I guess yes, but please indicate the "first sentence" thanks and regards Altin ... View more

Thank you very much Mr. Woodcock I am forced to use the TCP Input - at least for now. So from your answer I got the first rule: No TCP Input creation on a app_name.spl install! But what about index creation on the same (app_name.spl install)? Would that be considered invasive ? Be a problem in certification? thank you very much, best regards Altin ... View more

but always a Splunk software user! ... View more

My Splunk Enterprise has expired and I am testing now on the Free edition. There is no logon/logoff, no users and no roles. I am supplying the Linux "splunk" user which is owner of the Splunk installation and daemon. Does this mean that the method in discussion (OS CLI command-line) does not work for Free Splunk ? I managed to make the .spl with the web method - but that is another issue. best regards Altin ... View more

Hello everyone let me kindly ask you what happens now that this parameter is deprecated (at least on last version 6.3.3)? Could not find anything to replace it - while it raises a Warning into the XML editor best regards Altin ... View more

thank you very much rjthibod ... View more

To further clarify (after more testing) The first "#myChart g.highcharts........" - arrow char (>) excluded - is OK and did resolve my question. The second "#myChart > g.highcharts........" - arrow char (>) included - does not work - fields does show in legend. My Splunk is 6.5.2. thanks and regards Altin ... View more

thank you very much for the exact solution. however one thing remains: can you indicate some resources on the HighCharts - I mean Splunk related only? best regards Altin ... View more

Hello I am not sure if we are on the same line. I am having no drill-down problem here, only that the slave Drop-Down input "field_scan_run_id" keeps its value when the master "field_db_name" has changed. I know how to fix this by inserting: <change> <unset token="form.field_scan_run_id"></unset> </change> in the master "field_db_name". But then this will cause the URL problem - so I am looking to fix this without change/unset at your disposal for further info best regards Altin ... View more

to further clarify: If I need two drop-downs and the second slave (in search) to master first, I have to use unset to clear the second's value when first changes - no matter if I use or not select-first-choice in the second. If I use the unset - things are resolved - old value is cleared. The problem is: when I call the form above from a drill-down of another form's dashboard, the first drop-down is correctly set, while the second - being unset-ed by change of the first - looses the value given by the URL. thanks and regards Altin ... View more

Hello niketnilay I have a case in which even usage of select-first-choice does not help. In the following code below: <input type="dropdown" token="field_db_name" searchWhenChanged="true"> <label>Database</label> <fieldForLabel>DB_NAME</fieldForLabel> <fieldForValue>DB_NAME</fieldForValue> <search> <query>index=omega_ds | DEDUP DB_NAME | FIELDS DB_NAME</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <change> <set token="db_name_no_quotes">$value$</set> </change> <selectFirstChoice>true</selectFirstChoice> <prefix>"</prefix> <suffix>"</suffix> </input> <input type="dropdown" token="field_scan_run_id" searchWhenChanged="true"> <label>Scan Id Run</label> <search> <query>index=omega_ds DB_NAME=$field_db_name$ | stats earliest(_time) as SCAN_DT_START by DB_NAME SCAN_ID | sort - SCAN_DT_START</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <fieldForLabel>SCAN_ID</fieldForLabel> <fieldForValue>SCAN_ID</fieldForValue> <change> <set token="scan_run_id_no_quotes">$value$</set> <unset token="form.field_scan_bs_id"></unset> </change> <selectFirstChoice>true</selectFirstChoice> <prefix>"</prefix> <suffix>"</suffix> </input> drop-down input token "field_scan_run_id" will keep its old selected value even when all is options are changed - because of the change of token="field_db_name" - and the old value is no more. so using the "selectFirstChoice" (without unset) does not help. I see in answer 218751 selectfirstchoice-not-working-in-dynamic-dropdowns, that unset is offered as a solution, but I cannot use it for the URL drill-down failure (scan run id always *) can you help ? thanks and regards Altin ... View more

I did fixed it by replacing the field_db_name input with the un-quoted one: <condition match="'db_name_no_quotes' == &quot;*&quot;"> this made the switching of forms! I would be curious to see how this would work with the original input token - field_db_name thank you very much for your help, best regards Altin ... View more

sorry, but it still goes only to the second choice scan_compare_02. I can paste the whole code if you need. or at least until this dashboard. thank you very much Altin ... View more

Yes, it did this way thanks and regards Altin ... View more

I tested, but it always gets to the second condition whenever input field_db_name is set or no. can you help? thanks and regards Altin ... View more

thank you very much again I will test and let you know ASAP. One question(confirmation) before: The second condition does not have a "match" (alias condition), because is the last on list ? and if the first fires - it logically does not count ? best regards Altin ... View more

thank you very much for the quick answer Rjthibod meanwhile it took me some time to try, but I couldn't make it work. I have an empty new tab (about:blank) in both case database drop-down is selected or * by default value. I am inserting below the Database drop-down code: <input type="dropdown" token="field_db_name"> <label>Database</label> <prefix>"</prefix> <suffix>"</suffix> <default>*</default> <fieldForLabel>DB_NAME</fieldForLabel> <fieldForValue>DB_NAME</fieldForValue> <search> <query>`mc_vln` | DEDUP DB_NAME | FIELDS DB_NAME</query> <earliest>0</earliest> <latest></latest> </search> <change> <set token="db_name_no_quotes">$value$</set> <unset token="form.field_scan_run_id"></unset> </change> </input> And also my dashboard - as I did apply the match function solution: <panel> <title>Health by Severity</title> <chart> <search> <query>`mc_vln` | search DB_NAME=$field_db_name$ | stats earliest(_time) as SCAN_DT_START count(eval(SEVERITY_ID=1 AND CTRL_FIND_ID=0)) as High_Correct, count(eval(SEVERITY_ID=1 AND CTRL_FIND_ID=1)) as High_Finding, count(eval(SEVERITY_ID=2 AND CTRL_FIND_ID=0)) as Medium_Correct, count(eval(SEVERITY_ID=2 AND CTRL_FIND_ID=1)) as Medium_Finding, count(eval(SEVERITY_ID=3 AND CTRL_FIND_ID=0)) as Low_Correct, count(eval(SEVERITY_ID=3 AND CTRL_FIND_ID=1)) as Low_Finding by SCAN_ID | eval HRT_High = round(100 * High_Correct / (High_Correct+High_Finding), 2) | eval HRT_Medium = round(100 * Medium_Correct / (Medium_Correct+Medium_Finding), 2) | eval HRT_Low = round(100 * Low_Correct / (Low_Correct+Low_Finding), 2) | table SCAN_DT_START SCAN_ID HRT_High HRT_Medium HRT_Low | sort SCAN_DT_START | fields - SCAN_DT_START | rename SCAN_ID as "Scan Id" HRT_High as High HRT_Medium as Medium HRT_Low as Low</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.chart">line</option> <option name="charting.legend.labels">["High","Medium","Low"]</option> <option name="charting.legend.placement">right</option> <option name="charting.seriesColors">[0xFA4343,0xFFA042,0x00579F]</option> <option name="charting.legend.masterLegend"></option> <drilldown target="blank"> <condition match="isnull('field_db_name')"> <link>scan_data?form.field_db_name=$db_name_no_quotes$&amp;form.field_scan_id=$row.Scan Id$&amp;form.field_severity_name=$click.name2$</link> </condition> <condition match="isnotnull('field_db_name')"> <link> <link>scan_compare_02?form.field_db_name=$db_name_no_quotes$&amp;form.field_scan_run_id=$row.Scan Id$</link> </link> </condition> </drilldown> </chart> </panel> If I renounce conditioning - ie. use only drill-down to scan_data form whenever the database is selected or not - everything is OK. I do reach the scan_data form with correct variables in the URL. Clarification the db_name_no_quotes token is used and set inside the field_db_name declaration to have it without quotes in the drill URL May be I have missed something from your idea during my setup ? thank you very much best regards Altin ... View more

didn't work for me tried | top 100 my-field-name | rare 99 my-field-name for actually five records, but got all of them and not the first one (100-99) removed! Put high number (100) because five records is not the max number, may be even 150 regards Altin ... View more

Hello is there any development on this ? remove top x rows from result best regards Altin ... View more

Thank you very much for the reply and support Unfortunately in this project I am limited to Simple XML only - no Javascript, no CSS, some images at max. . Thus chances are that the field remains as it is (because needed for the drill-down) other then diverging from the projects course. If no solution here I will rename the field SCAN_ID to some small "x" and put the small color rectangle to white -a typical quick-and-dirty solution. This is a project framework - "major force" :-) Thus I tried the following settings in XML with the hope they work: <option name="charting.axisY2.enabled">false</option> <option name="charting.axisLabelsY2.axisVisibility">hide</option> <option name="charting.axisY2.fields">"SCAN_ID"</option> <option name="charting.axisY2.minimumNumber">0</option> <option name="charting.axisY2.maximumNumber">0</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.axisY2.scale">inherit</option> but still cannot hide the SCAN_ID in legend. can you advise? even by confirming that this is just no possible in Simple XML thanks and best regards Altin ... View more

Thank you very much for your reply Pduflot I see above you say that code above uses HTML syntax. I have tried your way in Simple XML (my project is limited there - no Javascript/CSS). And furthermore it is a Column chart. I tried to set the same of what you suggested in XML, I added the y2Axis. SCAN_ID is the sole field/column I want to hide in legend (it produces nothing) <chart> <search> <query>`mc_vln` | search DB_NAME=$field_db_name$ | stats count(eval(CTRL_FIND_ID=-1)) as Broken, count(eval(CTRL_FIND_ID=0)) as Correct, count(eval(CTRL_FIND_ID=1)) as Finding, earliest(_time) as SCAN_DT_START by DB_NAME SCAN_ID | sort - SCAN_DT_START | table DB_NAME SCAN_ID SCAN_DT_START Broken Correct Finding | dedup $field_last_x_scan$ DB_NAME | head 15 | sort SCAN_DT_START | fields - SCAN_DT_START | rename DB_NAME as Database</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="charting.chart">column</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisLabelsY2.axisVisibility">hide</option> <option name="charting.axisY2.fields">"SCAN_ID"</option> <option name="charting.axisY2.minimumNumber">0</option> <option name="charting.axisY2.maximumNumber">0</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart.stackMode">default</option> <option name="charting.legend.labels">["Finding","Correct","Broken"]</option> <option name="charting.legend.placement">top</option> <option name="charting.seriesColors">[0xFA4343,0x00579F,0x646464]</option> <option name="charting.legend.masterLegend"></option> <drilldown target="blank"> <link>scan_data?form.field_db_name=$click.value$&amp;form.field_scan_id=$row.SCAN_ID$&amp;form.field_ctrl_find_name=$click.name2$</link> </drilldown> </chart> but I does not work, I still see the SCAN_ID field (the only needed to hide) appear in legend menu Is your solution valid for simple XML, or am I missing something in my code? Can you please advise at this point? thanks and best regards Altin ... View more