Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
02-05-2020
05:14 AM
Hi @wieslaww do you have 1 to 1 mapping between host name and Site or not?
If so, create a Lookup Definition for indexers.csv and then change the query as following:
index="_introspection" component ="hostwide"
| lookup indexers indexer as splunk_server OUTPUT site
| timechart max(data.mem.mem_used) as Current by site
... View more
02-04-2020
09:47 PM
This would need to be an independent search and set the token using Search Event Handler. However, there are some additional questions you must consider:
Since the data indexed is JSON, are you using INDEXED_EXTRACTION=json in props.conf? This will allow you to query NUM field through tstats command which will work really fast.
If you are getting multiple JSON files, how many files do you want to consider for calculating max? For example based on all files that have come in last hour, last 24 hours, today, yesterday or any other timing? Or just based on last 10, 100 or 1000 files?
... View more
02-04-2020
06:32 AM
@anooshac let us take one step at a time. So is the JSON file indexed in Splunk? Can you mask/anonymize and provide us with sample data showing the num field in the JSON file? Do you have multiple num fields (multiple events) within same JSON file or multiple JSON files that get indexed in Splunk?
Your first step should be to analyze the data and come up with the SPL search to get the required data first i.e. use Splunk Search to find answer to your problem and then think how to put the same in Dashboard.
... View more
02-04-2020
05:44 AM
@nagar57 Even I was intrigued when I saw this posted in slack chat. I wish I could pull up who posted but definitely saw the need of documenting this.
With some simple XML standardization it becomes a reusable code for refresh button. Please find the updated Prebuilt panel code and dashboard code where you can create Refresh button as the Top Row which gets hidden. Downside is that row_refresh_panel added is outside the pre-built panel which is used to hide the empty row as Refresh button position is moved to top of the dashboard using CSS override.
<form>
<label>Dashboard with Refresh Button</label>
<fieldset submitButton="false"></fieldset>
<row id="row_refresh_panel">
<panel ref="pp_refresh_button"></panel>
</row>
<row>
<panel>
<input type="time" token="tokTime" searchWhenChanged="true">
<label></label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="tokDD" searchWhenChanged="true">
<label></label>
<choice value="a">Alpha</choice>
<choice value="b">Beta</choice>
<choice value="c">Charlie</choice>
<choice value="d">Delta</choice>
<default>a</default>
</input>
</panel>
</row>
<row>
<panel>
<table>
<title>Click to set table drilldown token!</title>
<search>
<query>| makeresults</query>
</search>
<option name="drilldown">cell</option>
<drilldown>
<set token="tokTableDDTime">$click.value$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<div>
<ul>
<li>tokDD: $tokDD$</li>
<li>Time Tokens: $tokTime.earliest$ | $tokTime.latest$</li>
<li>tokServer: $tokServer$</li>
<li>Current App Name: $env:app$</li>
<li>Current Dashboard Name: $env:page$</li>
<li>tokTableDDTime: $tokTableDDTime$</li>
</ul>
</div>
</html>
</panel>
</row>
</form>
Following is the updated prebuilt panel pp_refresh_button with updated CSS as mentioned above:
<panel id="panel_refresh">
<html>
<div id="simplexml_refresh_button">
<a href="http://$tokServer$:$tokHTTPPort$/en-US/app/$env:app$/$env:page$">
<i class="icon-rotate"/>
</a>
</div>
<style>
#simplexml_refresh_button{
border-width: thin;
border-radius: 50%;
background: #fff;
width: 25px;
float: right;
position: absolute;
top: -35px;
right: 220px;
height: 25px;
}
#simplexml_refresh_button a{
font-size:large;
position:relative;
top:2px;
left:6px;
}
#row_refresh_panel .panel-element-row{
height: 0px;
}
</style>
</html>
<table depends="$alwaysHiddenDummySearchForPreBuiltPanelTokens$">
<search>
<query>| rest splunk_server=local /servicesNS/-/-/server/settings
| fields host_resolved httpport
</query>
<done>
<condition match="$job.resultCount!=0$">
<set token="tokServer">$host_resolved$</set>
<set token="tokHTTPPort">$httpport$</set>
</condition>
<condition>
<set token="tokServer">localhost</set>
<set token="tokHTTPPort">8000</set>
</condition>
</done>
</search>
</table>
</panel>
... View more
02-04-2020
01:02 AM
@anooshac what do you mean by I want to compute the token value in init ? Have you tried <eval> ? Also what is your current code and what is not working? Give us more information about what you want to achieve on dashboard load so that we can assist you better.
... View more
02-04-2020
12:58 AM
2 Karma
@nagar57 if you want to do it via Simple XML JS Extension you can try one of older answers: https://answers.splunk.com/answers/554639/i-want-to-refresh-the-dashboard-on-button-click-is.html
Recently I have learnt that you can mimic something similar using pure Simple XML code. Since it was on slack and got cleaned up I am going to record this on Answers.
Add the following code to your dashboard and test. It basically refreshes the dashboard by opening the link to itself in the same browser:
<panel>
<html>
<div id="simplexml_refresh_button">
<a href="http://$tokServer$:$tokHTTPPort$/en-US/app/$env:app$/$env:page$">
<i class="icon-rotate"/>
</a>
</div>
<style>
#simplexml_refresh_button{
border-width: thin;
border-radius: 50%;
background: #eee;
width: 25px;
float: right;
position: absolute;
top: 40px;
right: 20px;
height: 25px;
}
#simplexml_refresh_button a{
font-size:large;
position:relative;
top:2px;
left:6px;
}
</style>
</html>
<table depends="$alwaysHiddenDummySearchForPreBuiltPanelTokens$">
<search>
<query>| rest splunk_server=local /servicesNS/-/-/server/settings
| fields host_resolved httpport
</query>
<done>
<condition match="$job.resultCount!=0$">
<set token="tokServer">$host_resolved$</set>
<set token="tokHTTPPort">$httpport$</set>
</condition>
<condition>
<set token="tokServer">localhost</set>
<set token="tokHTTPPort">8000</set>
</condition>
</done>
</search>
</table>
</panel>
PS: The dummy search above runs the REST API to get the current Splunk server and http port no. for the URL. Splunk App Name and current Dashboard name are pulled through global environment tokens .
If this works you can save the above code as Prebuilt panel in my example below I have named the prebuilt panel pp_refresh_button
Then try the following run anywhere example Simple XML Dashboard code to set few tokens, change them and refresh dashboard using Refresh button (PS: prebuilt panel above has been added using <panel ref="pp_refresh_button"></panel> in the Simple XML dashboard code):
<form>
<label>Dashboard with Refresh Button</label>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<input type="time" token="tokTime" searchWhenChanged="true">
<label></label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="tokDD" searchWhenChanged="true">
<label></label>
<choice value="a">Alpha</choice>
<choice value="b">Beta</choice>
<choice value="c">Charlie</choice>
<choice value="d">Delta</choice>
<default>a</default>
</input>
</panel>
<panel ref="pp_refresh_button"></panel>
</row>
<row>
<panel>
<table>
<title>Click to set table drilldown token!</title>
<search>
<query>| makeresults</query>
</search>
<option name="drilldown">cell</option>
<drilldown>
<set token="tokTableDDTime">$click.value$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<div>
<ul>
<li>tokDD: $tokDD$</li>
<li>Time Tokens: $tokTime.earliest$ | $tokTime.latest$</li>
<li>tokServer: $tokServer$</li>
<li>Current App Name: $env:app$</li>
<li>Current Dashboard Name: $env:page$</li>
<li>tokTableDDTime: $tokTableDDTime$</li>
</ul>
</div>
</html>
</panel>
</row>
</form>
... View more
02-03-2020
06:46 PM
@kvmadan can you try the following REST API?
https://xyz:8089/servicesNS/-/-/search/jobs
instead of https://xyz:8089/services/search/jobs and confirm?
... View more
01-28-2020
10:31 PM
@nareshinsvu if you ensure that the series labels are always present then you can apply this kind of format using CSS alone. For example in above scenario ERROR will always be series0 (if ERROR is not there its value should be 0) and WARN is series1 due to alphabetical order. You can refer to one such example on Splunk Answers: https://answers.splunk.com/answers/615999/pie-chart-vs-label-colors.html
If series is not fixed i.e. sometimes ERROR will not be there at all then you would need jQuery and SplunkJS for the override as that would be dependent on render of Pie Chart whether ERROR exists or not.
... View more
01-27-2020
05:09 PM
@genesiusj you can always upload to image sharing sites and post the link using image button here on Splunk Answers (for example imgur ). Please ensure that you mask/anonymize any sensitive information before posting.
... View more
01-27-2020
05:40 AM
@vn86893 refer to one of my answers below. With the suggestion from @kamlesh_vaghela you would be able to get the desired output as expected, however, it requires JS and CSS. If your constraint is to avoid static files like JS and CSS, you can try the other option as proposed in the answer. However, you would see status and host field value also in the table.
https://answers.splunk.com/answers/686288/how-do-you-highlight-a-table-cell-based-on-a-field.html (refer to the first example which does not use JS and applies color via colorPalette using Expressions purely through Simple XML, available in Splunk 6.5 and above ).
... View more
01-26-2020
09:15 AM
@kulick do you have searchWhenChanged for input set to true and submitButton turned false?
Also instead of <eval> use <set> to set the derived token in your dashboard
<set token="derived">minspan=10m</set>
PS: I tried the following code and it worked fine.
Source Dashboard
Used to link to Destination dashboard with input token value form.tokSummary=10minutes set
<dashboard>
<label>Source dashboard with time span</label>
<row>
<panel>
<html>
<a target="_blank" href="https://<yourSplunkServer>:<yourSplunkWebPort>/en-US/app/search/<yourDestinationDashboardName>?form.tokSummary=10minute">Click to Pass Span to destination dashboard</a>
</html>
</panel>
</row>
</dashboard>
Destination Dashboard
<form>
<label>Destination Dashboard with span input</label>
<fieldset submitButton="false">
<input type="dropdown" searchWhenChanged="true" token="tokSummary">
<label>Summary Interval</label>
<choice value="10minute">10 minutes</choice>
<choice value="1hour">1 hour</choice>
<choice value="1day">1 day</choice>
<default>1hour</default>
<change>
<condition value="10minute">
<set token="derived">minspan=10m</set>
</condition>
<condition>
<set token="derived"> </set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| makeresults
| fields - _time
| eval inputToken="$tokSummary$",derived="$derived$"</query>
</search>
</table>
</panel>
</row>
</form>
... View more
01-25-2020
12:11 PM
@potnuru if your intent is to display human readable string time in the table however, drilldown using the epoch time, then there are four options you can use including the one suggested by @kamlesh_vaghela which is available as an example in the Splunk Dashboard Examples app on Splunkbase.
If you would notice all four tables in the screenshot below show time as string time in the table however, the drilldown token in the table title is epoch.
Option 1: if _time is the first field in table then use $click.value$ table drilldown token to access epoch time.
Option 2: the table <drilldown> event handler can have <eval> section to convert string time in the table and set token as epoch time.
Option 3: Create a separate field for epoch timestamp apart from string time stamp field for displaying in the table. Make the epoch timestamp field hidden by prefixing the field name with underscore character. In the example it is _hiddenTimeEpochForDrilldown .
Option 4: hidden field through <fields> <table> Simple XML configuration option. If out of 3 fields in the table only 2 are listed in the fields section then, third field is still available for drilldown but not displayed in the table. In the following example it is <fields>["time_number","data"]</fields> . (Kamlesh also has posted same example.)
Following is a run anywhere dashboard with examples of all four approaches:
<dashboard>
<label>Table with Time Drilldown</label>
<row>
<panel>
<title>Option 1 - if _time is the first field in table then use click.value table drilldown token to access epoch time</title>
<table>
<title>Clicked row Time Epoch: $tokTimeNumberOption1$</title>
<search>
<query>| makeresults count=5
| eval data=random(), data=substr(data,0,3), delta=300
| accum delta
| eval _time=_time-delta
| fields - delta
| table _time data</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="tokTimeNumberOption1">$click.value$</set>
</drilldown>
</table>
</panel>
<panel>
<title>Option 2 - drilldown eval to set token as epoch</title>
<table>
<title>Clicked row Time Epoch: $tokTimeNumberOption2$</title>
<search>
<query>| makeresults count=5
| eval data=random(), data=substr(data,0,3), delta=300
| accum delta
| eval _time=_time-delta
| fields - delta
| rename _time as time_number
| table time_number data
| eval time_number=strftime(time_number,"%Y/%m/%d %H:%M:%S")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<eval token="tokTimeNumberOption2">strptime($row.time_number$,"%Y/%m/%d %H:%M:%S")</eval>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<title>Option 3 - keep epoch time field hidden by prefixing fieldname with underscore and use for drilldown</title>
<table>
<title>Clicked row Time Epoch: $tokTimeNumberOption3$</title>
<search>
<query>| makeresults count=5
| eval data=random(), data=substr(data,0,3), delta=300
| accum delta
| eval _time=_time-delta
| fields - delta
| rename _time as time_number
| table time_number data
| eval _hiddenTimeEpochForDrilldown=time_number
| eval time_number=strftime(time_number,"%Y/%m/%d %H:%M:%S")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="tokTimeNumberOption3">$row._hiddenTimeEpochForDrilldown$</set>
</drilldown>
</table>
</panel>
<panel>
<title>Option 4 - hidden field through <fields> table SimpleXML configuration option</title>
<table>
<title>Clicked row Time Epoch: $tokTimeNumberOption4$</title>
<search>
<query>| makeresults count=5
| eval data=random(), data=substr(data,0,3), delta=300
| accum delta
| eval _time=_time-delta
| fields - delta
| rename _time as time_number
| table time_number data
| eval hiddenTimeEpochForDrilldown=time_number
| eval time_number=strftime(time_number,"%Y/%m/%d %H:%M:%S")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<fields>["time_number","data"]</fields>
<drilldown>
<set token="tokTimeNumberOption4">$row.hiddenTimeEpochForDrilldown$</set>
</drilldown>
</table>
</panel>
</row>
</dashboard>
Please try out and confirm. Hope at least one option works out for you! 🙂
... View more
01-25-2020
11:22 AM
@genesiusj would it be possible for you to post the mock screenshot of the desired output? Based on your use case or ITSI scenario you have mentioned.
You can refer to one of my older answers where I have used Simple XML JS extension to parse through the search result rows using SplunkJS Stack and then format results as html section. You can go ahead and create html output as per your needs.
https://answers.splunk.com/answers/662523/how-to-show-table-result-in-one-page-table-modific.html
... View more
01-24-2020
10:45 AM
Hi @z432u4kvfkcg eventtype=pan_wildfire exists then the query should work.
Do you get results when you perform the following command:
index="paloalto" flags=decrypted type=THREAT threat!="MP4 Detected(52104)" action=blocked eventtype=Pan_wildfire
Or what do you see when you run the following:
index="paloalto" flags=decrypted type=THREAT threat!="MP4 Detected(52104)" action=blocked
| stats count by eventtype
Also adding span=1d should bucket daily stats for you. For example: | timechart span=1d ............
... View more
01-24-2020
09:43 AM
1 Karma
@z432u4kvfkcg when your intent is to plot a timechart, the reason to split by date field is not so clear. Also, based on the search you have provided seems like you dont need subsearch appendcols at all. Please try the following:
index="paloalto" flags=decrypted type=THREAT threat!="MP4 Detected(52104)" action=blocked
| timechart count as All_Blocked_count count(eval(eventtype= pan_wildfire)) as Pan_Wildfire_Blocked_count
... View more
01-23-2020
08:17 AM
1 Karma
@harishalipaka it definitely will have subsearch limitations and limits.conf can be changed to accommodate as per your needs but as @skoelpin has mentioned please let us know your current SPL/Use case so that we can suggest you any other alternative which is better suited for your needs and may not run into sub-search limitations. PS: You can also try out the sub-search related optional arguments to see if append works (not recommended unless we see your use case): https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Append#Optional_arguments
... View more
01-23-2020
07:35 AM
Following is a run anywhere example with slight modification to the answer by @jeffland,
The jQuery selector for trapping click event on Single value should be $(document).on("click","#single", function(e) { instead of $("#single").on("click", function(e) { to ensure that the document is rendered and #single is available for clicking.
$(document).on("click","#single", function(e) {
e.preventDefault(); // Prevent default drilldown if needed
var url = window.location.href.split("#")[0] + "#drilldownTarget"; // Add/Replace url fragment
window.location.href = url; // Go to specified position
});
Following is a run anywhere example which you can try and confirm!
<dashboard script="single_custom_drilldown.js">
<label>Single Value with Drilldown to Another section of Dashboard</label>
<row>
<panel>
<title>Click Single Value to navigate to the chart in the bottom within the dashboard</title>
<single id="single">
<title>Internal index event count</title>
<search>
<query>| tstats count where index=_internal
</query>
<earliest>-1d@d</earliest>
<latest>now</latest>
</search>
</single>
</panel>
</row>
<row>
<panel>
<table>
<title>Trending event count - tabular</title>
<search id="sResults">
<query>| tstats count where index=_internal by _time span=1h
</query>
<earliest>-1d@d</earliest>
<latest>now</latest>
</search>
<option name="count">20</option>
</table>
</panel>
</row>
<row>
<panel>
<title>Drilldown chart</title>
<chart id="drilldownTarget">
<title>Trending event count - Column Chart</title>
<search base="sResults"></search>
</chart>
</panel>
</row>
</dashboard>
Following is the code for single_custom_drilldown.js JavaScript file:
require(["jquery",
"splunkjs/mvc",
"splunkjs/mvc/simplexml/ready!"],
function($, mvc) {
console.log("Inside Custom Single Drilldown JS");
$(document).on("click","#single", function(e) {
e.preventDefault(); // Prevent default drilldown if needed
var url = window.location.href.split("#")[0] + "#drilldownTarget"; // Add/Replace url fragment
window.location.href = url; // Go to specified position
});
});
... View more
01-21-2020
08:50 AM
@premranjithj I have converted my comment to answer. Please accept if your issue is resolved.
... View more
01-20-2020
10:30 PM
@premranjithj can you please add a screenshot of what is the issue you are facing? Also what do you want to do when the inputs can't be accommodated in the same row? Do you want to reduce input width or do you want to have scrollbar to the right?
Here is a previous answer on similar lines. Not sure if this is same requirement for you as well: https://answers.splunk.com/answers/789054/how-to-fix-the-dashboard-layout-irrespective-of-th.html
... View more
01-20-2020
01:17 AM
1 Karma
@ak1508 as per color coding for SPL post Splunk 6.5 , the like in the command | where foo like "bar" is an argument as it highlights as orange, but using | where like(foo,"bar") treats it as function and highlights as pink. Refer to Splunk Documentation for the same: https://docs.splunk.com/Documentation/Splunk/latest/Search/Parsingsearches#Color_codes
You should be using the second one because internally Splunk's Query Optimization converts the same to function like() .
Which implies following query in Splunk Search
| makeresults
| eval data="testabc"
| where data like "test%"
Converts to the following optimized query when it executes (you can check Job Inspector for details:
| makeresults
| eval data="testabc"
| where like(data,"test%")
... View more
01-19-2020
11:05 PM
@vikram1583 the default sourcetype for Summary Indexes is stash. For example those collected via collect command or si ex: sichart, sitimechart etc.
The reason for this is that License usage is not incurred unless the sourcetype is overridden from stash to something else. Refer to documentation for sourcetype argument details and default stash value: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/collect#arg-options
Ideally you should create new fields like orig_sourcetype or any other marker field to keep the value of original sourcetype and keep stash as the sourcetype for summaries unless license cost for summary index is not an issue for you!
... View more
01-19-2020
12:25 PM
1 Karma
Simple solution of adding a dummy event using makeresults to ensure "No Results Found" message is not displayed! 🙂
I went for generating dummy event for each time span 😞
... View more
01-19-2020
12:20 PM
Please find updated answer!
... View more
01-19-2020
07:54 AM
[UPDATED ANSWER]
Documenting query with makeresults command for generating 60 rows for last 60 seconds.
index=_internal log_level="INFO" earliest=-60s latest=now
| timechart span=1s count
| fillnull value=0
| append
[| makeresults count=60
| eval count=1
| accum count
| eval _time=_time-count
| eval count=0]
| dedup _time
@ashish198511 if you intend is to show a timechart of all 0 count in case search returns No Results, instead of showing the No Results Found message, you can use the following append logic with gentimes (similar logic can be built with makeresults command as well). The append logic creates a timechart of 0 values and performs a final dedup to keep count from original timechart command if it exists.
Following run anywhere example is based on Splunk's _internal index. Change the log_level from ERROR to FATAL (which rarely happens) and you will see that you get timechart of all 0 count instead of No Results Found.
index=_internal log_level="ERROR" earliest=-2d@d latest=now
| timechart span=1d count
| fillnull value=0
| append
[| gentimes start=-2 end=+1 increment=1d
| fields starttime
| eval _time=starttime,count=0
| fields _time count]
| fields - starttime
| dedup _time
Other alternative would be to build two panels with depends and rejects based on $job.resultCount$ and show only the panel with gentimes kind of logic above to show 0 count. The depends/rejects logic for No Results has been called out in Splunk Document as well as several questions here on Splunk Answers if you are interested in this approach.
... View more
