Hi Splunker, This is just my curiosity. I have a lot of logs that are 99,999 in 1 millisec. I have tried zooming in until the minimum and then I have understood that 1ms is the limit of zoom. I think the product specification, but there is no doc to be written about it. If someone know doc or answers, please let me know. Regards, ... View more

Hi, I have copied the "table_row_highlighting.js" and "table_decorations.css" in Splunk DashBoard Example and created new ones. After that the javascript and css looks fine. And table row color and font are changed depending on the key value. However the only table row color is not changed with the following situation although the table value font is changed. 1. open this dashboard first time. 2. do not change the input panel value. 3. drilldown to this dashboard. After I do the above thing, table row color is changed. I am thinking that there is a cause to happen this issue in the lines. ###Original JS### mvc.Components.get('colortable').getVisualization(function(tableView) { tableView.on('rendered', function() { //Apply class of the cells to the parent row in order to color the whole row tableView.$el.find('td.range-cell').each(function() { $(this).parents('tr').addClass(this.className); }); }); //Add custom cell renderer, the table will re-render automatically. tableView.addCellRenderer(new CustomRangeRenderer()); }); }); ###myJS### mvc.Components.get('colortable').getVisualization(function(tableView) { // Add custom cell renderer tableView.table.addCellRenderer(new CustomRangeRenderer()); tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row tableView.$el.find('td.range-cell').each(function() { $(this).parents('tr').addClass(this.className); }); // Force the table to re-render tableView.table.render(); }); }); }); Does anyone have an idea or advice to solve it? I appreciate any ideas and advices. Best regards, ... View more

Hello, I would like to disable MouseScrollsetting in missile map apps. But the following option settings do not work for missile map apps. -mapping.tileLayer.minZoom -mapping.tileLayer.maxZoom -mapping.map.scrollZoom Addtionally, I tried changing the following "scrollWheelZoom: " of Javascript in missile map apps. source: .../apps/missile_map/appserver/static/visualizations/missile_map/visualization.js L.Map.mergeOptions({ // @section Mousewheel options // @option scrollWheelZoom: Boolean|String = true // Whether the map can be zoomed by using the mouse wheel. If passed 'center' , // it will zoom to the center of the view regardless of where the mouse was. scrollWheelZoom: false, However "scrollWheelZoom" setting did not work when I changed "true" to "false". Does anyone have an idea about the setting to disable it or the zoom setting? I would appreciate any ideas. Best regards. ... View more

Hi I have an alert to search proxy logs. And this alert creates its results to match 3 million Proxy logs and lookup files of 40,000 lines. Also the alert takes 7 ~ 9 hours until it finishes running. index=proxy sourcetype=proxy [inputlookup Proxy_blacklist.csv | table url ] | stats count as total_count, last(_time) as ltime, first(_time) as ftime, values(host) as host, values(auth_user) as auth_user by client_ip,url I would like to make this alert faster. As I do this, I have the idea to divide the lookup file as 3 file and this alert as 3 alerts too. If someone has another idea to make it faster, please give me your suggestion and advice. I appreciate any answers so much. Best regard, ... View more

Hi, I would like to know how to work "Palo Alto Networks App for Splunk" in Splunk version 7.0.2, which version is 5.3.1. I have already install "Palo Alto Networks Add-on for Splunk" which version is 3.7.1. pan_traffic and pan_threat could be searched and show the folowing fields. eventtype=pan eventtype=pan_threat eventtype=pan_traffic Additionally, these datamodels which are "Palo Alto Networks Firewall Logs" and "Network Traffic" have been acceleration. But this app is not working... I have known that SplunkBase show this version is not applied with Splunk 7.x. Actually I would like not to change this version, because these visualisation would be changed a lot. Are there any way to use this app version? Or Do I have to change the app version which is over6.0.x.? If someone counl work this app version fine in same case, please let me know which settings you changed. Also please check whether you are getting these error. Error message1: File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/lib/common.py", line 182, in exit_with_error Error message2: 2018-02-26 13:08:01,026 +0900 ERROR common:182 - File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/retrieveWildFireReport.py", line 143, in If you need more info to solve this issue, please let me know. I appreciate any anwers. Best regard, ... View more

Hi, I have a issue about the XML setting. I set this following setting of "default".But often the and elements were removed. Not only "thistime" but also the value of "now_time" and "workerlist" were removed. Does anyone have same case? OR know the cause of it? This is the folling XML which was often changed. Regards, Before(defalut) <panel> <title>testt title($tok_this_time$ )</title> <single> <title>Japanese comment</title> <search> <query>index="test" sourcetype=test #########Abbreviated search########## | stats count values(maxtime) as thistime values(maxtime2) as now_time values(list) as wlist | eval workerlist=mvjoin(wlist," OR ")</query> <finalized> <condition> <set token="tok_this_time">$result.thistime$</set> <set token="tok_now_time">$result.now_time$</set> <set token="tok_now_worker">$result.workerlist$</set> </condition> </finalized> <earliest>-3mon@mon</earliest> <latest>now</latest> </search> <option name="afterLabel">回</option> <option name="beforeLabel">超過回数</option> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="height">55</option> <option name="rangeColors">["0x65a637","0xFFD700","0xd93f3c"]</option> <option name="rangeValues">[0,30]</option> <option name="refresh.display">preview</option> <option name="useColors">1</option> <drilldown> <link target="_blank">#########Abbreviated path##########</link> </drilldown> </single> </panel> After <panel> <title>testt title($tok_this_time$ )</title> <single> <title>Japanese comment</title> <search> <query>index="test" sourcetype=test #########Abbreviated search########## | stats count values(maxtime) as thistime values(maxtime2) as now_time values(list) as wlist | eval workerlist=mvjoin(wlist," OR ")</query> <earliest>-3mon@mon</earliest> <latest>now</latest> </search> <option name="afterLabel">回</option> <option name="beforeLabel">超過回数</option> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="height">55</option> <option name="rangeColors">["0x65a637","0xFFD700","0xd93f3c"]</option> <option name="rangeValues">[0,30]</option> <option name="refresh.display">preview</option> <option name="useColors">1</option> <drilldown> <link target="_blank">#########Abbreviated path##########</link> </drilldown> </single> </panel> ... View more