Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2452 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
- Got Karma for Re: show/where the result from count when result is odd or even number. 11-07-2024 06:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
09-20-2020
10:45 AM
1 Karma
@mbasharat what do you mean by limiting the number of values? Are values some type of delimited strings? Or are they based on length?
... View more
09-20-2020
10:38 AM
2 Karma
@alwayslearning you are possibly looking for the following JS. I would recommend you to search in the Splunk Web Reference Documentation on Splunk Dev site for each of the SplunkJS stack elements mentioned in the code to understand them better. require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
], function (_, $, mvc) {
// Iitialize Default and Submitted Token Model.
var defaultTokenModel = mvc.Components.get("default");
var submittedTokenModel = mvc.Components.get("submitted");
// #html_ta_user_comment button Clicked
$(document).on("click", "input#html_ta_user_comment", function (e) {
// Capture value of the Text Area
var str_ta_investigateoutcome = $("textarea#ta_investigateoutcome").val();
// If text area value is not null or empty then set token $investigateoutcome$ value
if(str_ta_investigateoutcome!== undefined && str_ta_investigateoutcome!==""){
// Default Token Model update For token value in UI
defaultTokenModel.set("investigateoutcome", str_ta_investigateoutcome);
// Submitted Token Model update For running searches on Dashboard with Submit Button.
submittedTokenModel.set("investigateoutcome", str_ta_investigateoutcome);
}else{
// If Text Area is not populated before clicking on the #html_ta_user_comment button pop-up alert!
alert("Please add comment before submitting!");
}
});
});
... View more
09-18-2020
07:39 AM
@nv @logloganathan Which Add On are you using If you are using Splunk Add-on for Okta , it was last updated in 2016 and is no longer Splunk Supported as Okta has created its own app and continues to update it. Refer to the following blog https://www.splunk.com/en_us/blog/tips-and-tricks/end-of-availability-splunk-built-apps-and-add-ons.html and try out Okta Identity Cloud Add-on for Splunk
... View more
09-17-2020
03:57 AM
1 Karma
@ravicheepa87 you will have to analyze and understand your data. If you Date field in the event should be time of the event and not the index time, then you need to handle that in Timestamp extraction. Following is the Splunk Documentation that you can refer: https://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition Also if the event format and fields are the same across the three different sources you can create a single sourcetype which will identify timestamp, fields and events properly. Which in turn will allow pull data from various indexes (or same index depending on retention, security and volume), based on the sourcetype. If you can provide some sample events from the three sources, after masking/anonymizing any sensitive information, the community can assist you better with these configurations that will improve search performance and will be better for long run.
... View more
09-17-2020
03:20 AM
@seva98 refer to one of the older answers https://community.splunk.com/t5/Archive/How-to-retrieve-more-than-100-record-in-searchmanager/td-p/166454
... View more
09-15-2020
11:23 PM
Can you add your current SPL? Are the fields in the question generated by SPL or available in your raw data!
... View more
09-15-2020
11:21 PM
@bowesmana glad you found it helpful. Be careful for filtering actual unescaped html elements be used directly as code in backend as it may open up for injection attacks. That is what by default tokens do (convert to string vaule rather than HTML elements). So best use case is when you know which html tags to be applied from the token and process only those through JS. Similar to what I have done for this answer. #br/# converts to <br/>, but any other html element will convert to text (not HTML).
... View more
09-15-2020
12:52 PM
@swastikm123 best would be to open a support ticket and work with the Support team by providing them with required details. Seems like your SPL is very expensive or pulls a lot of data. Have you checked dispatch directory size and usage, search logs, failure details?
... View more
09-15-2020
12:30 PM
1 Karma
@marycordova Try the following. The UI SPL adds a delimeter #br# that gets converted in JS as <br/> Following is the Simple XML Dashboard code: <dashboard script="convert_token_to_html.js">
<label>Risk Value to HTML</label>
<row>
<panel>
<table>
<search>
<done>
<set token="tokRiskHTML">$result.riskHTML|h$</set>
</done>
<query>| makeresults
| fields - _time
| eval risk="Risk thing 1 0.06 > population (standard deviation 0.02 + average 0.04);Risk thing 2 0.74 > population (standard deviation 0.21 + average 0.30);Risk thing 3 0.90 > population (standard deviation 0.20 + average 0.65)"
| makemv risk delim=";"
| eval riskHTML=mvjoin(risk,"#br#")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
<panel>
<html>
<div id="htmlPanelWithToken">
</div>
</html>
</panel>
</row>
</dashboard> Following is the required JS convert_token_to_html.js require([
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
], function($, mvc,) {
var submittedTokens = mvc.Components.get('submitted');
// Listen for a change to the token tokHTML value
submittedTokens.on("change:tokRiskHTML", function(model, tokRiskHTML, options) {
var tokRiskHTMLJS=submittedTokens.get("tokRiskHTML");
if (tokRiskHTMLJS!==undefined)
{
tokRiskHTMLJS=tokRiskHTMLJS.replaceAll("#br#","<br/>");
$("#htmlPanelWithToken").html(tokRiskHTMLJS);
}
});
}); PS: You may notice that in the UI, I have used html escaping for the token using $result.riskHTML|h$ which ensures that HTML elements are not passed as token value. The break line element <br/> is added directly through JS code. Please try and confirm!
... View more
09-15-2020
10:17 AM
Option 1. Go by data-cid which will be unique. This should be easiest thing to try. You can find this attribute even in the screenshot you have provided for div with data-view="views/shared/results_table/ResultsTableMaster". So you need to pull div#statistics[data-view="views/shared/results_table/ResultsTableMaster"][data-cid] which is unique. Option 2. Nested selector means in your case try with #element1 div#statistics[data-view="views/shared/results_table/ResultsTableMaster"], #element2 div#statistics[data-view="views/shared/results_table/ResultsTableMaster"] etc. which will be unique. Chrome Browser inspector does something similar. This would require change in your accessibility checker. Option 3. Simple XML JS Extension requires an iterator to identify div#statistics[data-view="views/shared/results_table/ResultsTableMaster"] nodes in the dashboard and for each node suffix and incremental id to existing i.e. statistics becomes statistics1, statistics2, statistics3 through jQuery code. I feel this is purely jQuery question which you should be able to figure out through google search if you do not have jQuery background. Following is a JS example which does this 5 seconds after dashboard loads. You can change to a different event based on your need (like click of a button, or completion of most expensive query on Dashboard etc). Currently it just adds incremental IDs similar to how Splunk adds element1, element2 etc. You can change as per your need. I have added alert() and console.log() for debugging purpose. You can remove after test. require([
'jquery',
'splunkjs/mvc/simplexml/ready!'
], function ($) {
console.log("Inside statistics id node update!");
var id = 1;
$(document).ready(function() {
setTimeout(function(){
$('div#statistics[data-view="views/shared/results_table/ResultsTableMaster"]').each(function () {
jQuery(this).attr("id", "statistics" + id);
id++;
});
alert("Statistics Node IDs updated");
},5000);
});
}); PS: What if tables on Dashboard are loaded based on depends/rejects? Following is my test dashboard with two Tables and DOM source after the update from JS. PS: I have highlighted node elements for all three options for your reference. Please try out and confirm if any of the options work for you!
... View more
09-15-2020
10:14 AM
1 Karma
@marycordova are you trying to do something like the use case in the following Answer of mine? https://community.splunk.com/t5/Dashboards-Visualizations/Render-HTML-code-from-search-result-in-Splunk-dashboard/m-p/221935I am not sure of the use case. Do you want to shorten the length of token?Once you do that what is the use of token. Here is another answer with Table with multi-values which formats as Tile using CSS, in case you just want to format table as Tile using HTML, this would be better approach. https://community.splunk.com/t5/Dashboards-Visualizations/Is-there-a-way-to-display-more-than-20-charts-at-a-time-using/m-p/298526 Even if the above two do not fall into your use case, I think I would be able to help. However, I need to to know what is your use case. Table with Multivalue needs to be passed to a token, then what do you plan to do with the token! @bowesmana check Answer 1 if you want to render HTML content from Search result as html panel.
... View more
09-14-2020
10:19 AM
1 Karma
@hariram159 The solution is based on panel not viz. If you notice closely it is based on Panel IDs. Also if you have some hurdles with Splunk Admin uploading the CSS file, the Simple XML CSS extension can remain within Dashboard code as provided in the example. However, if you would want to make CSS re-usable you will have to consider Pre-Built Panel or else moving to a CSS Stylesheet in the appserver/static folder. What difference do you want to achieve with Pixel and not %? Is the width of Browser/Display always fixed for you and you want the three panels to consume specific width no matter what is the total width of the browser/display? In either, case you can change from percent to Pixels (px) and it should still work the way CSS style overrides are supposed to. If you are new to Simple XML CSS extension in Splunk or CSS itself read the following excellent Clara-fication blog by @cmerriman https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-clara-fication-customizing-simplexml-dashboards-with-inline-css.html
... View more
09-14-2020
09:36 AM
@spkriyaz refer to one of the issues mentioned for Splunk 6.6+ which required in lag for table rendered function call: https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Dashboard-Examples-Table-Row-highlighting-bug/td-p/342612 You would need to add a small setTimeout() for the tableView.on('rendered', function() { , function call. Please try out and confirm!
... View more
09-14-2020
09:33 AM
@ScottSusman you are possibly looking for Location Tracker Custom Visualization or may be Map + for Splunk
... View more
09-14-2020
09:28 AM
@aamirs291 even if we create panels, tables, search or any other dashboard element without providing our own IDs they are usually provided incremental IDs, i.e. tables will have ids table1, table2, table3 and so on. Option 1: Although statistics id has been created without using unique id, would it be possible to use nested id i.e. table#table1 div#statistics, table#table2 div#statistics and table#table3 div#statistics etc? Option 2: If not your option would be to use jQuery and update all statistics nodes on dashboard load. Option 3: If not either one, submit an idea on ideas.splunk.com.
... View more
09-14-2020
09:15 AM
@nagar57 This is because Highcharts tries to adjust Dynamically based height (even width) of the chart and amount of data label to show on the axis. In your case you have Legends on top and X-axis label on the bottom Both reduce the height of the chart. On top of this if you reduce panel height using Simple XML height option then also you will see lesser Data Labels on y-axis. Refer to the following two examples through a run anywhere dashboard example and you will realize the issue and fix. Following is the Simple XML code for run anywhere example screenshot above. PS: First chart is also using seriesCompare for legend on right. <dashboard>
<label>Series with Percent</label>
<row>
<panel>
<chart>
<search>
<query>| makeresults count=30
| eval span=300
| accum span
| eval _time=_time-span
| fields - span
| eval series1=substr(tostring(random()),1,2), series2=substr(tostring(random()),1,2), series3=substr(tostring(random()),1,2)
| bin _time span=5min
| stats last(*) as * by _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisLabelsY.majorUnit">25</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.maximumNumber">100</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">seriesCompare</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart>
<search>
<query>| makeresults count=30
| eval span=300
| accum span
| eval _time=_time-span
| fields - span
| eval series1=substr(tostring(random()),1,2), series2=substr(tostring(random()),1,2), series3=substr(tostring(random()),1,2)
| bin _time span=5min
| stats last(*) as * by _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisLabelsY.majorUnit">25</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.maximumNumber">100</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">top</option>
<option name="charting.lineWidth">2</option>
<option name="height">194</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</dashboard>
... View more
09-14-2020
08:05 AM
1 Karma
@yvassilyeva thanks for adding the details. I wished you mentioned in your question and your SPL could have been easier... Do read the foreach command Splunk Documentation if the interpretation of the template is not clear. It has solid examples and that is where I learnt these from. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Foreach | foreach "Com-*"
[| eval "Sum-<<MATCHSTR>>"='Tar-<<MATCHSTR>>'+'<<FIELD>>'] Following is a run anywhere search based on sample data provided so that you can play around yourself. | makeresults
| eval data="3,3,1,2,5,7;1,1,3,2,5,3"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval Com-Jun=mvindex(data,0),Com-Jul=mvindex(data,1),Com-Aug=mvindex(data,2),Tar-Jun=mvindex(data,3),Tar-Jul=mvindex(data,4),Tar-Aug=mvindex(data,5)
| table *Jun, *Jul, *Aug
| foreach "Com-*"
[| eval "Sum-<<MATCHSTR>>"='Tar-<<MATCHSTR>>'+'<<FIELD>>']
| fields Com-* Tar-* Sum-*
... View more
09-14-2020
07:33 AM
@aamirs291 for the community to assist you better please add more context to your question. What is your use case/problem statement that you are trying to solve? Why do you want that section unique? Where are you trying to access the above ID CSS override or JS extension?
... View more
09-14-2020
07:30 AM
1 Karma
@dkgs seems like your series is split by AlertStatus as a field similar to | timechart count by AlertStatus. You can try click.name2 to pull the AlertStatus name and click.value2 to pull that particular AlertStatus value. Please add the code as suggested earlier to set the required token in the <drilldown> section of the chart and use the token in the drilldown search.
... View more
09-14-2020
07:27 AM
@yvassilyeva please add the following to your existing search and it should do a template foreach for all months <yourCurrentSearch>
| foreach Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Sep,Oct,Nov,Dec [| eval "Sum-<<FIELD>>"='<<FIELD>>'+'Com-<<FIELD>>'] Also more specific answer can be provided based on whether your SPL is calculating these columns or do these exist in your event.
... View more
09-14-2020
05:28 AM
@spkriyaz if you have used CSS before each DOM element is supposed to have a unique ID. Hope you are not using id as a class which is generic. Also, since it is ID you can have only one. If you already have table id="highlight" and are sure you have no other table with the same ID and do not want similar CSS applied to any other table in the dashboard, you can #tableColumnWidth with #highlight in the CSS override and it should work. No need to change any of your existing XML. Please try out and confirm. I would recommend going through the Clara-fication Blog to get references for CSS and understanding how to use CSS overrides in Splunk Simple XML Dashboards: https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-clara-fication-customizing-simplexml-dashboards-with-inline-css.html
... View more
09-14-2020
05:07 AM
1 Karma
@dkgs For the community to assist you better, can you add Simple XML dashboard code (specially the one that is populating your chart)? Adding a screenshot means Community experts who try to assist you will have to type it themselves to prototype or give you an example as you requested (unless you are fine with any run anywhere example portraying your scenario). Please add more details to your actual issue. If you want the role in the dropdown you will first have to create a drilldown token for role from your chart panel. Which you do not have currently. Based on your current chart screenshot, you need one of the following: Option 1: If you want Generic drilldown token to pull the role name which has been clicked (if you have many dynamic roles): <set token="role">$click.name2$</set> Option 2: If you need specific drilldown in case of fixed and handful of roles, but based on click want to pull all roles at a particular time: <set token="role_NO_RISK">$row.NO_RISK$</set>
<set token="role_YOUR_2ND_ROLE">$row.YOUR_2ND_ROLE$</set>
...
... On a different note, seems like your SPL needs several changes for performance tuning. For example you can have either KV_MODE=json or INDEXED_EXTRACTION=json and avoid spath (depending on use case). You need to filter results upfront rather than later in the query! Refer to documentation to understand these better: https://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization
... View more
09-14-2020
04:49 AM
@spkriyaz try something like the following where table has id="tableColumnWidth". If you want to understand Simple XML CSS extension better, refer to the following Clara-fication blog by @cmerriman https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-clara-fication-customizing-simplexml-dashboards-with-inline-css.html (PS: The following is demo code hence CSS has been added directly in Simple XML dashboard, you should ideally move this to your App level CSS static file and reference the stylesheet in your dashboard/s for re-usability, app level consistent style and avoiding duplicate/redundant styling). <row>
<panel>
<html depends="$alwaysHideCSSPanel$">
<style>
#tableColumWidth table thead tr th:nth-child(4),
#tableColumWidth table thead tr th:nth-child(5){
width: 10% !important;
overflow-wrap: anywhere !important;
}
</style>
</html>
<table id="tableColumWidth">
...
...
...
... View more
09-14-2020
04:12 AM
@divya1388 Following is one of the options you can use (This uses only Simple XML CSS Extension, but JS Extension can also allow you to do something similar with more control via JS). It uses Link Input as a Submit Button so that only if form token from Link Submit button is set the searches execute. PS: The reason why current design with Submit button many not work directly is because Submit button does not add any additional token dependency, it merely pushes token from Default Token Model to Submitted (in simple words tokens from UI elements to Search Managers). This is oversimplified statement, in case you want to understand better refer to couple of my older answers (PS: This may give you insight into why Submit button may not work for you directly, unless you use Simple JS Extension, my solution approach is to circumvent this caveat!) https://community.splunk.com/t5/Archive/What-is-the-expected-behavior-for-Submit-button-when-inputs-have/td-p/398397 https://community.splunk.com/t5/Dashboards-Visualizations/searchWhenChanged-false-not-honored/m-p/430993 Following is the design consideration: Add a Link Input as Submit button. Add change event handler to rest the Submit button form token and set a token to Run required searches and/or Show required UI element/s. On change of each of form inputs like Time input and Dropdown unset the search token so that Link Submit button needs to be clicked again. Apply CSS extension to make Link Input appear like Button. Since Submit button token itself is converted to a form token. If you do not pass the token from your source dashboard then destination dashboard will wait for Submit button to be clicked. Added bonus is that in case you have a dashboard from where you want to allow auto-submission of destination dashboard, you can do that as well by passing the Submit link input token along with other required tokens. If that makes sense. Following is a run anywhere example that you can try. Without Submit button click, the search does not run even with time and log_level inputs populated Without click of Submit Button Search does not run, even with Form inputs i.e. time and log level populated After Submit button click, searches run. After Submit, the searches run. Following is run anywhere Simple XML code for screenshots above: <form>
<label>Form Input with Submit</label>
<fieldset submitButton="false">
<input type="time" token="time" searchWhenChanged="true">
<label>Select Time</label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
<!-- When input changes reset the token runSearch to force Submit button click input required from user -->
<change>
<unset token="runSearch"></unset>
</change>
</input>
<input type="dropdown" token="log_level" searchWhenChanged="true">
<label>log_level</label>
<choice value="INFO">INFO</choice>
<choice value="ERROR">ERROR</choice>
<choice value="WARN">WARN</choice>
<!-- When input changes reset the token runSearch to force Submit button click input required from user -->
<change>
<unset token="runSearch"></unset>
</change>
<default>ERROR</default>
</input>
<input id="linkSubmit" type="link" token="submit" searchWhenChanged="true">
<label></label>
<choice value="submit">Submit</choice>
<change>
<!-- Submit Button using Link Input. runSearch is set only on clicking Submit Button. -->
<condition value="submit">
<set token="runSearch">true</set>
<unset token="form.submit">true</unset>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<html>
<div>Use Link Input as Submit button to wait for Search to run until Submit is clicked!</div>
<style>
#linkSubmit[data-view="views/dashboard/form/Input"]{
width: 100px !important;
}
#linkSubmit button[value="submit"]{
background-repeat: repeat-x;
background-color: #65a637;
color: #fff;
text-shadow: none;
text-decoration: none;
border-radius: 4px;
}
#linkSubmit button[value="submit"].active{
background-color: rgba(0,0,0,.05) !important;
text-decoration: none !important;
color: #999 !important;
border-radius: 4px !important;
}
</style>
</html>
</panel>
</row>
<row depends="$runSearch$">
<panel>
<table>
<search depends="$runSearch$">
<query>index=_internal sourcetype=splunkd log_level="$log_level$"
| stats latest(_time) as _time latest(event_message) as "Latest Message" count as "Event Count" by component
| eval "Latest Message"=strftime(_time,"%Y/%m-%d %H:%M:%S.%3N")." - ".'Latest Message'
| fields - _time
| sort - "Event Count"</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="count">5</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form> Please try out and confirm.
... View more
09-13-2020
01:28 AM
@vvemula based on your question seems like you are interested in delta for each time duration i.e 0-30 days 30-60 days and 60-90 days. Following is a run anywhere search based on Splunk's _internal index which splunkd errors for last 7 days as 0-1 day, 1-3 days and 3-7 days broken down by various components. [Optional only for demo use case]... it retains only top 5 components as per total errors. index="_internal" sourcetype="splunkd" log_level!="INFO" earliest="-7d" latest=now
| stats count as Total count(eval(_time>relative_time(now(),"-1d@d") AND _time<=now())) as "0-1 day"
count(eval(_time>relative_time(now(),"-3d@d") AND _time<=relative_time(now(),"-1d@d-1s"))) as "1-3 days"
count(eval(_time>relative_time(now(),"-7d@d") AND _time<=relative_time(now(),"-3d@d-1s"))) as "3-7 days" by component
| sort - Total
| head 5
| fields component * Total You can adjust as per your needs, data and field names. Please try out and confirm!
... View more
