Refer to Splunk Chart Configuration reference on Splunk docs for various chart config options. In your case you can set charting.legend.labelStyle.overflowMode to ellipsisNone. By default it is ellipsisMiddle. Since your chart appearance depends on how axis data is plotted you might want to truncate legends which are too long. So see if ellipsisLeft or ellipsisRight could be used to show different legends. <option name="charting.legend.labelStyle.overflowMode">ellipsisNone</option> ... View more

Try the following. You had a typing mistake after my). Also I have put true under double quotes and removed label node. From Dashboard Name Splunk will pick up Dashboard label on its own. <nav color="#d15c34"> <collection label="Web Statistic"> <view name="my_web_statistics_20170109_dashboard" default="true"/> </collection> </nav> Refer to http://dev.splunk.com/view/webframework-developapps/SP-CAAAEP9 or http://docs.splunk.com/Documentation/Splunk/6.4.5/AdvancedDev/BuildNavigation ... View more

I am assuming you have multiple Search Heads and Multiple Indexers. Splunk documentation mentions that Post-Processing is not useful in case of Multiple Indexers, it also suggests to reuse the same search in suce case (refer to Post-process searches) : http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches A post-process is effective for conserving resources if the base search is on a single indexer. If you are in an environment with a search head using multiple indexers, post process might not be effective for conserving resources. In this scenario, it might be more effective to use the same search multiple times within a dashboard. ... View more

Is your search given here supposed to get Average and 90th Percentile for entire week or just last week same hour as current hour today? ... View more

You have accepted other comment where there was no answer. ... View more

Can you please Accept/Vote my answer then? ... View more

If you think the suggestion has helped you to resolve your issue, then kindly accept the answer or vote. ... View more

Following is what your Dropdown may look like <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="selTimeWindow" searchWhenChanged="true"> <label>Select Time Window</label> <choice value="(date_wday=&quot;monday&quot; OR date_wday=&quot;tuesday&quot; OR date_wday=&quot;wednesday&quot; OR date_wday=&quot;thursday&quot; OR date_wday=&quot;friday&quot;) AND (date_hour&gt;=7 AND date_hour&lt;=18)">Weekday Business Hours</choice> <choice value="(date_wday=&quot;saturday&quot; OR date_wday=&quot;sunday&quot;) AND (date_hour&gt;=7 AND date_hour&lt;=18)">Weekend Business Hours</choice> <choice value="(date_wday=&quot;monday&quot; OR date_wday=&quot;tuesday&quot; OR date_wday=&quot;wednesday&quot; OR date_wday=&quot;thursday&quot; OR date_wday=&quot;friday&quot;) AND (date_hour&lt;7 AND date_hour&gt;18)">Weekday Non Business Hours</choice> <choice value="(date_wday=&quot;saturday&quot; OR date_wday=&quot;sunday&quot;) AND (date_hour&lt;7 AND date_hour&gt;18)">Weekend Non Business Hours</choice> <default>(date_wday="monday" OR date_wday="tuesday" OR date_wday="wednesday" OR date_wday="thursday" OR date_wday="friday") AND (date_hour&gt;=7 AND date_hour&lt;=18)</default> <initialValue>(date_wday="monday" OR date_wday="tuesday" OR date_wday="wednesday" OR date_wday="thursday" OR date_wday="friday") AND (date_hour&gt;=7 AND date_hour&lt;=18)</initialValue> </input> </fieldset> You can then feed the value selected in Drop Down to your search: <search> <query>index=_internal sourcetype=splunkd AND $selTimeWindow$ | stats count by group ... View more

When you use it in the dropdown value, it will not evaluate as a search... It will just remain as a string. Where ever you run the query that is where you will append the string $selectedTimeWindow$ ... View more

Could you please let me know how the issue was resolved? Was it through re-install? or through splunkd log errors? ... View more

Yes You can define a Dropdown with two static options or Labels i.e. Businees Hours and Non-Business Hours and Values will be the two queries as string. You can finally append to searches. If Drop Down name is selectedTimeWindow then your query will change to <Your Base Search> $selectedTimeWindow$ | Also instead of Eventtype you can define macros with the part of search query above and append to your own base search where ever required (also via Dropdown). ... View more

Your macro is getting inputs as bytes, however, you existing default case treats any value greater than 1 GB as bytes, which is incorrect. Try the following case statements instead of nested if. I have account for Tera Byte and Zeta Byte on top of your existing case. Anything greater that 1024 TB will show up as ZB through final case statement. eval $bytes$=case($bytes$>=1125899906842624 AND $bytes$>1152921504606846976, tostring(round($bytes$/1152921504606846976,2))+" ZB",$bytes$>=1099511627776 AND committed<1125899906842624,tostring(round($bytes$/1073741824,2))+" TB",$bytes$>=1073741824 AND $bytes$<1099511627776, tostring(round($bytes$/1073741824,2))+" GB", $bytes$>=1048576 AND $bytes$<1073741824, tostring(round($bytes$/1048576,2))+" MB", $bytes$>1024 AND $bytes$<1073741824, tostring(round($bytes$/1024,2))+" KB", $bytes$<1024,tostring($bytes$+" Bytes"),1=1,tostring(round($bytes$/1152921504606846976,2))+" ZB") PS: Based on the same you have provided, where your if statement starts my example will start with case statement. So replace macro definition accordingly. ... View more

Can you confirm whether committed and uncommitted fields are numeric prior to being fed to format_bytes or not? If format_bytes appends GB and Bytes to the end of numeric value then the It would be better to handle in format_bytes macro, if not you can use if() condition to handle GB and Bytes. Otherwise, you would need to share the format_bytes macro code from Splunk Knowledge Object. ... View more

I have added the above solution to my Splunk Wiki. Topic 1: Image Overlay with Icons Example: Extends Image Ovelay with Single Values example from Splunk 6.x Dashboard Examples Splunk App: http://wiki.splunk.com/User_talk:Niketnilay ... View more

Please refer my wiki on overriding Chart style using CSS: http://wiki.splunk.com/User_talk:Niketnilay#Topic_2:_Overriding_Chart_Styles_using_CSS Splunk uses Highcharts to display various charts like Line, Column, Bar, Pie etc. Following are various highchart nodes that may be overridden through CSS. Step 1 Font Size in Charts, can be changed via CSS. For example you can save the following as custom_override_highchart_style.css. The following sets x-axis label to 15px, instead of default 11px. /* SVG Highcharts x-axis label font size*/ g.highcharts-axis-labels.highcharts-xaxis-labels text{ font-size: 15px !important; } Step 2 The custom css file custom_override_highchart_style.css should be placed under $SPLUNK_HOME\etc\app&lt;YourAppName>\appserver\static folder. Step 3 Then add stylesheet="custom_override_highchart_style.css" in your <dashboard> or <form> node in Simple XML. For ex: <dashboard stylesheet="custom_override_highchart_style.css"> Step 4 Finally, you would need to restart Splunk and if required, clear web browser cache. ... View more

Custom Command Version 2 protocol is used by Python SDK only. You would need to check with Splunk Team for future road map. ... View more

Sparklines can be added to statistical reporting functions (like chart, stats, timechart) only for the count command and it draws the same based on time span. It shows total count in the Table column and shows time span in the sparkline. If you want to show time span also in tabular as well you might have to separate the queries as two adjacent panels. Sparkline details and example can be found in the following Splunk documentation: http://docs.splunk.com/Documentation/Splunk/latest/Search/Addsparklinestosearchresults Following is an example of the same. I have also applied JS script from Layout Customization: Panel Width example in Splunk 6.x Dashboard Examples App, in order to have the two tables occupy 70%-30% of the entire row. Dashboard Simple XML Code <dashboard script="customtablewidth7030.js"> <label>Sparkline with Details</label> <description>Sparkline</description> <row> <panel> <title>Stats by Month Date</title> <table> <search id="sparklineBaseSearch"> <query>index=_internal date_mday=* | chart count over sourcetype by date_mday | sort sourcetype</query> <earliest>@w0</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <title>Sparkline</title> <table> <search> <query>index=_internal date_mday=* | chart sparkline count as Total over sourcetype | sort sourcetype | fields - sourcetype count</query> <earliest>@w0</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard> JS extension code for customtablewidth7030.js included in dashabord (must be placed in $SPLUNK_HOME\etc\app&lt;YourAppName>\appserver\static folder. It requires splunkd restart and cleaning of internet browser cache) require(['jquery', 'splunkjs/mvc/simplexml/ready!'], function($) { // Grab the DOM for the first dashboard row var firstRow = $('.dashboard-row').first(); // Get the dashboard cells (which are the parent elements of the actual panels and define the panel size) var panelCells = $(firstRow).children('.dashboard-cell'); // Adjust the cells' width $(panelCells[0]).css('width', '70%'); $(panelCells[1]).css('width', '30%'); }); PS: I have not used Post Processing. But should be feasible. As an alternate to Sparkline you should also explore Horizon Chart Custom Visualization which will show adjacent numeric difference and also overlaid sparkline series for various statistical splits over the same time frame. ... View more

accum is “Stateful Streaming” command. Process search results one-by-one Can maintain global state Must not re-order search results Only run at Search Head Examples: accum streamstats dedup ... View more

Your events are arriving every 15 minutes if you do not want to miss a time-bucket you can set span=30m instead of span=15m. Also if you already have fixed source to "UNDERWTG", there is no need to performs stats by source. ... View more

As per your example index=itsm sourcetype=tsm_filespaces OR sourcetype=tsm_nodes node_name=* |stats values(filespacename) as filespacename values(platform_name) as platform_name values(backup_end) as backup_end values(host) as host by nodename ... View more

There could be multiple ways Easiest to do might be through transaction sourcetype="srcType1" OR sourcetype="srcType2" commonField=* | transaction commonField | table _time, eventcount, duration, _raw However, stats might perform better based on use case. You will have to use combinations of first(), last(), min(), max() or values() etc for various fields that you want to work on after correlation sourcetype="srcType1" OR sourcetype="srcType2" commonField=* | stats count as eventcount by commonField | search eventcount>1 You can also use append, appendcols, appendpipe, join,lookup etc based on your needs. Refer to the following event correlation documentation for deciding on your choice: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation ... View more