Can you provide some more informations? For example it is possible to click on one value in a table and then this value is used in an other panel. You can achieve this with set. Here is some doku with an example: http://docs.splunk.com/Documentation/Splunk/6.1.4/Viz/PanelreferenceforSimplifiedXML#set ... View more

Yeah, my services were also removed. Maybe some problem with the new services, as far as i know the splunkd and splunkweb services are combined after the upgrade. I could also find a "splunk.log" in the temp directory of windows that should log the installation progress. It said the installation failed because of some account rights that can not be transfered. But i didn't understand it and can't remember completely. Sadly i can't post it now, because i am at my home computer now. ... View more

Hi! Nice to hear i am not alone. I run in exactly the same problem! ... View more

If everything is green, there should be a problem with your if clauses or the check for cell.field==='severity'. Because in the css it looks like green is the default color. You can use a debuger or manually look what values your variables have with something like this: console.log(cell.field) or console.log(value) and then look at your browsers web console. For example use this: return _(['severity']).contains(cell.field); }, render: function($td, cell) { // Add a class to the cell based on the returned value var value = cell.value; // Apply interpretation for number of historical searches if (cell.field === 'severity') { console.log(value + "High case"); if (value=='High') { $td.addClass('range-cell').addClass('range-elevated'); } } // Apply interpretation for number of realtime searches if (cell.field === 'severity') { console.log(value + "Low case"); if (value=='Low') { $td.addClass('range-cell').addClass('range-severe'); } } // Update the cell content $td.text(value.addClass('string')); } }); ... View more

What you tried is the right way: if (cell.field === 'severity') { if (value =='High') { $td.addClass('range-cell').addClass('range-elevated'); } } But right before these lines, you define what is in the value variable. In the original piece of code it looks like this: var value = parseFloat(cell.value); This parses the string value of the cell to a number. But in your case, you don't want to get a number from the cell, instead you just want to the string. so try to replace this with: var value = cell.value; ... View more

Hi, there is a example implementation of this feature in the "Splunk 6.x Dashboard Example App". The example is called "Table Row Highlighting" and provides a simple xml example, together with the corresponding js and css files. This should be a good startingpoint for you. Greetings Tom ... View more

Could you provide some sample results were it went correctly and incorrectly? ... View more

Hi, I had the same problem. For a quick fix just remove the "id": "scope1" line completely. Looks like then automatically a unique id is generated with every call. I don't think this is the best method for the performance, but you can work on with your code. Greetings Tom ... View more

Hi, by default splunk reads the first few lines of a file (256 bytes) and calculates a hashvalue over those lines. When a new file with the same hash appears it isn't read. In your case, those first few lines are the same, therefore the file is reindexed again and you get your duplicates. You can adjust the amount of bytes that are read with this value in the inputs.conf: initCrcLength = <integer> Here is the link to the examples and spec of the inputs.conf file. You can find additional details for initCrcLength there, and also much more configuration options for your inputs. Greetings Tom ... View more

Hi, you can package the folder in you etc/apps directory as zip and then share it with the other users. You can also use the splunk rest endpoint to package an app as a .spl file. If i remember correctly, you can use this in your searchbar: | rest /services/apps/local/<appname>/package You have to substitude by the appname of the app you want to package. You can find the .spl file in the \etc\system\static\app-packages directory if everything runs as expected. Other useres then can use the "install app from file" option from the Splunk web ui to install the app. Always remember to check the permissions of all objects in your app. If an object is for example only private, it won't be packed in your app. Greetings Tom ... View more

I do not completely understand your question. Do you want to put all fields, in this case load_disk, sessions, maxpage, datadisk and memory on one row? So you want to gor from your example to something like this: 10:01pm load_disk: 200, sessions: 2, maxpage: 201, datadisk: 30, memory: 10 10:02pm load_disk: 201, sessions: 3, maxpage: 202, datadisk: 31, memory: 11 ... View more

Have you tried using subsearches and the append or appendcols searchcommand? Appendcols ... View more

Try this one: #element2 > div:nth-child(1) > h3:nth-child(2){ font-size: 56px; } ... View more

Can you try this : g.highcharts-legend-item:nth-child(1) > text:nth-child(2) > tspan:nth-child(1) { font-size: 56px; } This should manipulate at least the first item of the legend. ... View more

Hi leo_wang! It shouldn't make a difference if you use dashboard or form. I have played around with some of these examples in the last time and there are some points you can troubleshoot. First of all you should check if your script is loaded when you open the dashboard. For this purpose you can use the developer tools of you browser. (For example in firefox you can go for developer tools and then debugger. Is your table_icons_rangemap.js listed there?) Have you restarted splunk or at least splunk web after you created the js and css files? Are the js and css files in the correct folder of the app (appserver/static). Are there any other Errors on the console of the Web developer tools? Have you assigned an id to the table you want to display the icons in? It could also possibly help if you can post a snipped of your dashboard, so others can take a look over it. Greetings! ... View more

Hi! Is there something like a field "status" and you use this choice as: status=$status$ in your corresponding search? If so, you could put something like this in as value: <label>Select a status:</label> <default>status=*</default> <choice value="status=*">All</choice> <choice value="status=SUCCESS">SUCCESS</choice> <choice value="status=FAILED OR status=FAIL OR status=FAILURE">FAILURE</choice> </input> and in your search you do not use status=$status$, instead you just use $status$. Greetings Tom ... View more

FYI: There was a Question regarding the same tableformat as you have here. Also parts of the table header are the same: Link If your headers are fixed, you might be able to solve this with regular expressions. ... View more

Hi Felix, if your date is an epoch timestamp, you can use the strftime command to convert it. Assume time_epoch is your date as number, then: ... | eval date=strftime(time_epoch, "%F %T") Greetings Tom ... View more