One solution would be if we could shift the deployment stuff over onto the application rows,  and you need to shift the server stuff over as well.  Or going the other way, if we could shift all the pieces we need ontot he actual "relationship" rows, and then just do a stats that only picks things up from them. Either way - that sort of feeling, where you need to copy a couple phases of things around using different ids,  is when you should think of eventstats or streamstats. In this particular case I cannot make it very simple.   It involves a lot of "shifts" and it's ugly.     | makeresults | fields - _time | eval data="1,A,appl1,,;2,A,appl2,,;3,D,depl1,,;4,D,depl2,,;5,D,depl3,,;6,S,serv1,,;7,S,serv2,,;8,S,serv3,,;9,S,serv4,,;10,R,,1,3;11,R,,2,4;12,R,,2,5;13,R,,3,6;14,R,,4,7;15,R,,5,8;16,R,,5,9", data=split(data, ";") | mvexpand data | rex field=data "(?<sys_id>[^,]*),(?<type>[^,]*),(?<name>[^,]*),(?<parent>[^,]*),(?<child>[^,]*)" | fields sys_id type name parent child | eval parent=if(parent=="",null(),parent), child=if(child=="",null(),child) | eval application_id=case(type="A",sys_id, type="R",parent), server_id=case(type=="S",sys_id,type="R",child), application_name=case(type="A",name), deployment_name=case(type="D",name), server_name = case(type="S",name) | eventstats values(server_name) as server_name by server_id | eval deployment_id=case(type=="D",sys_id,type=="R" AND isnull(server_name), child, true(),parent) | eventstats values(server_id) as server_id values(deployment_id) as deployment_id by application_id | fillnull deployment_id value="" | mvexpand deployment_id | eventstats values(deployment_name) as deployment_name values(server_name) as server_name by deployment_id | eventstats values(application_name) as application_name by application_id | fields application_name deployment_name server_name | stats values(*) as * by application_name         The mocked up rows -- I had to add an extra eval to try and make it a little more like data.   emptystring values and null() values are pretty different.   I manually am turning some thing sback into null() values where it matters. The big eval statement -- it's a little careless in how it hands out application_id but it doesnt matter - likewise with server_id the next two lines - eventstats and then the eval that makes deployment_id -   deployment id is trickier but we basically use the absence of the server_name field to conclude that the "R" row is a application-to-deployment row.   the fillnull - mvexpand will throw away values that are actual nulls, so we do an ugly workaround to replace with emptystring values.   It's a bit of a shell game.  It copies the data from row to row,  step by step.  tedious and painful.   And if there's a way to replace it all with a simple pair of stats commands,  it's certainly beyond my abilities at the moment. SO - there's another path.  And that's to break it into smaller problems. I would go that way in this case.   Make a static file-based lookup mapping deployment id to deployment name. likewise from server id to server name.   and from application id to application name.   Then you can have 3 explicit lookup statements, painting these names onto all the rows.  And between eval and lookup you can actually load up the "relationship" rows with ALL of the ids and names,  and then one simple stats can do it in a single fell swoop then.  I'll come back and write up specific SPL to flesh out this way. ... View more

This may be because the app packages a "custom module" in the legacy Advanced XML system, and that the custom module contains its own custom python endpoint. You can check it very quickly by looking for a stack trace in web_service.log If there is one, look carefully in the last line of the stack - it will refer to a python file that is in a particular app, in an "appserver/modules" subdirectory. If that stack trace does exist, and points to this particular app, that's your root cause. And if so, here's the explanation of what just happened> a) those endpoints are not a part of the normal "web.conf" endpoints that you might be more familiar with in Splunkweb. This stuff is a pretty obscure backwater of some ancient systems that predate the web.conf controllers and have been largely forgotten since 4.X/5/X days. b) Splunkd in 8.0 still runs those legacy "advanced xml custom module" endpoints even though technically the advanced XML was suposed to be removed completely in 8.0. Splunk has acknowledged this as a mistake and I hear it's being fixed. c) furthermore Splunkd in 8.0 runs these ancient things in python3, which will almost guarantee that the endpoint wont run. d) more fun - when it fails to run the endpoint, splunkweb then itself fails to start for some reason. ... View more

I think the core problem, or at the very least a major source of confusion, is that you're taking _time, which is already an integer value (the number of seconds since big ben rang out the new year in 1970), and turning it into a string-formatted time, naming that field "time_epoch" which is SUPER confusing because its values are string-formatted times, not epochtime integers. Then sorting by that string formatted time. This is a little odd but so far not really a problem - just weird since the original _time value can do all that perfectly well too. Wild guess - you're getting confused by the behavior of the Splunk UI - whenever it sees any field called "_time" it sneakily sneaks in and on-the-fly converts the display of those values to string-formatted times. However the values underneath are epochtime integers. you can always verify that I'm not talking crazy by doing | eval srsly_wat=_time Then anyway, back to our story the problem arises with this - | bin span=2m time_epoch that would make sense if time_epoch was actually an epochtime-valued field, ie if it held integer values. It makes no sense however in this case where the "time_epoch" field holds strings. Bin has no idea what to do with this combination of field and value, and so what it does is -- nothing at all. it throws no error but it does nothing. I think if you fix that core issue, you might be able to revisit what you're trying to do with the bin+makecontinuous +filldown. re-examining that fresh, with some fresh caffeine, is a good idea. index=infra_apps sourcetype=ca:atsys:edemon:txt | search Job=* | rename hostname as host | fields Job host Autosysjob_time Status _time | lookup datalakenodeslist.csv host OUTPUT cluster | mvexpand cluster | table Job Status host cluster _time | search cluster=* AND host=* | sort + _time | stats count by _time Job Status host cluster This is bit of an instinct, but I have seen many cases where people where folks are fiddling with bin+makecontinuous+filldown basically trying to recreate one of timechart's core use cases, beacuse they've come to believe that timechart can't do it. I hope this helps - I don't think it's your whole answer, but I think it clears some of the mess up and puts you in a better place. and i'll update this answer if you post back etc. ... View more

If you manually request the image, does splunkWeb return a 404 or a 200? It seems very similar to the longstanding problem where people add a new dashboard.js or application.js or application.css, but it doesn't get loaded until SplunkWeb is restarted. Thinking about all this, I can't remember if the root cause is that splunkWeb refuses to serve net-new static files until a restart, or if that condition applies only to appllication.* and dashboard.* and is more of a cache problem in the python code. Along the same line, if you can log into the host itself then another thing to try is to just restart splunkweb. splunk restart splunkweb Kicking splunk boots everyone out and makes everyone come at you with pitchforks. restarting just "splunkweb" wont do that and will generally just give everyone a few seconds of o_O while requests spin a bit. ... View more

Supported as of v3 for dbxquery which is great, but still not supported as dbinputs, it seems, which was the question ... View more

Looking at Sideview Utils release notes, it looks I added this feature exactly a week later, Version 2.6.4 released August 23rd 2013, has Added a requested feature to Tabs where it will now do $foo$ replacement into *static* tab values before it outputs them downstream. which is so long ago that it was about 48 releases and 243 release notes ago. ALSO anyone who has Sideview XML views and dashboards, should go to this page https://sideviewapps.com/apps/canary/ and after reading a bit, click the link that says "I maintain (or develop) custom dashboards or apps written with Sideview Utils" ... View more

What version of Splunk are you running? I actually hit a maddening problem that sounds like this, quite a few versions back and I resorted to weird things like setting crcSalt to random strings like "reindex this 17" when crcSalt=<SOURCE> mysteriously stopped working. At the time I had the option to clean that index and I think I did. And then the problem never returned but I had since upgraded Splunk. ... View more

I think it's because these are 32-bit PNG files. I downloaded them and looked at them and they do seem to have a bit depth of 32. Try saving them as 24-bit or better yet 8-bit png's. There won't be any loss since the images are pretty simple. I think it's quite possible that the code that is checking the file formats was just written before 32 bit pngs were a thing! I hope that helps. ... View more

Can you update the question with what your desired end goal is? It sounds like maybe you want a single number representing all answered calls from any of those 4 extensions? There are some other pieces that you want to introduce but before I start answering I want to make sure I understand the question. Ideally if you could give a brief description of the goal and then specify what you want the table columns to be, or what you want the chart to show? ... View more