Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 4 weeks ago
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
08-11-2020
08:38 PM
@jodros stats might be better way, but community would be able to assist better if you can provide some cooked up dummy data for events containing word and anotherword. There are several examples on community for such kind of use case with stats as an alternative for transaction.
... View more
08-10-2020
07:26 AM
@antoniopisc while these viz by default as it is might not be available you can 1. Use inbuilt visualization which may not be exactly what you are looking for, but can represent same data: https://docs.splunk.com/Documentation/Splunk/latest/Viz/CreateCharts#Select_a_chart 2. Check out Visualizations that come packed with Machine Learning Toolkit App: https://docs.splunk.com/Documentation/MLApp/latest/User/Customvisualizations 3. Check out Custom Visualization on Splunkbase: https://splunkbase.splunk.com/apps/#/app_content/visualizations Or 4. If you have JS knowledge built your own custom viz using charting library like d3, highcharts, chartJS etc: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomVizTutorial
... View more
08-10-2020
03:49 AM
@Nishant_Pandya ideally if events are of different type, you should have different sourcetypes created and Regular Expression should be applied using props and transforms for Search Time field extraction. Please add sample (mock and anonymized) data from all sourcetypes for the community to assist you better. What is the field you want to extract and what is your RegEx?
... View more
08-10-2020
02:53 AM
1 Karma
@selva1709 if SPL is working as expected and you just need to show YYY-mm-dd format time based on Time Picker input, you can either use <eval> on time input <change> event handler or else use an independent search with the time input which sets required time token using search event handler. Both examples you can find in one of my older answer: https://community.splunk.com/t5/Archive/Running-one-of-two-searches-based-on-time-picker-selection/td-p/364411
... View more
08-10-2020
02:40 AM
Based on sample data provided add the following to your existing query <yourCurrentSearch>
| rex field=_raw "sessionid\:(?<sessionid>[^\s]+)"
| stats values(clientId) as clientId count(eval(searchmatch("found and success"))) as SuccessCount count(eval(searchmatch("found but failed"))) as FailedAttemptCount by sessionid
| stats sum(SuccessCount) as SuccessCount sum(FailedAttemptCount) as FailedAttemptCount by clientId Following is a run anywhere search which uses data provided by you. (commands till | KV generate the sample data). I have changed sessionid regular expression extraction as per your sample data. You may not need that change if data session id has double quotes for your actual data. | makeresults
| eval _raw="2020-08-09 23:59:56,455 sessionid:abc123 event=AUTHN_ATTEMPT ip=10.10.10.10 app=blah clientId=myApp1 status=inprogress adapterid=temp attributes=\"\" description=\"\" nmessagetype=\"Request\""
| append [| makeresults
| eval _raw="2020-08-09 15:10:57,674 sessionid:abc123 INFO \"In processCredentials\" VERIFIED [email protected] userid=
[ 1111111] found and success"]
| KV
| rex field=_raw "sessionid\:(?<sessionid>[^\s]+)"
| stats values(clientId) as clientId count(eval(searchmatch("found and success"))) as SuccessCount count(eval(searchmatch("found but failed"))) as FailedAttemptCount by sessionid
| stats sum(SuccessCount) as SuccessCount sum(FailedAttemptCount) as FailedAttemptCount by clientId
... View more
08-10-2020
01:43 AM
@hrs2019 sorry still not clear. Possibly because screenshot does not explain the details you have typed. When you start, will you have up to 5 URLs in the Text Box (comma separated). Then when you click on Plus one URL will be popped from Text Box and will appear as a row in the table. So on till last URL is removed from Text Box to Table? What will you do when someone pops one URL from Text Box to table and then adds one more URL to Text Box, will that be allowed and if so you may have more than 5 URL set from the Text Box. Since seems like you are trying to build a lot of custom Client Side capabilities which are not direct straightforward implementation using Simple XML, I would request have a Web Developer code all the required behavior using Simple XML JS extension.
... View more
08-09-2020
06:40 AM
Please add more details for the community to assist you better? Is this happening only for dashboard or even in Search UI? Please add simple XML code for time input and also the panel search code where time input is being used? What are the value for start and end time you are picking? Does it happen for all selections? Can you add screenshots of issue and steps to reproduce if possible?
... View more
08-09-2020
03:35 AM
1 Karma
@mdwecht I dont think for Production you can turn off caching. Only for Development environment you can enable web.conf config for no caching so that new static files are loaded (which again would require bump or refresh). Event after that Browser may also cache static file which may show previously loaded image instead of the new one. https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomVizTutorial#Development_mode_settings Can you custom command generate SVG code as search result so that you can plot image directly using SPL with Scalable Vector Graphics Custom visualization?
... View more
08-09-2020
01:14 AM
@lping how is dc_no_tok token being set? Can you add that code?
... View more
08-09-2020
12:32 AM
@skodak refer to one of my older answers on how to use Browser Inspector and CSS override to change Table Header Background and Font Color as per need. https://community.splunk.com/t5/Splunk-Search/How-to-change-the-default-color-formatting-on-a-table-header/td-p/304470 As stated in the link provided above, can you try the following? <html depends="$alwaysHideCSSStyle$">
<style>
.table th {
background-image: linear-gradient(to bottom, blue, turquoise) !important;
text-shadow: none !important;
}
.table th a{
color: white !important;
}
</style>
</html>
... View more
08-09-2020
12:11 AM
@jodros please add more relevant details. Do you want to correlate based on field names or values of the fields? i.e. field1, field2 and field3 to be present in the event? Or for field1=<value1>, field2=<value2> and field3=<value3> you want to correlate when the values value1, value2 and value3 are the same for the three fields? Please add some sample cooked up data for the two events and the final expected output so that the community can assist you better!
... View more
08-08-2020
10:26 PM
@alancproctor this seems to be Education related question (which specific session are you trying out?). Do reach out to Splunk Education team for further help (you should have email on Education site as per region like AMER, APAC etc). They do provide Splunk instance for training as per specific courses (is this one of those instance?). Have you tried changing the time picker to All Time and maybe index=* to see whether data got indexed to right index or not and also may be the data is older and you are trying to search for recent time like last 24 hours? Where did you get the data from? Was it as asked in course or from Splunk Docs Search Tutorial?
... View more
08-08-2020
10:19 PM
@shashank_24 for the community to assist you better you may have to provide some more details like mock/anonymized sample data from both sourcetype. Also what is the output of current query or till what point is your query working? Based on the details provided your query should work, however following would have been better way to write the SPL index=test (sourcetype=splunk_log event=AUTHN_ATTEMPT clientId=* status=inprogress) OR (source="server.log" AND "In processPasswordCredential" AND ("found but failed" OR "found and success"))
| rex field=_raw "sessionid\=\"id\:(?<id>[^\"]+)"
| eval status_new=case(searchmatch("found and success"),"Success", searchmatch("found but failed"),"Fail")
| stats count(eval(status_new=="Success")) as SuccessCount count(eval(status_new=="Fail")) as FailedAttemptCount by id If above query or your SPL is not working at present please provide more details. Is the sessionid field present in both the sourcetypes? If not how can the id be extracted from server.log source? Is it automatically extracted? (as you have provided no details in your question and SPL does not include that extraction).
... View more
08-08-2020
06:43 AM
@hrs2019 the expected behavior for + link input button has not be clearly described in your question. On click of + button, do you want to add selected text box values to the table?
... View more
08-08-2020
06:40 AM
@pipipipi for the community to assist you better please provide more details. You can mock/anonymize any sensitive information. What is your current SPL, can you share some data? What is the drilldown code and behavior (does it run search in new window or set required token for drilldown panel search)? Typically, although Single Value shows one value in the panel, its underlying search can be a time series data which is required to show the sparkline trend and only the latest value is displayed as the result. Also when we do drilldown to search without coding the tokens/values ourselves, it runs the underlying search which may give events from the previous pipe, hence return more results.
... View more
08-08-2020
06:26 AM
@saiprasadp101 for the community to assist you better please provide more context to your question. What are the inputs and what are some of combinations? What have you tried so far and what is not working for you? You can mock/anonymize any sensitive data or code before posting on community. Based on the description, you would need an independent search which takes all possible combinations of input selection and sets the final token using search event handler. Then use the token as depends for specific panel (to hide/show panel) and search (to execute and stop required search).
... View more
08-08-2020
06:22 AM
1 Karma
@kotak86 since you are trying to use a token in the init section, which does not seem to be set during dashboard initialization, your dependent token is not getting set. Try to use an independent search instead, which also runs on Dashboard load as well as each time source token changes, <search>
<query>| makeresults
| fields - _time
| eval cur_data=substr($data_type|s$, 8,12)</query>
<done>
<set token="cur_data">$result.cur_data$</set>
</done>
</search>
... View more
08-06-2020
02:43 AM
@meenal901 based on which region is this for, please contact the Splunk Sales team: https://www.splunk.com/en_us/about-splunk/contact-us.html
... View more
08-05-2020
08:06 PM
@vinothn your question seems to be different from what was originally posted. Hope you had posted your question separately. Also this has been solved before using <html> panel as header title and hiding the default Label/Description of the dashboard.
... View more
08-05-2020
08:02 PM
@avni26 if your issue is resolved please Up Vote and accept the answer.
... View more
08-04-2020
09:23 AM
@genesiusj try the following CSS override where <map id="chropleth_white_override_with_grey"> <html depends="$alwaysHideCSSPanel$">
<style>
#chropleth_white_override_with_grey .leaflet-overlay-pane svg g path[fill="#ffffff"]{
fill: #000 !important;
}
#chropleth_white_override_with_grey div.legend.leaflet-control svg g.svg-colors rect:first-child{
fill: #000 !important;
}
</style>
</html>
... View more
08-04-2020
08:30 AM
@vikashperiwal unfortunately this will not be just CSS based solution as there is no direct link between Chart series being hovered and tooltip's DOM. You may have to try jQuery based approach. Try to adjust the example as per your needs: https://community.splunk.com/t5/Archive/How-to-change-the-dislay-value-in-graph/td-p/375473
... View more
08-02-2020
05:18 AM
Paging @sideview for help 🙂 But yes you are right either Simple XML JS extension or Sideview Utils. In both cases I would expect value to be fetched and passed using tokens.
... View more
08-02-2020
05:15 AM
1 Karma
Wait patiently and it may come 🙂 https://www.linkedin.com/feed/update/urn:li:activity:6691303981484011520/ @MuS 🙂
... View more
08-01-2020
10:15 PM
2 Karma
@dominhthe110 try the following with | eval {splitField}=overField option. You will have to enable chart stacking. Since you will always have 4 splits, it is better to use Bar Chart. <dashboard theme="dark">
<label>Chart with Field Colors</label>
<row>
<panel>
<chart>
<search>
<query>index=_internal
| eval TimeOfTheDay=case(date_hour>=0 AND date_hour<=6,"Dawn",
date_hour>6 AND date_hour<=12,"Morning",
date_hour>12 AND date_hour<=18,"Afternoon",
date_hour>18 AND date_hour<=23,"Evening")
| eval orderedTimeOfTheDay=case(TimeOfTheDay=="Dawn","1.".TimeOfTheDay,TimeOfTheDay=="Morning","2.".TimeOfTheDay,TimeOfTheDay=="Afternoon","3.".TimeOfTheDay,TimeOfTheDay=="Evening","4.".TimeOfTheDay)
| stats count as Orders by orderedTimeOfTheDay
| eval {orderedTimeOfTheDay}=Orders
| fields - Orders
| eval orderedTimeOfTheDay=replace(orderedTimeOfTheDay,"\d+\.","")
| rename "1.*" as *, "2.*" as *,"3.*" as *,"4.*" as *</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">auto</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{"Dawn":"#FACDB3","Morning":"#F1813F","Afternoon":"#F8BE34","Evening":"#E1E6EB"}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">none</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</dashboard>
... View more
