On Dashboard load, when my initial value/default value is daily my token  <set token="tok_daily">$dailytoken$</set> is not set (not getting today's date automatically) where as this( <set token="tok_weekly">*</set>,) is set.   I have to change the dropdown to weekly and change it back to daily again for it to work properly. Can someone tell what am I doing wrong ?   <search> <query> | makeresults | eval today=strftime(now()+19800, "%m/%d/%Y") , currentweek=strftime(now()+19800, "%U-%Y") | table today currentweek </query> <done> <set token="dailytoken">$result.today$</set> <set token="weeklytoken">$result.currentweek$</set> </done> </search> <fieldset submitButton="false" autorun="true"> <input type="dropdown" token="custom_time_token" searchWhenChanged="true"> <label>Select Time Range</label> <choice value="daily">Daily</choice> <choice value="weekly">Weekly</choice> <choice value="monthly">Monthly</choice> <initialValue>daily</initialValue> <default>daily<default> <change> <condition value="daily"> <set token="tok_daily">$dailytoken$</set> <set token="tok_weekly">*</set> </condition> <condition value="weekly"> <set token="tok_weekly">$weeklytoken$</set> <set token="tok_daily">*</set> </condition> </change> </input> </fieldset>       basesearchstring | search scheduled_delivery_date ="$tok_daily$" AND week_of_year="$tok_weekly$" AND delivery_month="$tok_monthly$"     When I used those set token values in my base search  my result is like this      basesearchstring | search scheduled_delivery_date ="$tok_daily$" AND week_of_year=* AND delivery_month=*     ... View more

All, I was reusing the Modal Window project from Ian Gillespie as described in the Hurricane Labs Tutorial Project . This project shows a TABLE in the Modal Window , I would like to have different Visualizations like Chart, Single View Panels etc. Instead of using the TableView, I tried changing it to ChartView , ChartElement etc, but I am not able to make it work. I still get the output as a Table in the Modal Window. Could someone teach me to do that ? It would be really helpful if an example is given on Single View apart from ChartView as well. Dashboard Code: <dashboard script="modalviewsearchapp1.js"> <label>Modal Demo</label> <row> <panel> <table id="master"> <title>Master</title> <search> <query>index=_internal | stats count by sourcetype</query> <earliest>-60m@m</earliest> <latest>now</latest> </search> <!-- Set the type of of drilldown, since we will always consume the same field, use row--> <option name="drilldown">row</option> </table> </panel> </row> <row> <panel> <table id="slave"> <title>slave</title> <search> <query>index=_internal | dedup group | table group</query> <earliest>-60m@m</earliest> <latest>now</latest> </search> <!-- Set the type of of drilldown, since we will always consume the same field, use row--> <option name="drilldown">row</option> </table> </panel> </row> </dashboard> Script - "modalviewsearchapp1.js" require([ 'underscore', 'backbone', '../app/search/components/ModalViews', 'splunkjs/mvc', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc/simplexml/ready!' ], function(_, Backbone, ModalView, mvc, SearchManager) { var master = mvc.Components.get("master"); var tokens = mvc.Components.getInstance("submitted"); var slave = mvc.Components.get("slave"); var detailSearch = new SearchManager({ id: "detailSearch", earliest_time: "-24h@h", latest_time: "now", preview: true, cache: false, search: "index=_internal sourcetype=$sourcetype$ | timechart count" }, {tokens: true, tokenNamespace: "submitted"}); var detailedSearch = new SearchManager({ id: "detailedSearch", earliest_time: "-24h@h", latest_time: "now", preview: true, cache: false, search: "index=_internal group=$group$ | chart count by sourcetype" }, {tokens: true, tokenNamespace: "submitted"}); master.on("click", function(e) { e.preventDefault(); if(e.field === "sourcetype") { var _title = e.data['click.value']; tokens.set('sourcetype', _title); var modal = new ModalView({ title: _title, search: detailSearch }); modal.show(); } }); slave.on("click", function(e) { e.preventDefault(); if(e.field === "group") { var _title = e.data['click.value']; tokens.set('group', _title); var modal = new ModalView({ title: _title, search: detailedSearch }); modal.show(); } }); }); Script - ModalViews define([ 'underscore', 'backbone', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc/simplexml/element/table', 'splunkjs/mvc/chartview', 'splunkjs/mvc/simplexml/element/chart', 'splunkjs/ready!' ], function(_, Backbone, $, mvc, SearchManager, ChartElement) { var modalTemplate = "<div id=\"pivotModal\" class=\"modal\">" + "<div class=\"modal-header\"><h3><%- title %></h3><button class=\"close\">Close</button></div>" + "<div class=\"modal-body\"></div>" + "<div class=\"modal-footer\"></div>" + "</div>" + "<div class=\"modal-backdrop\"></div>"; var ModalView = Backbone.View.extend({ defaults: { title: 'Not set' }, initialize: function(options) { this.options = options; this.options = _.extend({}, this.defaults, this.options); this.childViews = []; console.log('Hello from the modal window: ', this.options.title); this.template = _.template(modalTemplate); }, events: { 'click .close': 'close', 'click .modal-backdrop': 'close' }, render: function() { var data = { title : this.options.title }; this.$el.html(this.template(data)); return this; }, show: function() { $(document.body).append(this.render().el); $(this.el).find('.modal-body').append('<div id="modalVizualization"/>'); $(this.el).find('.modal').css({ width:'90%', height:'auto', left: '5%', 'margin-left': '0', 'max-height':'100%' }); var search = mvc.Components.get(this.options.search.id); var detailTable = new ChartElement({ id: "detailTable", 'charting.chart': 'pie' managerid: search.name, el: $('#modalVizualization') }).render(); this.childViews.push(detailTable); search.startSearch(); }, close: function() { this.unbind(); this.remove(); _.each(this.childViews, function(childView) { childView.unbind(); childView.remove(); }); } }); return ModalView; }); ... View more

I was displaying the count of certain type of locks using the query below. index=A sourcetype="source" LOCK_MODE!="" SYSTEM_ID=SYSTEM1 | dedup CLIENT_ID ENTRY_TIME USER_ID LOCK_TEXT LOCK_MODE | eval SYSTEM=SYSTEM_ID."-".CLIENT_ID | eval DURATION=strptime(DATETIME, "%d/%m/%Y %H:%M:%S") - strptime(ENTRY_TIME, "%d/%m/%Y %H:%M:%S") | eval LOCK_DURATION=round(DURATION/3600) | eval LOCK_STATUS=case(LOCK_DURATION > 15, "RED", LOCK_DURATION > 8, "AMBER" , 1=1, "GREEN") | search LOCK_STATUS=RED | stats count | rangemap field=count low=0-1 default=severe Recently, we faced a situation where our SYSTEM_ID was down and no data was being indexed - So obviously my count was being displayed as 0 and in GREEN colour. I tried just the stats count in line 8 and the results will always be 0 even if So now I have to handle two situations, 1) the count should be 0 and in GREEN in case there are no lock types I am looking for. 2) the count should be 0 or "No events are indexed" and in RED only incase no data is flowing to index=A sourcetype="source" LOCK_MODE!="" SYSTEM_ID=SYSTEM1 for the specified timeperiod. I tried the following but it doesn't handle the two situations i need together. Either even if the count is zero although data is flowing , it is being changed to "no events found". I tried just the stats command in line number 8 , and my count will always be 0 irrespective of whether data is flowing or not. index=A sourcetype="source" LOCK_MODE!="" SYSTEM_ID=SYSTEM1 | dedup CLIENT_ID ENTRY_TIME USER_ID LOCK_TEXT LOCK_MODE | eval SYSTEM=SYSTEM_ID."-".CLIENT_ID | eval DURATION=strptime(DATETIME, "%d/%m/%Y %H:%M:%S") - strptime(ENTRY_TIME, "%d/%m/%Y %H:%M:%S") | eval LOCK_DURATION=round(DURATION/3600) | eval LOCK_STATUS=case(LOCK_DURATION > 15, "RED", LOCK_DURATION > 8, "AMBER" , 1=1, "GREEN") | search LOCK_STATUS=RED | stats count AS "Event Status" by LOCK_STATUS | table "Event Status" | appendpipe [| stats count | eval "Event Status"="No events indexed for the time range" | where count==0 | fields - count ] | rangemap field="Event Status" low=0-1 default=severe In the appendpipe I tried using eventstats command to evaluate if there are no events, but because of | stats count AS "Event Status" by LOCK_STATUS --> it is showing no results found , and if I just do stats , the result will always be 0. | appendpipe [| eventstats count as "Number of Events" | eval "Event Status"="No events indexed for the time range" | where 'Number of Events'==0 | fields - "Number of Events" ] ... View more