LatestTime values(EventCode) as EventCode values(_time) as Events by CallerLogonID For Disabled Accounts with failed login attempts you need to pipe the following | search EventCode=639 AND EventCode=531 For All other Failed Logins | search EventCode!=639 AND EventCode=531 Option with Transaction index="<Your_Index_Name>" sourcetype="WineventLog:Security" EventCode="639" OR EventCode="531" CallerLogonID=* | transaction CallerLogonID startswith="EventCode=639" endswith="EventCode=531" | table CallerLogonID eventcount duration Update @renjujacob88... Sure it should be possible with stats and also lookup. In case above hints do not help you come up with query(try stats first) then please add sample events for one disabled user who attempted login. You can garble/mock the sensitive data before posting the same. You should also read the documentation on Splunk App for Windows Infrastructure which already takes care of your use case beside many... many... many... others 😉 http://docs.splunk.com/Documentation/MSApp/latest/Reference/FailedLogons --> "Failed logons by reason (for example, expired password, locked account, or disabled account.)" ... View more

You can just replace appencols in above example with join ID So try the following: (index="first" sourcetype="anysourcetype") OR (index="second" sourcetype="otherstr") | stats count as count1 by FIELD1 | join ID [search index="second" sourcetype="otherstr"| stats count as count2 by FIELD1]| eval Difference=count1-count2 FYI - append, appendcols, join, stats, eventstats, transaction, subsearch etc are all for event correlation and most of them might fit in to return the results you want. However, you should try job inspector to evaluate which one performs best. Refer to following Splunk documentation on how to choose between various event correlation commands http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation ... View more

@vaibhavagg2006 I have updated my answers and added a screenshot to show that nullValueMode is applicable to Overlaid fields also. Please let me know if I have misunderstood your question in anyway. In case I have please add current Screenshot and if possible the expected behavior. ... View more

@jhatton Were you able to try the above approach for your scenario. ... View more

Using Extract fields method in your Splunk Search you can create Field Extraction yourself using Regular Expression on your data. Make sure there are no non-matches in your selected events or you would need to adjust the regular expression by including non-matched events. Follow the documentation to come up with your field extraction: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX ... View more

Here is the option with single check box... Like @rjthibod mentioned, change event handler is not available for Checkbox or Multiselect control since both handle multi-values, even though the Splunk documentation mentions that change event is available for checkbox (http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference). I have submitted a feedback for the broken functionality for Checkbox change event as listed out in the following Splunk Documentation. I am not sure of how to create an Enhancement request, until then you can try the following option to run a dummy search to set the token you need (it will be more expensive than previous approach I mentioned in comments). <fieldset submitButton="false"> <input type="checkbox" token="showPanel"> <label>Show/Hide Panels</label> <choice value="Panel1">Panel1</choice> <choice value="Panel2">Panel2</choice> <default>Panel1,Panel2</default> <initialValue>Panel1,Panel2</initialValue> <delimiter> </delimiter> </input> </fieldset> <search id="myDummySearch"> <query>| makeresults | eval checkBoxSelection="$showPanel$" | eval Panel1=case(like(checkBoxSelection, "%Panel1%"),"true") | eval Panel2=case(like(checkBoxSelection, "%Panel2%"),"true") | eval flag=case(Panel1=="true" AND Panel2=="true",1,Panel1=="true",2,Panel2="true",3,1==1,4) | table Panel1 Panel2 flag </query> <earliest>-1m</earliest> <latest>now</latest> <preview> <condition match="$result.flag$==&quot;1&quot;"> <set token="showPanel1">true</set> <set token="showPanel2">true</set> </condition> <condition match="$result.flag$==&quot;2&quot;"> <set token="showPanel1">true</set> <unset token="showPanel2"></unset> </condition> <condition match="$result.flag$==&quot;3&quot;"> <set token="showPanel2">true</set> <unset token="showPanel1"></unset> </condition> <condition> <unset token="showPanel1"></unset> <unset token="showPanel2"></unset> </condition> </preview> </search> However, you need to define two depends tokens both for checkbox and also one set through above search. Token from checkbox will handle the scenario to hide both panels where both check boxes are unchecked. For example <table depends="$showPanel1$,$showPanel$"> ... View more

You can create two independent Check Boxes one for each Panel/visualization. Then you do not need to code change event handler as the checkbox token is unset when checkbox is unchecked. <input type="checkbox" token="showPanel1"> <label>Show/Hide Panels</label> <choice value="Panel1">Panel1</choice> <default>Panel1</default> <initialValue>Panel1</initialValue> <delimiter> </delimiter> </input> <input type="checkbox" token="showPanel2"> <label></label> <choice value="Panel2">Panel2</choice> <default>ShowPanel2,Panel2</default> <initialValue>ShowPanel2,Panel2</initialValue> <delimiter> </delimiter> </input> </fieldset> <row> Then you can associate each of the panel with corresponding token through depends <panel id="panel1" depends="$showPanel1$"> ... <panel id="panel2" depends="$showPanel2$"> ... View more

@andrewtobec...Did you try any of the options provided here? Since you had told time shifting by 3 days, I had suggested correcting time in inner query by 3 days... There are two other answers without use of appendcols, can you try them and confirm? ... View more

@jeffland, this question was for Timeline Custom Visualization a property like charting.drilldown is not applicable. Also I think @robertlynch2020 had already tried timeline_app.timeline.drilldown, which is not exposed. Which I why I suggested a workaround in Simple XML. ... View more

Yes... I tried to attach image to my answer since both rex as well as IFX worked for me. However, I am unable to do so... I have added regular expression that IFX came up with to my answer. Please test that in rex. If not Try Field Extraction yourself. One of the other option would be to remove newline character from your _raw events using eval with replace, but that will be too expensive. ... View more

Are using trying the rex command or IFX? In either case you can turn on Access Flag (?s), due to the same \s+ will match newline characters also. Following is an example: rex field=_raw "(?s)Error message:\s+(?<Username>.*)-The user name or password is incorrect" Both rex and IFX worked for me... If Rex is not working for you please try Interactive Field Extraction in Splunk and let Splunk come up with required regular expression. Following is the regular expression IFX came up with ^(?:[^ \n]* ){4}\s+(?P<Username>[^\-]+) . You can also try this instead in rex to test. ... View more

Please add condition block to set the other dropdown as asterisk (*) only if the selected value in the current dropdown is not asterisk (*) i.e. <condition match="$value$!=&quot;*&quot;"> <input type="dropdown" token="DealSize" searchWhenChanged="true"> <label>Deal Size</label> <default>*</default> <prefix>"</prefix> <suffix>"</suffix> <fieldForLabel>DealSize</fieldForLabel> <fieldForValue>DealSize</fieldForValue> <search> <query>| stats count by DealSize | dedup DealSize | fields DealSize</query> </search> <initialValue>*</initialValue> <choice value="*">All</choice> <change> <condition match="$value$!=&quot;*&quot;"> <set token="form.Fiscal_Year">*</set> </condition> </change> </input> <input type="dropdown" token="Fiscal_Year" searchWhenChanged="true"> <label>Fiscal Year</label> <default>All</default> <prefix>"</prefix> <suffix>"</suffix> <fieldForLabel>Fiscal_Year</fieldForLabel> <fieldForValue>Fiscal_Year</fieldForValue> <search> <query>| stats count by Fiscal_Year | dedup Fiscal_Year | fields Fiscal_Year</query> </search> <initialValue>*</initialValue> <change> <condition match="$value$!=&quot;*&quot;"> <set token="form.DealSize">*</set> </condition> </change> </input> ... View more

If you have same date range why would you want to do appendcols? Please provide context. In any case if your time for Exit search is shifted by 3 days you can either do _time=(_time-3*24*60*60) or else also try including earliest and latest dates directly in base search for both correlated search. ... View more

HTML Panels are different than HTML Dashboards. What I was requesting was to create HTML Panels with anchor tags instead of links and use then as URL Encoded links. Nevertheless, easier or the hard way, I am glad you are able to somehow make it work. Upgrading to newer instance of Splunk will also fix the same as the Simple XML dashboard is working fine for me in 6.5. Sooner or later things will be easier with latest version. ... View more

@andrey2007, I am working on Splunk 6.5 and can see the node as svg text. I have attached a screenshot for the same. I had missed line-height: 30px !important; override setting in CSS which I have updated in my answer. Please check again and confirm. Also which version of Splunk are you using? When you drilldown the CSS can you see the nodes as highlighted in the screenshot I have attached? ... View more

There could be multiple ways to do it. However, best suited would be based on your current drilldown definition and details like what kind of visualization with what value/token is being used for displaying a new panel, also what should be the condition to hide the new panel. However, if you just want to hide based on check box Show (checked or unchecked) or Link Switcher Show/Hide, you can use panel depends attribute for the same. If you assign a token to it based on whether the token is set or unset the panel will be displayed or hidden accordingly. Similar to depends rejects attribute can also be used which performs vice-versa. For the first time you can set the token HidePanel for your drilldown. ..... ..... <input type="checkbox" token="hideFlag"> <label>Select Field</label> <choice value="true">Hide</choice> </input> </fieldset> <row> <panel depends="$hideFlag$"> ..... ..... For similar examples on Depends/Rejects and Link Switcher you can check out Splunk 6.x Dashboard Examples app from Splunkbase. ... View more