@kotak86 I dont think there is an existing feature or custom app for this kind of use case. You can either submit and idea on ideas.splunk.com or build your own Custom Alert Action for this feature. ... View more

@nvonkorff if your request is specifically for the Heat Map Custom Viz enhancement, you can reach out to developer who has built pretty cool visualizations and pretty active with updates to his viz as per request. Alternatively, if you want to plot heat map, you can do the same using Splunk Table visualization as well 🙂. Following is a thread where I have provided Table with SimpleXML CSS Extension for generating this kind of view. https://community.splunk.com/t5/Dashboards-Visualizations/Is-there-a-way-to-display-more-than-20-charts-at-a-time-using/td-p/298526/page/3 ... View more

@fbond_diligent sorry for the copy paste issue. match() condition is regex based. So * is not required. Please check updated SPL. ... View more

@kranthimutyala Yes this should be Solved using Splunk's REST API and based on logged in User. Following is an old answer of mine on similar lines. https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-a-dashboard-as-value-in-dropdown-of-another/td-p/327727 ... View more

[Updated] Corrected typo for match() condition which does not need * ___________________________ @fbond_diligent  as your final pipe if you add transpose command it should show Pie chart (convert result columns to rows).   | transpose   However, there are a lot of performance steps that you need to adopt. https://docs.splunk.com/Documentation/Splunk/8.0.5/Search/Writebettersearches Filter only required events from index based on pluginText as yes and no. Perform stats using specific fields to deduplicate instead dedup with all the fields. Avoid subsearch as it introduces sub-search limitations (which may drop events if you hit limit). Chain eval as single eval for performance and simple code.     index="secops" sourcetype="tenable:sc:vuln" plugin_id=19506 pluginText!="*Host_Scan*" pluginText IN ("*Credentialed checks : yes*","*Credentialed checks : no*") | stats count as total_scans count(eval(match(pluginText,"Credentialed checks : no"))) as failed_scans count(eval(match(pluginText,"Credentialed checks : yes"))) as successful_scans by ip | stats sum(*_scans) as *_scans | eval failed_percent=round((failed_scans/total_scans*100),2), success_percent=round((success_percent/total_scans*100),2) | fields success_percent failed_percent | transpose 0 header_field="status" | rename "row 1" as percent   ... View more

@adnankhan5133 for the community to assist you better can you please add details of what you SPL you have in SimpleXML vs what is your code for SearchManager in the JS? Also the user case for running Search through JS instead of SimpleXML? ... View more

Try CSS Style override for setting panel height. If you have panel id="panelWithHeight", then use the following CSS override #panelWithHeight .panel-body{ height: 2000px !important; } ... View more

@Rukmani_Splunk will you Splunk Tables have fixed number of columns? ... View more

I meant JavaScript file referred in the Dashboard xml code not JSON. Can you open source editor and check which JS is referred in script="<fileName>.js"? Then depending on the Splunk App name try the following URL to see whether it shows up or you get 404 error for static script file... <yourSplunkURL>/en-US/static/app/<yourSplunkAppName>/<yourJSFileName>.js ... View more

@kranthimutyala as per your question users as per their access will fetch the data from different indexes. Within different indexes the source type should ideally be same if you are collecting same data for providing same dashboard for all of them. What do you mean by metrics being different? (1) Are the field names different but capture same information or  (2) the data type itself is different. If it is first then you need field normalisation by aliasing or data model or parameterized macro based on looged in user. If not you will have to provide more example with cooked up data for some dummy users and then what kind of SPL and Visualizations you have in the dashboard. If data itself is completely different for different users I don't see how you can give same dashboard for two different use cases. ... View more

@sahil237888 you should filter URLs upfront while pulling from index (Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization) . So if you are interested only in specific URLs you should add them to first SPL i.e. index=dev_env sourcetype="urldata" URL IN ("https://www.pingtest.com/Logins/Login.aspx*","https://www.othertest.com/Logins/Login.aspx*") | timechart span=1m eval(round(avg(LoadTime),0)) as TimeUsedtoload by URL   ... View more

All my points for Performance improvement are still valid. Do include my SPL as well and check performance of your SPL vs mine using Job Inspector. I have tried to explain some of the basic Splunk Search Best practices (obviously SPL will still work without best practices as well.) https://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization ... View more

Can you add further details for code with table with id main_table and search with id main_search? Is the search linked with the table i.e. present within table? Try to put the following at the beginning of your code and step through each JS debug step in Browser or Debugger of your preference to see which step is actually failing. console.log("Script Loaded"); Most important part is whether it is entering table render code and classes are being added or not. If you are using code from the following post you may also have to ensure that null fields are handled in SPL using fillnull. https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-get-the-Table-cell-colorization-rendering-for-every/td-p/289392 or  https://community.splunk.com/t5/Splunk-Search/Add-colors-to-a-table-for-dynamic-columns/td-p/411419 ... View more

@wwhite12 Ideally you should use Simple XML JS extension as your requirement it complex. However, with colorPalette expression option and table allowing multi value fields, you can refer to one of my older answers for applying Color based on Simple XML: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-font-color-based-on-a-condition-for-a-particular/td-p/487257 In your case you will need additional SPL step to convert only the cells with % into multi-value cell and based on value apply range for applying color expression. Finally use Simple XML CSS extension to hide the multi-value cell for applying required color range.     Following is a run anywhere example that you can use!   <dashboard> <label>Table with color Based on Percent</label> <row> <panel> <title>Color Ranges | 0-40: Red | 40-90: Yellow | 90+: Green</title> <html depends="$alwaysHideHTMLCSSPanel$"> <style> #tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="tableColorFinalRowBasedOnData"> <search> <query>| makeresults | eval data="Total Stories,5,10,20;Stories Completed,5,0,10;% Completed,100%,0%,50%" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval State=mvindex(data,0),Team1=mvindex(data,1),Team2=mvindex(data,2),Team3=mvindex(data,3) | table State Team* | foreach Team* [| eval "&lt;&lt;FIELD&gt;&gt;"=case(State="% Completed" AND tonumber(substr('&lt;&lt;FIELD&gt;&gt;',1,len('&lt;&lt;FIELD&gt;&gt;')-1))&gt;=0 AND tonumber(substr('&lt;&lt;FIELD&gt;&gt;',1,len('&lt;&lt;FIELD&gt;&gt;')-1))&lt;40 ,'&lt;&lt;FIELD&gt;&gt;'."|LOW", State="% Completed" AND tonumber(substr('&lt;&lt;FIELD&gt;&gt;',1,len('&lt;&lt;FIELD&gt;&gt;')-1))&gt;=40 AND tonumber(substr('&lt;&lt;FIELD&gt;&gt;',1,len('&lt;&lt;FIELD&gt;&gt;')-1))&lt;90 ,'&lt;&lt;FIELD&gt;&gt;'."|MEDIUM", State="% Completed" AND tonumber(substr('&lt;&lt;FIELD&gt;&gt;',1,len('&lt;&lt;FIELD&gt;&gt;')-1))&gt;=90,'&lt;&lt;FIELD&gt;&gt;'."|HIGH", true(),'&lt;&lt;FIELD&gt;&gt;')] | foreach Team* [| eval "&lt;&lt;FIELD&gt;&gt;"=split('&lt;&lt;FIELD&gt;&gt;',"|")]</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="Team1"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette> </format> <format type="color" field="Team2"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette> </format> <format type="color" field="Team3"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette> </format> </table> </panel> </row> </dashboard> ... View more

@rwardwell @ak9092 how about something like this? You have to ensure that Dashboard search for drilldown has raw events only using purely streaming command. <dashboard> <label>Table with Show Source Drilldown</label> <search> <query>| makeresults | eval app="$env:app$"</query> <done> <set token="app">$result.app$</set> </done> </search> <row> <panel> <table> <search> <done> <set token="sid">$job.sid$</set> </done> <query>index=_internal sourcetype=splunkd log_level!=INFO | fields _time log_level _raw | head 50</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <link target="_blank">http://localhost:8000/en-US/app/$app$/show_source?sid=$sid|n$</link> </drilldown> </table> </panel> </row> </dashboard> ... View more

@mitag @s2_splunk I dont think this needs Idea submission are two ways the width can be adjusted Option 1 Table Sparkline Format Option width: The feature you are requesting is already available in Simple XML Dashboards. Refer to documentation:  https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#Table_sparklines Option 2 Table column width as per sparkline using CSS Override: Sparkline if you have not added spacing and bar width using sparkline format option will take 75px width, which you have already seen. You can use Simple XML CSS extension to adjust column width as per sparkline width. Refer to one of my older answers for changing table column width: https://community.splunk.com/t5/Splunk-Search/Column-width/td-p/309644 PS: I am waiting for about a month for one of my apps to be published on Splunkbase through which you can create your own Sparklines using jQueryUI Sparkline by Omnipotent. Which means sparkline chart within table can be anything besides just values over time.   Following is a run anywhere example which demos both options. Please try out and confirm, and if it works please update the comment/reference in the idea that is already submitted.     <dashboard> <label>Sparkline Width</label> <row> <panel> <title>Sparkline Width with format option</title> <table> <search> <query>index=_internal | chart sparkline as trend count by sourcetype</query> <earliest>-60m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <!-- Set sparkline options here; make sure that field matches field name of the search results --> <format type="sparkline" field="trend"> <option name="width">95%</option> </format> </table> </panel> </row> <row> <panel> <title>CSS Overridden sparkline Width</title> <html> <style> #tableWithSparklineWidth table thead th[data-sort-key="trend"]{ width: 75px !important; } </style> </html> <table id="tableWithSparklineWidth"> <search> <query>index=_internal | chart sparkline as trend count by sourcetype</query> <earliest>-60m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard>     ... View more

@adnankhan5133 you are performing too many preprocessing and filtering of data after pulling from index and before your stats command. Which will impact performance of your query. Also you are performing eval on string time field with timezone adjustment by 4 hours. If your data is getting indexed with wrong timestamp identification you should handle timestamp extraction and timezone adjustment while indexing the data (not in all of your search time SPL which impacts performance). Please try the following search and confirm whether it matches your expectation. 1. I have _time calculated based on Timestamp string time field, however, you should handle this while indexing of data. 2. I have filtered only three combination of Verb, Transaction Name and Application Name from your data so that there is no need to pull unwanted data from index and filter later. 3. I have used timechart to create empty buckets of time using calculated key field which is built by combining Verb, Transaction Name and Application Name. 4. Finally used transpose to reverse row data as column and vice versa. (Epoch time is converted String Time of format YYYY-mm-dd before transpose so that it shows up properly as column). Keep adding one pipe at a time to understand what each step is doing.   index=test_index_1 sourcetype=test_sourcetype_2 (Verb="GET" AND 'Transaction Name'="Transaction1" AND 'Application Name'="APP1") OR (Transaction Name'="Transaction2" AND 'Application Name'="App2") OR (Verb="PUT" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2) | eval _time=strptime(Timestamp, "%Y-%m-%dT%H:%M:%S.%3QZ")-14400 | eval key=Verb."|".'Transaction Name'."|".'Application Name' | timechart span=1d count('Status Code') as count by key | eval service_id=case(Verb="GET" AND 'Transaction Name'="Transaction1" AND 'Application Name'="APP1", "ID1", Verb="GET" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "ID2", Verb="PUT" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "ID3") | eval Priority=case(Verb="GET" AND 'Transaction Name'="Transaction1" AND 'Application Name'="APP1", "2", Verb="GET" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "2", Verb="PUT" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "1") | eval service_area=case(Verb="GET" AND 'Transaction Name'="Transaction1" AND 'Application Name'="APP1", "Area1", Verb="GET" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "Area2", Verb="PUT" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "Member") | eval Time=strftime(_time,"%Y-%m-%d") | fields - _* | transpose 0 header_field="Time" column_name=key | eval key=split(key,"|"), Verb=mvindex(key,0), "Transaction Name"=mvindex(key,1), "Application Name"=mvindex(key,2) | fields - key | fields Verb "Transaction Name" "Application Name" *   Following is a run anywhere example based on sample data provided:   | makeresults | eval Timestamp=strftime(_time,"%Y-%m-%dT%H:%M:%S.%3QZ") | eval data="Verb=\"GET\",\"Transaction Name\"=\"Transaction1\",\"Application Name\"=\"APP1\";Verb=\"GET\",\"Transaction Name\"=\"Transaction2\",\"Application Name\"=\"App2\";Verb=\"PUT\",\"Transaction Name\"=\"Transaction2\",\"Application Name\"=\"App2\"" | makemv data delim=";" | mvexpand data | rename data as _raw | extract pairdelim="," kvdelim="=" | eval "Status Code"=random() | rename "Transaction_Name" as "Transaction Name","Application_Name" as "Application Name" | eval _time=strptime(Timestamp, "%Y-%m-%dT%H:%M:%S.%3QZ")-14400 | eval key=Verb."|".'Transaction Name'."|".'Application Name' | timechart span=1d count('Status Code') as count by key | eval service_id=case(Verb="GET" AND 'Transaction Name'="Transaction1" AND 'Application Name'="APP1", "ID1", Verb="GET" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "ID2", Verb="PUT" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "ID3") | eval Priority=case(Verb="GET" AND 'Transaction Name'="Transaction1" AND 'Application Name'="APP1", "2", Verb="GET" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "2", Verb="PUT" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "1") | eval service_area=case(Verb="GET" AND 'Transaction Name'="Transaction1" AND 'Application Name'="APP1", "Area1", Verb="GET" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "Area2", Verb="PUT" AND 'Transaction Name'="Transaction2" AND 'Application Name'="App2", "Member") | eval Time=strftime(_time,"%Y-%m-%d") | fields - _* | transpose 0 header_field="Time" column_name=key | eval key=split(key,"|"), Verb=mvindex(key,0), "Transaction Name"=mvindex(key,1), "Application Name"=mvindex(key,2) | fields - key | fields Verb "Transaction Name" "Application Name" *   ... View more

The complete Simple XML approach in the second answer link (https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-font-color-based-on-a-condition-for-a-particular/td-p/487257) is to : Use an eval and suffix label value along with a delimiter to all other fields in the same row. Then use split() eval function to split the values into multivalue field. Then use Simple XML CSS to hide the split value from the label field. Finally apply expression based on label field value that is present in the second field but hidden through CSS. You can try to run the example code and open the search in a new window to see how SPL for above steps are working. If not you will have to use JS but approach for data will remain the same in SPL. PS the row in the example is colored based on label field log_level. ... View more

As per your eval there is a syntax error. However, if the URL field matches the eval condition, then you should see output. Following is a run anywhere example based on your data which is giving output for me | makeresults | eval URL="https://www.pingtest.com/server/server.aspx,https://www.servermonitor/clients/hostname/server.aspx?filetype_id=474&mode=new,https://www.pingtest.com/clients/User/Testdata.aspx,https://www.pingtest.com/mobileusers/Logins/Login.aspx?testid=1578&actid=21047,https://www.pingtest.com/User/newuser.aspx" | makemv URL delim="," | mvexpand URL | eval LoadTime=random() | eval url_name= case(URL like "https://www.pingtest.com/server/server.aspx%" , "ServerLogin", URL like "https://www.servermonitor/clients/hostname/server.aspx?filetype_id=474&mode=new%","Servers", URL like "https://www.pingtest.com/clients/User/Testdata.aspx%" ,"ServersPing", URL like "https://www.pingtest.com/mobileusers/Logins/Login.aspx?testid=1578&actid=21047%","MobilePing", URL like "https://www.pingtest.com/User/newuser.aspx?%","NewUserPing",1==1,0) | timechart span=1m eval(round(avg(LoadTime),0)) as TimeUsedtoload by url_name cont=f ... View more

May be try rest API call to dashboard definitions and see if Advanced XML related nodes like <module> <param> or <populatingSearch> are used. Since I have not used Advanced XML myself, I do not know whether there is something in metadata fields like root, eai:type, isDashboard will be same for Advanced XML and Simple XML or not. So you can check those as well. (Do remove search filter and table all fields to compare fields for regular Simple XML dashboards and Advanced XML). | rest /servicesNS/-/-/data/ui/views | search eai:data IN ("*<param>*","*<module>*","*<populatingSearch>*") | table eai:acl.app title label   ... View more

@psriyanka For Table Row Expansion there is a separate JS file that AWS dashboard would be using. If you have not migrated the required JS that functionality might not work. Check Browser Console to see if there are any JS based Client side errors. If your intent is to have Table Row Expansion feature in your Simple XML Dashboard, you can check out Splunk Dashboard Examples App which has this example as well. Refer to one of my older answers for detail: https://community.splunk.com/t5/Splunk-Search/Can-I-custom-code-a-Splunk-table-to-include-JSON-in-a-cell/td-p/336947 ... View more