Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 4 weeks ago
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
08-30-2020
01:45 PM
@sarit_s within an input <change> event handler the selected value should be accessed via built-in predefined token $value$ Please retry after changing the token $lsap_token$ with $value$ in the condition block of change event handler of the input. <input type="text" token="lsap_token" searchWhenChanged="true">
<label>lsap</label>
<default>*</default>
<change>
<condition match="$value$ == "BCG29"">
<set token="limit_token">""</set>
</condition>
<condition match="$value$ == "COL41"">
<set token="limit_token">"127.0.0.1 tomcat: Starting dataload"</set>
</condition>
</change>
</input> PS: If there are no condition match default value *, I dont understand setting that as the default value for the text box. Also if there are only two condition blocks you can use a dropdown or radio (unless you are sampling few for simplicity)
... View more
08-30-2020
01:35 PM
@treverce for the community to assist you better you will need to provide more context as to what is the token name and value being passed from source to destination dashboard. What is the configuration of input field in the destination dashboard. With some sample data what is happening right now vs what is expected.
... View more
08-30-2020
01:31 PM
@CarbonCriterium hope you are looking for the following SPL. If not please add some sample data and a screenshot of what it looks like right now and how it should appear. | stats count(eval(status!=200)) as Error avg(eval(time_taken)) AS avg_tt, avg(eval(sc_bytes)) AS avg_bytes, count(eval(source)) AS NumTransactions, BY cs_uri_stem
| eval status=if(Error=0,"200","!=200")
| fields cs_uri_stem, status, avg_tt, avg_bytes, NumTransactions
| rename avg_bytes AS "Average Bytes Returned" avg_tt AS "Average Time in Milliseconds" NumTransactions AS "# of Transactions" Following is a run anywhere example based on Splunk's _internal access index with data similar to yours. <dashboard theme="dark">
<label>Bubble Chart with Bubbles Based on Status</label>
<row>
<panel>
<chart>
<search>
<query>index = _internal sourcetype=splunkd_access
| eval status=if(random()%2==0,200,400)
| stats count(eval(status!=200)) as Error count sum(bytes) as "Total Bytes" by uri_path, date_hour
| eval status=if(Error=0,"200","!=200")
| fields uri_path status date_hour count "Total Bytes"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bubble</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{"200":"#53A051","!=200":"#DC4E41"}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</dashboard>
... View more
08-30-2020
01:01 PM
@irvindominguezs for the community to assist you better please provide relevant details as well. With your current code what is the issue you are facing? For the dropdown search SPL, what is the exact filter that should be passed as token? Add some sample data and example of the use by anonymizing any sensitive information. As per the code, if Multiselect has 3 proxy values selected proxy1, proxy2 and proxy3, then the dropdown SPL will have value like the following in the SPL headers.apiproxy="proxy1" OR headers.apiproxy="proxy2" OR headers.apiproxy="proxy3". What is the expected value, if not this? index=apigee sourcetype=apigee_metrics headers.apiproxy="proxy1" OR headers.apiproxy="proxy2" OR headers.apiproxy="proxy3"
... View more
08-30-2020
12:46 PM
1 Karma
@welderbuilder based on the details provided, you can use Simple XML CSS extension to style as per your need. If you are not using Link input for any drilldown, you can use html panel instead for similar results. Refer to Splunk Dashboard Examples App for Custom Decorations using html panel (on similar lines, you can also use Image Overlay with Single Value for better data representation). Following is Simple XML code with the run anywhere example as per the question and two options to get to desired results: <form theme="dark">
<label>Input Status Side By Side</label>
<fieldset submitButton="false"></fieldset>
<row depends="$alwaysHideCSSPanel$">
<panel>
<html>
<style>
div[id^="panelLabelCheck"]{
height: 50px !important;
width: 20% !important;
}
div[id^="panelLabelCheck"] .dashboard-panel,
div[id^="panelStatusCheck"] .dashboard-panel{
margin-bottom: 0px !important;
}
div[id^="panelLabelCheck"] .dashboard-panel{
margin-right: 0px !important;
}
div[id^="panelStatusCheck"]{
width: 80% !important;
}
div[data-view="views/dashboard/form/Input"] label,
div[data-view="views/dashboard/form/Input"] .splunk-choice-input-message{
display:none !important;
}
div[id^="panelLabelCheck"] .dashboard-panel,
div[id^="panelStatusCheck"] .ui-resizable,
div[id^="panelStatusCheck"] .dashboard-panel{
height: 50px !important;
min-height: 50px !important;
}
div[id^="panelStatusCheck"] .ui-resizable-handle{
visibility: hidden !important;
}
div.splunk-status-indicator {
display: flex !important;
}
div.splunk-status-indicator i{
padding-top: 5px !important;
padding-left: 20px !important;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<html>
<h3 style="text-align:center">Option 1: Status Indicator</h3>
</html>
</panel>
</row>
<row>
<panel id="panelLabelCheck1">
<input type="link" token="tokCheck1" searchWhenChanged="true">
<label></label>
<choice value="check1">Check1</choice>
</input>
</panel>
<panel id="panelStatusCheck1">
<viz type="status_indicator_app.status_indicator">
<search>
<query>| makeresults
| fields - _time
| eval status="Green", color="green", icon="exclamation-circle"
| table status icon color</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<!-- Set tokens for HTML panel from Status Check 1 Search -->
<done>
<set token="tokStatus1">$result.status$</set>
<set token="tokColor1">$result.color$</set>
</done>
</search>
<option name="drilldown">none</option>
<option name="height">50</option>
<option name="refresh.display">progressbar</option>
<option name="status_indicator_app.status_indicator.colorBy">field_value</option>
<option name="status_indicator_app.status_indicator.fillTarget">text</option>
<option name="status_indicator_app.status_indicator.fixIcon">info-circle</option>
<option name="status_indicator_app.status_indicator.icon">field_value</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">1</option>
<option name="status_indicator_app.status_indicator.staticColor">#555</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
<row>
<panel id="panelLabelCheck2">
<input type="link" token="tokCheck1" searchWhenChanged="true">
<label></label>
<choice value="check1">Check2</choice>
</input>
</panel>
<panel id="panelStatusCheck2">
<viz type="status_indicator_app.status_indicator">
<search>
<query>| makeresults
| fields - _time
| eval status="Green", color="green", icon="exclamation-circle"
| table status icon color</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<!-- Set tokens for HTML panel from Status Check 2 Search -->
<done>
<set token="tokStatus2">$result.status$</set>
<set token="tokColor2">$result.color$</set>
</done>
</search>
<option name="drilldown">none</option>
<option name="height">50</option>
<option name="refresh.display">progressbar</option>
<option name="status_indicator_app.status_indicator.colorBy">field_value</option>
<option name="status_indicator_app.status_indicator.fillTarget">text</option>
<option name="status_indicator_app.status_indicator.fixIcon">check</option>
<option name="status_indicator_app.status_indicator.icon">field_value</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">1</option>
<option name="status_indicator_app.status_indicator.staticColor">#555</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
<row>
<panel id="panelLabelCheck3">
<input type="link" token="tokCheck1" searchWhenChanged="true">
<label></label>
<choice value="check1">Check3</choice>
</input>
</panel>
<panel id="panelStatusCheck3">
<viz type="status_indicator_app.status_indicator">
<search>
<query>| makeresults
| fields - _time
| eval status="Red", color="red", icon="exclamation-circle"
| table status icon color</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<!-- Set tokens for HTML panel from Status Check 3 Search -->
<done>
<set token="tokStatus3">$result.status$</set>
<set token="tokColor3">$result.color$</set>
</done>
</search>
<option name="drilldown">none</option>
<option name="height">50</option>
<option name="refresh.display">progressbar</option>
<option name="status_indicator_app.status_indicator.colorBy">field_value</option>
<option name="status_indicator_app.status_indicator.fillTarget">text</option>
<option name="status_indicator_app.status_indicator.fixIcon">check</option>
<option name="status_indicator_app.status_indicator.icon">field_value</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">1</option>
<option name="status_indicator_app.status_indicator.staticColor">#555</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
<row>
<panel id="panelLabelCheck4">
<input type="link" token="tokCheck1" searchWhenChanged="true">
<label></label>
<choice value="check1">Check4</choice>
</input>
</panel>
<panel id="panelStatusCheck4">
<viz type="status_indicator_app.status_indicator">
<search>
<query>| makeresults
| fields - _time
| eval status="Amber", color="orange", icon="exclamation-circle"
| table status icon color</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<!-- Set tokens for HTML panel from Status Check 4 Search -->
<done>
<set token="tokStatus4">$result.status$</set>
<set token="tokColor4">$result.color$</set>
</done>
</search>
<option name="drilldown">none</option>
<option name="height">50</option>
<option name="refresh.display">progressbar</option>
<option name="status_indicator_app.status_indicator.colorBy">field_value</option>
<option name="status_indicator_app.status_indicator.fillTarget">text</option>
<option name="status_indicator_app.status_indicator.fixIcon">check</option>
<option name="status_indicator_app.status_indicator.icon">field_value</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">1</option>
<option name="status_indicator_app.status_indicator.staticColor">#555</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
<row>
<panel>
<html>
<style>
div.html-container div.html-row{
display:flex;
padding-bottom: 10px;
}
div.html-container div.html-row div.html-column-label{
position: relative;
left: 20px;
padding-right:10px;
font-size:15px;
}
div.html-container div.html-row div.html-column-status{
position: relative;
left: 20px;
font-size:33px;
font-weight:bold;
display:flex;
}
div.html-container div.html-row div.html-column-status div.html-column-status-icon{
padding-right:5px;
}
</style>
<h3 style="text-align:center">Option 2: HTML Panel</h3>
<div class="html-container">
<div class="html-row">
<div class="html-column-label">Check 1:</div>
<div class="html-column-status" style="color:$tokColor1$">
<div class="html-column-status-icon"><i class="icon-info-circle"></i></div>
<div class="html-column-status-value">$tokStatus1$</div>
</div>
</div>
<div class="html-row">
<div class="html-column-label">Check 2:</div>
<div class="html-column-status" style="color:$tokColor2$">
<div class="html-column-status-icon"><i class="icon-info-circle"></i></div>
<div class="html-column-status-value">$tokStatus2$</div>
</div>
</div>
<div class="html-row">
<div class="html-column-label">Check 3:</div>
<div class="html-column-status" style="color:$tokColor3$">
<div class="html-column-status-icon"><i class="icon-info-circle"></i></div>
<div class="html-column-status-value">$tokStatus3$</div>
</div>
</div>
<div class="html-row">
<div class="html-column-label">Check 4:</div>
<div class="html-column-status" style="color:$tokColor4$">
<div class="html-column-status-icon"><i class="icon-info-circle"></i></div>
<div class="html-column-status-value">$tokStatus4$</div>
</div>
</div>
</div>
</html>
</panel>
</row>
</form> PS: For Image Overlay with Single Value, there is also an example I have added to my Splunk Wiki Talks: https://wiki.splunk.com/User_talk:Niketnilay Refer to example below with Icons (you can obviously use Splunk's built-in icons as well).
... View more
08-30-2020
10:59 AM
1 Karma
@dkgs also do upvote the linked answers as well whichever you find useful! 😉
... View more
08-30-2020
09:53 AM
1 Karma
@ak9092 I am glad you found this helpful. For sorting just add the sort command 😉. | sort - count Do upvote the answer/comments that helped.
... View more
08-28-2020
12:56 PM
1 Karma
@isoutamo I think it can be done. I just want to be sure what is the use case here. What is environment is it a Splunk Deployment, a Splunk App or a Splunk Dashboard or it is environment data within Splunk Dashboard visualization. Details need to be added!
... View more
08-28-2020
12:22 PM
1 Karma
Try the following approach from one of my previous answers: https://community.splunk.com/t5/Security/Restrict-specific-users-to-view-only-certain-panels/td-p/297732
... View more
08-28-2020
12:16 PM
1 Karma
Is each environment represented by a different App or just Different Dashboard? If there are different Apps for different environment you should create different navigation color in navigation default.xml. Also replace the App's static Icons files. If the different Apps are represented by different dashboards, you can run an independent search to pull Environment name from the data. Set search token (either as init or independent search) to pass on the selected App name as token to apply different CSS Style override for different environment. If the environment is shown only in visualizations, depending on what you are using, you will have to configure/override viz CSS. Please add more details/data for your use case for the community to assist you better.
... View more
08-28-2020
12:09 PM
1 Karma
@ak9092 This question has definitely been answered multiple times before. But even I am having difficulty searching for my own answer. So let me documented one more time. The reason why you get only one series color for | stats count by status is that you have only one series i.e. count (also displayed in the Legend). When you use transpose you get series colors as all status values become column and hence show up in Legend. However, you loose values on x-axis because of which you can not show series names on x-axis but as Legend due to this approach. What you need to use is following kind of eval | eval {field1}=value <yourMainSearch>
| stats count by status
| eval {status}=count
| fields - count The above will create Column names as Status as well as Row Name as Status and for each column row combination populate corresponding count. The Column/Bar chart however, will not stick together as this kind of creates matrix form of data. So you would need to enable Stacked mode for the chart. Following is the Simple XML Code for Run Anywhere example which generates Status and corresponding count similar to the question (replace with your existing search). Please try out and confirm! <dashboard>
<label>Field Color for Count by Status</label>
<row>
<panel>
<chart>
<search>
<query>| makeresults
| fields - _time
| eval status="COMPLETE,PENDING,REPAIR,CANCELED,POSTED"
| makemv status delim=","
| mvexpand status
| eval count=random()
| table status count
| eval {status}=count
| fields - count</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">auto</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{"COMPLETE":#32a838,"CANCELED":#e81324,"REPAIR":#FFC200,"PENDING":#F1813F,"POSTED":#006D9C }</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="height">327</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</dashboard>
... View more
08-28-2020
10:14 AM
If this is from a field in your SPL search, then Splunk's built in Navigation xml will not work for you, as that is only based on Dashboard title. So you will have to consider second option of building your own Pre-built Panel and create your own Navigation.
... View more
08-28-2020
10:00 AM
Status Indicator is single query with Trellis Layout? Or is it <html> panel?
... View more
08-28-2020
07:01 AM
@welderbuilder Not sure what exactly is the output you need. But seems like you need CSS extension for the two panels. Here is a previous answer of mine which creates Links as Tabs and shows corresponding Status Indicators on click of various links : https://community.splunk.com/t5/Dashboards-Visualizations/How-can-we-create-Tabs-using-Link-List-in-Splunk-with-only-CSS/td-p/485176 If you need a different output, do edit the image and post as per your final requirement or any other way you want to post the mock required structure.
... View more
08-27-2020
07:59 PM
@zacksoft you can perform condition for matching dashboard based on Dashboard Label. But you can not really do it based on specific fields/data. <!-- Dynamically list all dashboards with the word "error"-->
<collection label="Dashboards (errors)">
<view source="all" match="error"/>
</collection> Could you please add more details on the following? How would you distinguish Splunk Server Name? I feel the actual step would be configuration of the dashboards myDASHBOARD_1 and myDASHBOARD_2 as readable only on Splunk server wekwyeiyu134. On other servers it should not be made accessible for any role (or for specific roles if required). <condition match = 'splunk_serv_name', wekwyeiyu134> <view name="myDASHBOARD_1 /> <view name="myDASHBOARD_2 /> </condition> If you really want to handle through Splunk Server name as condition, you may have to create your own navigation using Simple XML (possibly pre-built panel and include in all your dashboards or dashboard.js). Here is an example of building Custom Navigation through Simple XML that can be moved to Pre-built Panel: https://community.splunk.com/t5/Dashboards-Visualizations/Can-we-implement-cascading-dropdowns-in-a-dashboard/td-p/316866
... View more
08-25-2020
08:56 AM
1 Karma
You can refer to one of my previous answer on similar lines which uses Independent search as one of the option to set the required token. https://community.splunk.com/t5/Archive/Running-one-of-two-searches-based-on-time-picker-selection/td-p/364411 Following is a run anywhere example based on your question that you can try and confirm! <form>
<label>Time input tokens</label>
<fieldset submitButton="false">
<input type="time" searchWhenChanged="true" token="time_token">
<label>Time Range</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
<change>
<eval token="relstart_time"></eval>
<eval token="relend_time"></eval>
</change>
</input>
</fieldset>
<!-- Independent search to perform complex Time token conversions using SPL -->
<search>
<query>| makeresults
| addinfo
| eval info_min_time=replace(info_min_time,"\.\d+",""),
info_max_time=replace(info_max_time,"\.\d+","")
| eval startTimeDelta="-".tostring(now()-info_min_time),
endTimeDelta="-".tostring(now()-info_max_time)
| eval relstart_time=strftime(relative_time(now(),startTimeDelta),"%m/%d/%Y %T"),
relend_time=strftime(relative_time(now(),endTimeDelta),"%m/%d/%Y %T")
</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<done>
<set token="relstart_time">$result.relstart_time$</set>
<set token="relend_time">$result.relend_time$</set>
</done>
</search>
<row>
<panel>
<html>
relstart_time: $relstart_time$<br></br>
relend_time: $relend_time$
</html>
</panel>
</row>
</form>
... View more
08-25-2020
08:09 AM
@vinod0313 Can your primary table for drilldown have more than one row? If so do you want to hide the drilldown detail table only if same table row is clicked for the second time? Please add how you are setting depends token right now and how is the depends token being set right now.
... View more
08-25-2020
04:25 AM
@Ashwini008 refer to another answer by me with couple of workarounds to set the required tokens based on time input selection. One of the uses input change event handler and other one which is more dynamic uses an independent search: https://community.splunk.com/t5/Archive/Running-one-of-two-searches-based-on-time-picker-selection/td-p/364411
... View more
08-24-2020
06:31 PM
1 Karma
@welderbuilder a mock screenshot or even whiteboard diagram of what these Single Value based buttons are intended to look like and a use case description of what these buttons are supposed to perform would help us assist you better. Based on the question, instead of Single Value viz. I would recommend using Splunk Link Input instead. You can refer to one of my older answers which all use depends/rejects to show/hide certain panels and solve three different use cases. See if one of them solves your needs. 1. Link input as Button Switcher (Toggle). 2. Link Input as Tabs. 3. Link Input as Expand and Collapse panel button.
... View more
08-24-2020
11:53 AM
1 Karma
Simple XML JS Extension can be used to enable drilldown for Horizon Chart Custom Visualization. Then Splunk JS stack can be used to set the required tokens and send back to Simple XML dashboards. In our example we are using Horizon Chart with id starting with horizon_drilldown_ for the tokens to be created and work. For example if Horizon Chart has id=horizon_drilldown_a1, the respective drilldown tokens would be horizon_drilldown_a1.field and horizon_drilldown_a1.value. Please try out and upvote if it helps! 🙂 Following is a run anywhere example based on Splunk's _internal data and has two charts, horizon_drilldown_names_trending and horizon_drilldown_2. <dashboard script="horizon_drilldown.js">
<label>Horizon Chart Drilldown</label>
<row>
<panel>
<title>Visualization id must start with horizon_drilldown_ | Tokens field and value are generated based on visualization ids. Refer to examples below:</title>
<html>
<style>
div[id^="horizon_drilldown_"] div.splunk-horizon-chart div.horizon canvas:hover{
cursor: pointer !important;
}
</style>
</html>
<viz id="horizon_drilldown_names_trending" type="horizon_chart_app.horizon_chart">
<title>Example 1: horizon_drilldown_names_trending.field - $horizon_drilldown_names_trending.field$ | horizon_drilldown_names_trending.value - $horizon_drilldown_names_trending.value$</title>
<search>
<query>index=_internal sourcetype=splunkd component="Metrics" name=*
| timechart count by name useother=f where max in top5</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="height">244</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
<viz id="horizon_drilldown_2" type="horizon_chart_app.horizon_chart">
<title>Example 2: horizon_drilldown_2.field - $horizon_drilldown_2.field$ | horizon_drilldown_2.value - $horizon_drilldown_2.value$</title>
<search>
<query>index=_internal sourcetype=splunkd component="Metrics" name=* log_level="INFO"
| timechart count by name useother=f where max in top5</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="height">244</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
</dashboard> Following is the required Simple XML JS extension i.e. horizon_drilldown.js, to be placed under your Splunk apps /appserver/static folder. require(["jquery", "splunkjs/mvc", "splunkjs/mvc/simplexml/ready!"], function ($, mvc) {
console.log("Inside Horizon Chart Click handler");
var defaultTokenModel = mvc.Components.get("default");
var submittedTokenModel = mvc.Components.get("submitted");
// Enable drilldown for Horizon Chart with id starting with horizon_drilldown_ (prefix)
// So it would work for ids like horizon_drilldown_a1, horizon_drilldown_a2 ...
$(document).on("click", 'div[id^="horizon_drilldown_"] div.splunk-horizon-chart div.horizon canvas', function () {
// Find the Horizon Chart ID
// based on nearest Dashboard Element Data View with id starting with horizon_drilldown_
var horizon_chart_id = $(this).closest('div[data-view="views/dashboard/element/DashboardElement"][id^="horizon_drilldown_"]').attr("id");
// The first span under canvas node contains split by field name
var field = $(this).next()
var strField = field.text();
// The second span under canvas node contains selected value
var value = field.next()
var strValue = value.text();
// Set the token based on Horizon Chart ID.
// For example horizon_drilldown_a1 will generate two tokens
// horizon_drilldown_a1.field and horizon_drilldown_a1.value
// Set and unset both Default and Submitted Token Models.
if (strField !== undefined) {
defaultTokenModel.set(horizon_chart_id + ".field", strField);
submittedTokenModel.set(horizon_chart_id + ".field", strField);
} else {
defaultTokenModel.unset(horizon_chart_id + ".field");
submittedTokenModel.unset(horizon_chart_id + ".field");
}
if (strValue !== undefined) {
defaultTokenModel.set(horizon_chart_id + ".value", strValue);
submittedTokenModel.set(horizon_chart_id + ".value", strValue);
} else {
defaultTokenModel.unset(horizon_chart_id + ".value");
submittedTokenModel.unset(horizon_chart_id + ".value");
}
});
});
... View more
08-24-2020
11:08 AM
1 Karma
Horizon Chart Custom Visualization does not support drilldown. How to enable drilldown to get the split by field name and clicked value as tokens. PS: Documenting answer for Simple XML JS extension to enable drilldown. Custom Viz can be enhanced to send the drilldown tokens.
... View more
Labels
- Labels:
-
drilldown
08-24-2020
06:20 AM
1 Karma
@tkerr1357 don't introduce subsearch for the query as you can handle straightforward using a query like the following: Eventcode=4624 ("successful" OR "failed") host=myhost1 user=user*
| stats count(eval(searchmatch("successful"))) as successful count(eval(searchmatch("failed"))) as failed The above search will make single trip to fetch required data from Index and will not be impacted by subsearch limitation. Please try out and confirm!
... View more
08-24-2020
05:41 AM
1 Karma
@wu_weidong one of the options would be to turn on "Dark Theme" for your dashboard. This will automatically invert the Tooltip background Color and font color. Second option could be to use Simple XML CSS Override to style the Tooltip as per your needs. If the chart ID is chartWithTooltipCSSOverride then following html panel with CSS override can be added to test. Once finalized, you should move CSS override to CSS file and reference the same in your dashboard/s for reusability. <html depends="$alwaysHideCSSOverridePanel$">
<style>
#chartWithTooltipCSSOverride g.highcharts-tooltip path {
fill: white !important;
}
#chartWithTooltipCSSOverride table.highcharts-tooltip tbody tr td:last-child{
color: black !important;
}
</style>
</html>
<chart id="chartWithTooltipCSSOverride"> Please try out and confirm!
... View more
08-24-2020
02:15 AM
1 Karma
@knanaiah001 if you need to show a custom panel/output when the text box is empty (on load or afterward), actual solution may differ based on how you are using the token in your SPL and how you are setting them. However, try the following run anywhere example where solution is based on rejects to display an empty html panel with -- as the output. You can use similar approach for your case. PS: Based on the question asked, I am assuming you have a Submit button and there is no default option for the text box. I coded change event handler to unset the form token for the text box to ensure -- is displayed even when user manually clears the text box. Please try out and confirm! <form>
<label>Text Box based Search</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="logLevel" searchWhenChanged="false">
<label>Log Level</label>
<change>
<condition value="">
<unset token="form.logLevel"></unset>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<title>Display Panel based on Text Box</title>
<table depends="$logLevel$">
<title>When the Search is Waiting for Input</title>
<search>
<query>| makeresults
| eval filterData="$logLevel$"</query>
</search>
</table>
<html rejects="$logLevel$">
<div style="font-weight:bold;text-align: center;">--</div>
</html>
</panel>
</row>
</form>
... View more
08-22-2020
09:39 PM
@chakru1234 you can refer to Splunk Products Portfolio for checking out various Splunk offerings. https://www.splunk.com/en_us/software.html If you have any specific requirements around the use cases these product solve, you can reach out to Splunk Sales through the same link for further details.
... View more
