Check out Layout Customization: Panel Width in Splunk 6.x Dashboard Examples App. This example is to set you get started with use of CSS and JavaScript to control various panel width, like 20%, 20% and 60% distribution of a row between three panels. ... View more

Was the field alias for TransType? ... View more

Yes that is what I mentioned. Calculated Field should be working fine as per the case statement you have provided. Since it is not working for you please ensure that conditions in bold are met. Like Trans Type field should not be a part of Lookup table etc. ... View more

Provided EVAL is lower case in the search string above search should work. Neverthless, Calculated Field will not have eval keyword anyways. Since case statement seems to be correct for Calculated Field, following are the things you need to validate again: 1) Calculated field is applied on correct app and sourcetype. 2) Calculated field has correct permissions. 3) Since 'Trans Type' field on which eval seems to have a space, I am skeptical whther it is extracted prior to application of Calculated Field or not. Due to search type operations sequence, Calculated fields can not be applied on a) Lookups b) Event Types c) Tags Refer to following Splunk documentations on Calculated Fields and Search Time operation sequence: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence ... View more

If you want to implement Status Indicator query should have field value for color (ex: range_color below ) and icon (ex: range_icon below ) both. index=network sourcetype=juniper host=RouterA AND ospf_interface="ge-0/0/0.0" | RPD_OSPF_NBR* "Full to Down" | dedup ospf_interface | stats count as status | rangemap field=status green=0-0 red=1-1 default=low|eval range_color=range | rangemap field=status arrow-circle-o-up=0-0 arrow-circle-o-down=1-1 default=arrow-circle-o-up | eval range_icon=range | eval status=case(status== 1, "Down", "Down", 1==1,"OK") | table status , range_icon, range_color Also in dashboard you would need following options set for using color, filling background, using field value for color and field value for icon respectively: <option name="status_indicator_app.status_indicator.useColors">true</option> <option name="status_indicator_app.status_indicator.fillTarget">background</option> <option name="status_indicator_app.status_indicator.colorBy">field_value</option> <option name="status_indicator_app.status_indicator.icon">field_value</option> Hope this work. let me know otherwise. PS: I have taken out value 2 for simplicity. ... View more

Sure. Status Indicator works fine. However, HTML dashabord allows you to build UI the way you want and place icons/values anywhere (not restricted to panels and rows :)) ... View more

If you want to use job.resultCount you can change the search query to perform | search=QTD=1 in the end. That way job.resultCount will be >0 only when QTD is one. But this implies you need to have one base search with several post process queries like QTD=1, QTD=2. Which is not feasible for most scenarios and is a performance bottleneck. This was the problem I was actually working on and solved myself. Please refer to the following answer thread and vote if it works for you as well. HINT : I used eval to match to set tokens instead of condition. However, job.resultCount will still be required becase eval will not work when there are no results and default values would still need to be set. https://answers.splunk.com/answers/464037/how-to-change-image-dynamically-based-on-search-re.html ... View more

Just to be sure that email exchange is setup and Splunk is able to send emails, have you tested any existing Dashabord/Report for scheduled PDF delivery by email Export > Schedule PDF Delivery > Check the Schedule PDF check box and after filling Email To, click Send Test Email at the bottom. If the email delivers fine it implies email exchange on Splunk server is setup properly and is not blocked by network. If you feel your cron schedule has issue, you can test your cron expressions through online utility. Cron expression provided bby cmerriman is correct i.e. 0 */12 * * * runs every 12 hours. ... View more

Can you tell whether the Pie chart loads with first set of colors and then changes or not? Refer to charting.legend.masterLegend property so that it disables legend color synchronization with other dashabord panels. That way pie chart colors might not get overridden from those defined in charting.fieldColors and charting.seriesColors. Code snippet of all chart options would be useful to assist. ... View more

Can you share the chart options code for both Line Chart and Pie Chart? Also try changing from Red Green to some other colors like brown purple for both charting.fieldColors and charting.seriesColors for both the charts. ... View more

Try the following: (index="first" sourcetype="anysourcetype") OR (index="second" sourcetype="otherstr") | stats count as count1 by FIELD1 | appendcols [search index="second" sourcetype="otherstr"| stats count as count2 by FIELD1]| eval Difference=count1-count2 ... View more

While this is separate than the original issue posted. I think you are looking for charting.chart.showLabels and not legends. Please check and confirm. ... View more

Alternatively you can also create a separate alert with the following alert condition: Trigger Alert when : Number of results is equal to : 0 ... View more

Lookup files serve as a table with foreign key which can be joined via Splunk search over a particular index. Like any relational DB joins you will have to ensure that the field name from SPL Search matches that present in the lookup table (you can easily perform this by eval or rename). For example if you have lookup file added statscode.csv and you created a lookup field statscode, you can try the following: 1) Run following to see content of lookup file(also ensure that it is correct and accessible) |inputlookup statscode 2) Run the Splunk search on index (assuming field1 and field3 are the fields from index being searched). Rename field3 as field2 (assuming field2 is present in lookup table) and join to lookup table statscode field2 through lookup command. index="foo" sourcetype="bar" field1="Yes"| eval field2=field3 | lookup statscode field2 | table field1, field2, field3 .... Splunk Search reference will be a good place to read and try out some examples: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup Geostats table example in Splunk 6.x Dashboard Examples app also uses a lookup table to map States to their geocoodinates (present in the lookup table). ... View more

Option 1 Step 1: Run search index="first" sourcetype="anysourcetype" and save as Event Type "firstany". Step 2: Run search index="second" sourcetype="othersrt" and save as Event Type "secondother" Step 3: Run the following search query (eventtype="firstany" ) OR (eventtype="secondother") | chart count over FIELD1 by eventtype | eval difference=firstany-secondother Also refer to previous answer on similar lines as this seems to be a duplicate thread. https://answers.splunk.com/answers/470876/how-to-calculate-the-difference-between-count-of-t.html#answer-469923 Option 2 (index="first" sourcetype="anysourcetype") OR (index="second" sourcetype="otherstr") | eval statsfield= FIELD1 + " - " + index + " - " + sourcetype | stats count by statsfield | delta count as Difference Please let me know if this is not what you are looking for, so that I may assist. ... View more

Since we are using rangemap in SPL to compute color ranges, we have to ensure that we don't try to use Single Value panel's Color by value option. In order to ensure the same either Option 1) Delete and add the Single Value panel again through search or Option 2) Edit the Simple XML of dashboard and set <option name="useColors">0</option> Hope this helps! Let me know otherwise. ... View more

Can you please check the system from where performance counters are being forwarded? Using start > run > perfmon, whether RPC_HTTP_PROXY is available counter on the machine or not. If it is, and you have a non prod system with similar configuration see if you can install Splunk and use Add Data > Local Performance Monitor and check whether the same performance counter is listed in splunk or not. You can also try keeping only above performance counter forwarding in inputs.conf and restart splunk. Validate the splunkd logs for above performance counter, whether there is any error logged or not. ... View more

This is Simple XML example, so it does not require you to add additional css/js ot HTML code. You can refer to Splunk 6.x Dashboard Examples app for details. Just edit source of your existing code and place job.resultCount related code in Chart <title> , <search><progress> and <search><cancelled>. The progress event sets the token sourcetype_count (could be any variable name). Cancelled event resets the token and Title section uses the token. (It is not that tough as it seems :)) PS: Splunk itself uses the same variable for knowing whether Search returned result or not. For example N/A being displayed when search returns not result. Other options if you do not want to use job.resultCount would be 1) Use accum : ... |eval sno=0 | sno=sno+1 | accum sno| ... 2) Enable Row Number: Edit Panel, Choose Edit Table option and Under General settings set Row Numbers as Yes. ... View more

Based on the above search you might not need join for the second search. See if following query helps: (index="first" sourcetype="data_sourcetype" ) OR (index="second" sourcetype="datatype2") | stats count as count1 | appendcols [search index="first" sourcetype="type1"| stats count as count2]| eval difference=count1-count2| table count1, count2, difference You can also save index AND sourcetype searches as three different eventtypes and then use stats count by eventtype as your query. accum and delta can be used on different rows of search results by eventtype. ... View more

I have edited my answer, you can try using $job.resultCount$ and print anywhere in the panel you like. In Splunk 6.x Dashaborad Examples code, it has been added as Panel Title. Please check and see if it solves your problem. ... View more

Oh I now understand. You might have to use $job.resultCount$ property for **** event and then assign it to a token to be used later in your Panel as HTML. Check Search Result Setter in Splunk 6.x Dashboard Examples <chart> <title>Top sourcetypes ($sourcetype_count$ total sourcetypes)</title> <search> <query>index=_internal | top sourcetype</query> <earliest>-60m</earliest> <latest>now</latest> <!-- Use the following search events to access job properties, and set tokens that can be accessible throughout the page --> <!-- Progress event has access to job properties only (not first result row) --> <progress> <set token="sourcetype_count">$job.resultCount$</set> </progress> <cancelled> <unset token="sourcetype_count"></unset> </cancelled> </search> <option name="charting.chart">bar</option> <option name="charting.legend.placement">none</option> </chart> ... View more