What kind of Javascript? Splunk JS Extension or Completely custom Javascript like jQuery? ... View more

If acts is one of your extracted fields you can filter the same in the base search itself <Your Base Search> acts!="*#*" | table acts ... View more

How many TEST fields do you expect?, Can they be statically mapped once and based on whichever Field is present will get color? If above is not possible then you would need to use Javascript/CSS to color your Table Cell/Row. For exploring the options you can refer Table Cell Highlighting and Table Row Highlighting examples in the Splunk 6.x Dashboard Examples App ... View more

From your question you seem to be passing TestID from table to another dashboard. However, if you perform statistical function you will get multiple values for T1 there are two test IDs 1 and 2. Please confirm what is the expected behavior. The above drilldown that you have defined should work directly with first table that you have mentioned in the question. ... View more

The change event is not available for multiselect input refer to the documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference I wish there was an enhancement to multiselect input to handle change. ... View more

CSS Extension and JS Extension allows Splunk developers to extend and use their own CSS and JavaScript to extend Splunk to do whatever developer imagines. Some more examples are present on dev.splunk.com(http://dev.splunk.com/view/webframework-codeexamples/SP-CAAAEU7 ) However, I find that Simple XML Examples App is better organised and it gets you started with some examples in each area. Let me change this answer to comment so that Splunk Community can point you to any App which can allow Splunk developers to use CSS more dynamically. Otherwise it would mean that there is scope of development of such app. ... View more

Another thing you need to explain about -15 min. Is it 15 minutes prior to the DateTime value selected as Label in the Dropdown? ... View more

Not sure what is wrong based on IDateTime that you have in your screenshot. Can you try a different command for the same? <YourBaseSearch> | convert timeformat="%m-%d-%Y %I:%M:%S %p" mktime(IDateTime) | fieldformat IDateTime=strftime(date,"%m-%d-%Y %I:%M:%S %p") PS: Use of fieldformat instead of eval will keep underlying field as it is (in our case epochtime) and just display the changed value (human readable date). ... View more

Option 1 If you have access to execute REST API in Splunk search you can add a filter in base search to get all your hosts (or deployment clients) by adding a filter to base search like the following: index=name sourcetype="dell:firewall" [| rest /services/deployment/server/clients| search hostname="192.168.*" | fields hostname | fields - _* | rename hostname as host] earliest=-1d@d latest=@d | <Your Stats Command> In the base search you can add filter for your hosts using OR or a pattern using wildcard/s ( I have taken 192.168.* ) as an example. Option 2 Alternatively you can create lookup table with your host names and instead of rest use inputlookup to get list of all hosts. Option 3 You can do a stats preferably (distinct_count() ) on a field you know that definitely exists on all your hosts and then use eval to replace the stats on the field with 0. ... View more

Can you see if following filter in the base search of your query helps? "* \*" ... View more

@dexxter275... That is why I follow @martin_mueller 🙂 ... View more

@LNebout ... I think you missed accepting the answer 🙂 You should choose Accept Answer option from bolt icon next to my Answer (only you will have that option since you posted the question). In any case glad that the issue is actually resolved. ... View more

Refer to my answer on putting label in Pie Chart. You would need to use eventstats to get the Total and then based on each slice's value compute the percent. Finally, you need to change the label name itself to show Total and Percent. This way you labels will show both without hovering over it. https://answers.splunk.com/answers/351010/how-to-round-a-percentage-value-in-a-pie-chart-to.html#answer-440827 ... View more

You need to parse to PARVW and NAME1 nodes separately and then pipe your search condition for both the fields i.e. (PS: I personally prefer spath over xpath as I am more comfortable with spath syntax) Your query example does not show XML being extracted. If you already do not have a field containing XML data extract the same using rex. Since detail is not present in example, I am assuming xml data field name as xml_data for the following example. (also assuming E1EDKA2 is the root node as per your sample data/query, if not please change path accordingly): <Your Base Search> | spath input=xml_data output=PARVW path=E1EDKA2.PARVW | spath input=xml_data output=NAME1 path=E1EDKA2.NAME1 | search PARVW="AG" | table NAME1 ... View more

I think Workflows should solve your needs https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/CreateworkflowactionsinSplunkWeb ... View more

You will have to provide more sample of your fields/data. If you have some Incident ID you can correlate based on status_label. For example (assuming some of the field name and values just to explain... correct query can be formed only after looking at field names and data) <Your Base Search> | stats count as EventCount min(_time) as MinTime max(_time) as MaxTime values(status_label) as status_label last(owner) as CurrentOwner last(reviewer) as reviewer last(urgency) as CurrentUrgency by IncidentID Then you can filter and evaluate further for Incidents created but not assigned using query like | search status_label="created" AND status_label!="assigned" | eval durationInSeconds=now()-Min_time | search duration>1800 | eval _time=MinTime | table _time IncidentID EventCount status_label CurrentOwner reviewer CurrentUrgency You can create an alert for the same. ... View more

You can edit panel and choose how to handle null values. If you are plotting area chart as per your screenshot. You currently have the Null Values in your timechart treated as Gaps, you can change the same to Zero (equivalent of writing fillnull command) or else mark as Connect (which is equivalent of writing filldown command). ... View more

Final eval should look like the following: (You can use cascaded replace command to find string patterns and replace with what you want in a column. <Your Base Search> | eval column=replace(replace(replace(column,"Math_total_score","Math"),"English_countable_score","English"),"Phy_countable_score","Phy") ... View more

If field D is always present but may differ in your three indexes you can use D=* in your base search. ... View more

If D is the transaction ID to correlate the same event in three indexes then you can try index=A OR index=B OR index=C <Add your Base Search Filter cirteria/s> | stats count as EventCount values(index) as MatchedIndexes min(_time) as MinTime max(_time) as MaxTime by D | search MatchedIndexes=A AND MatchedIndexes=B AND MatchedIndexes!=C | eval durationInSeconds=MaxTime-MinTime | eval _time=MinTime | table _time D EventCount MatchedIndexes durationInSeconds ... View more

If you upgrade to 6.5 or higher you will have cell coloring option built in to the table. Without JS/CSS extension. ... View more

@pratyush46 is your issue resolved? ... View more

@splunkrocks2014 Were you able to try the example provided? ... View more