Dear Support I am looking to hide in chart legend one field that shows in legend, field that is used only for drill-down purpose. Please see the following chart code: <chart> <search> <query>`mc_vln` | search DB_NAME=$field_db_name$ | stats count(eval(CTRL_FIND_ID=-1)) as Broken, count(eval(CTRL_FIND_ID=0)) as Correct, count(eval(CTRL_FIND_ID=1)) as Finding, earliest(_time) as SCAN_DT_START by DB_NAME SCAN_ID | sort - SCAN_DT_START | table DB_NAME SCAN_ID SCAN_DT_START Broken Correct Finding | dedup $field_last_x_scan$ DB_NAME | head 15 | sort SCAN_DT_START | fields - SCAN_DT_START</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">default</option> <option name="charting.legend.labels">["Finding","Correct","Broken"]</option> <option name="charting.legend.placement">top</option> <option name="charting.seriesColors">[0xFA4343,0x00579F,0x646464]</option> <option name="charting.legend.masterLegend"></option> <drilldown target="blank"> <link>scan_data?form.field_db_name=$click.value$&amp;form.field_scan_id=$row.SCAN_ID$&amp;form.field_ctrl_find_name=$click.name2$</link> </drilldown> </chart> I have got the SCAN_ID field in the "| table" part of my search only for using it in the drill-down. The problem is that this field SCAN_ID shows as an extra item in the Legend, while it logically produces no column. All the rest of the chart is OK - Database in X and Correct/Finding/Broken columns (per each Scan SCAN_DT_START) are shown. Question: How can I hide this unnecessary SCAN_ID legend item from the chart ? But without loosing it for drill-down - if I: | fields - SCAN_DT_START SCAN_ID then I get $row.SCAN_ID$ on the other side. looking for something as done for Table Dashboards in: 26825/drilldown-from-a-hidden-column.html with Splunk 6.0-6.4.x <option name="fields">field1,field2,field4,count</option> Splunk 6.5+ <fields>field1,field2,field4,count</fields> but for chart-equivalent (and thus hopefully in sImple XML) at your disposal for further info best regards, Altin ... View more

Hello I added a logo to my application, put the logo file appLogo.png at the /static folder as it is suggested in the docs, restarted. The logo does appear correctly in the app bar, but it is auto-placed on the right and thus covers the App Title which is also on the right. I can see the title is there in a flash when the page loads, but then it is covered by the logo. The question is: How can I position the logo without covering the App Title? Possibly in simple XML thanks and regards Altin PS. I have red the "Display both App Logo and App Name in Splunk 6 Custom Application", but cannot find how it was managed to put the logo on the left side (this would do) and without replacing anything on the left side. ... View more

Dear support I have a simple XML form in which a Dropdown input controls the content of a dashboard table. This dashboard table drills down to another form. The search on the table is done by matching one field (DB_NAME) by the value of the Dropdown input. This field by itself is not present in the table as a column - it is used for search filter only! Since the value of this field - although not present in the table - is needed to be send to the other form (by drill down), I tried to use the input's value instead of the missing column, since I know that every record returned has the same DB_NAME. The Dropdown element is a classic-wizard one, takes values from a search and uses Prefix and Suffix (important!) since db_name values can contain spaces <input type="dropdown" token="field_db_name" searchWhenChanged="true"> <label>Database</label> <fieldForLabel>DB_NAME</fieldForLabel> <fieldForValue>DB_NAME</fieldForValue> <search> <query>index=omega_ds_idx_01 | DEDUP DB_NAME | FIELDS DB_NAME</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <change> <unset token="form.field_scan_run_id"></unset> </change> <selectFirstChoice>true</selectFirstChoice> <prefix>"</prefix> <suffix>"</suffix> </input> The drill-down part of the table like: <drilldown target="blank"> <link>scan_comp_details_01?form.db_name_drill=$field_db_name$&amp;.........</link> </drilldown> where: scan_comp_details_01 - the drilled form db_name_drill - text input on the drilled form PROBLEM: The db_name_drill text input is completed with the selected option of the Dropdown input of the calling form, but the prefix (") and suffix (") are also present. Thus I see in the db_name_drill "database name" instead of database name this damages the search and work in the drilled form scan_comp_details_01 ! reminds: * I need to use prefix-suffix on the original form * could use hidden simple xml fields, but this is for 6.x only. also no use of .js, just simple xml Can you please advise how to get the value of the input "stripped" by prefix-suffix on the other side by drill down ? best regards Altin ... View more

Hello I find difficult to proper display relatively large text fields in dashboard tables - simple xml New lines are lost when displayed in dashboard table column, while being correct in the raw event. Data comes as XML, the field is CTRL_OUTPUT Below is some record content of column CTRL_OUTPUT as it shows on the Dashboard table: OMEGACAADM DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL OMEGACATESTAPP01 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL OMEGACATESTDBA01 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL OMEGACATESTDEV01 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL OMEGACATESTDEV02 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL OMEGADBSCAN DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL SYS DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL TEST1 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL TEST2 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL TEST3 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL TEST4 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL TEST5 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL Below is the Raw event: <SCAN_ID>20170714_210278_Ora_DB_T01_y</SCAN_ID><DB_NAME>Ora Test DB 01</DB_NAME><DB_HOST>db_test</DB_HOST><VLN_ID>10</VLN_ID><VLN_NAME>User Profile - Password Verify Function</VLN_NAME><SEVERITY_ID>2</SEVERITY_ID><SEVERITY_NAME>Medium</SEVERITY_NAME><CATEGORY_ID>0</CATEGORY_ID><CATEGORY_NAME>Authentication</CATEGORY_NAME><SCAN_CODE_ID>0</SCAN_CODE_ID><SCAN_CODE_NAME>Completed</SCAN_CODE_NAME><SCAN_MESSAGE>Completed</SCAN_MESSAGE><CTRL_FIND_ID>1</CTRL_FIND_ID><CTRL_FIND_NAME>Finding</CTRL_FIND_NAME><CTRL_SUMMARY>OMEGACAADM,OMEGACATESTAPP01,OMEGACATESTDBA01,OMEGACATESTDEV01,OMEGACATESTDEV02,OMEGADBSCAN,SYS,TEST1,TEST2,TEST3,TEST4,TEST5</CTRL_SUMMARY><CTRL_OUTPUT>OMEGACAADM DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL OMEGACATESTAPP01 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL OMEGACATESTDBA01 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL OMEGACATESTDEV01 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL OMEGACATESTDEV02 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL OMEGADBSCAN DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL SYS DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL TEST1 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL TEST2 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL TEST3 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL TEST4 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL TEST5 DEFAULT -> PASSWORD -> PASSWORD_VERIFY_FUNCTION NULL </CTRL_OUTPUT> Collapse As it is seen above, the formatting (new lines) of the CTRL_OUTPUT is preserved in raw event, but it is lost in dashboard table display. Can this be fixed ? best regards Altin ... View more

Hello I am trying to drilldown a table dashboard to another form's several inputs, but I get the variable names instead of their values. The main form - scan_data_02 - has (between others) a statistical table dashboard, whose records are present. I have another form - scan_item_details_02 which has three simple text inputs and a table dashboard, which is bound in search to the three inputs. The search in this form works correctly by itself, the three inputs have default values, the table has data and it responds to every change in the three inputs. scan_item_details_02: <form> <label>Scan Item Details 02</label> <fieldset submitButton="false" autoRun="false"> <input type="text" token="field_scan_id"> <label>Scan Id</label> <default>20170709_125008_Ora_DB_LV</default> <prefix>"</prefix> <suffix>"</suffix> </input> <input type="text" token="field_vln_id"> <label>Vln Id</label> <default>201</default> </input> <input type="text" token="field_db_name"> <label>Database</label> <default>Oracle Live DB</default> <prefix>"</prefix> <suffix>"</suffix> </input> </fieldset> <row> <panel> <table> <search> <query>index=omega_ds_idx_01 DB_NAME=$field_db_name$ SCAN_ID=$field_scan_id$ VLN_ID=$field_vln_id$ | table DB_NAME SCAN_ID VLN_ID VLN_NAME .........</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">3</option> <option name="wrap">true</option> </table> </panel> </row> </form> The URL of the correct standalone working of the detail form is: http://192.168.1.71:8000/en-US/app/Omega_DS_App_02/scan_item_details_02?form.field_scan_id=20170709_125008_Ora_DB_LV&form.field_db_name=Oracle%20Live%20DB&form.field_vln_id=201 The problem starts when I drill-down from the main form "scan_data_02". The dashboard and drill-down code is: <panel> <table> <title>DRILL</title> <search> <query>index=........ | table DB_NAME SCAN_ID VLN_ID VLN_NAME .......</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">4</option> <drilldown target="blank"> <link>scan_item_details_02?form.field_scan_id=$row.SCAN_ID&amp;form.field_vln_id=$row.VLN_ID&amp;form.field_db_name=$row.DB_NAME</link> </drilldown> </table> </panel> Instead of having the three inputs completed with the three field values - I get $row.field_name on them - $row.SCAN_ID instead of the scan name. so for two others - by respective field The error URL is: http://192.168.1.71:8000/en-US/app/Omega_DS_App_02/scan_item_details_02?form.field_scan_id=%24row.SCAN_ID&form.field_vln_id=%24row.VLN_ID&form.field_db_name=%24row.DB_NAME Please advise on the right command for drill-down thank you very much, best regards Altin ... View more