I am not sure why the field order is also getting sorted. Perhaps running the sort then the table command will put things right. ... | sort EventID | Table CustomerID Time EventID .... ... View more

Yes it is. Here is an example: <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="foo" autoRun="True"> <param name="groupLabel">foo</param> <param name="search">index=_internal | head 5</param> <module name="HiddenPostProcess"> <param name="search">`head`</param> <module name="JobProgressIndicator"/> <module name="Paginator"> <param name="count">10</param> <param name="entityName">results</param> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="SimpleResultsTable"> <param name="allowTransformedFieldSelect">True</param> <param name="entityName">results</param> <param name="drilldown">row</param> <module name="Gimp"/> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> ... View more

Sure you can create a custom endpoint in splunkweb (port 8000) What you want to do is create a custom controller. This pretty similar to the python portion of a module. Take a look at the docs on splunkweb controller @ dev.splunk.com. ... View more

You can in an advanced xml view take a look at an example from our docs: <chart> <option name="charting.chart">radialGauge</option> <option name="charting.chart.style">minimal</option> <option name="charting.chart.rangeValues">[0,100,300,500]</option> <option name="charting.gaugeColors">[0x84e900,0xffe800,0xbf3030]</option> ... View more

Issue 1: jscharts like Ayn said has limitations both around browser performance as well as pixel density. This page in our docs tries to explain more about this. There are a few ways to customize this, but I would try using a smaller timerange if you want the small spans. Issue 2: I answered a similar question here: Essentially you can use eval in the timechart cmd. ie: ... | timechart span=3s eval( 1000 * avg(Value)) as field ... View more

Take a look at this sample. Does a search for the sources, then uses the ShowSource on that source. <module name="SearchSelectLister" layoutPanel="panel_row1_col1" group="viewsource" autoRun="True"> <param name="search">index=_internal earliest=-15m | dedup source | table source</param> <param name="settingToCreate">source</param> <param name="searchFieldsToDisplay"> <list> <param name="label">source</param> <param name="value">source</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">source</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="source"> <param name="value">$target$</param> </param> </param> </param> <module name="HiddenSearch" layoutPanel="panel_row3_col1"> <param name="search"> index=_internal source=$source$ </param> <module name="ShowSource"></module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> ... View more

I think you just want to eval count to what you want ex: ... | eval(count(source)/60) So your search: sourcetype="access-prod-wcs" useragent = "CLOUDTEST-SOASTA" OR useragent = "Lr-Perf" OrderProcessCmd | timechart eval(count(sitefamily)/60) by sitefamily Other timechart commands: CommonStatsFunctions ... View more