I have created a simple addon on Splunkbase that can identify bad CSV files in your environment: https://splunkbase.splunk.com/app/7497   ... View more

I have created a simple addon on Splunkbase that can identify bad CSV files in your environment: https://splunkbase.splunk.com/app/7497   ... View more

For anyone else like me in the future trying to get this to work, the solution from @ITWhisperer is for use in a dashboard. You should be able to get this to work outside a dashboard like so:  | inputlookup test.csv | map search="| makeresults | map search=\"$magic$\"" ... View more

Apologies for the delay in responding. I am not sure I understand the question properly. Are you able to please provide some more details?     The circlepack does allow for creating as many subgroups as you need - just keep adding more columns to your data (the last column should always be numbers) ... View more

Yep agree with @bowesmana .   If you try mock-up a screenshot @aru949 we can advise you better. All the best ... View more

Hi Ian,    I have taken another look at this, and I misunderstood your original request. I thought you were asking if its possible to make the nodes clickable to have them collapse and expand, but you are asking for a non-tree structure.   Common descendants is not something I can easily add to this sorry, that would be a different structure as Bowsmana said, there are other apps like the excellent Network Diagram Viz that should be able to do this for you.   All the best, Chris ... View more

Hi @ianthomas . Thanks for the suggestion, Ill take a look and see if I can make this work.  I am pretty slammed with work at the moment so it might be a little while sorry.   All the best, Chris ... View more

Glad to hear it!  Its a shame that the Splunk API for visualizations is a bit unclear and broken becuase I have always wanted to do what you are trying before,.    ... View more

VatsalJagani is 100% correct. Unfortunately its not possible to change a form.XXX token from the vis. It can be done using complicated javascript, but this is a real pain.  ... View more

I have just released a Splunkbase addon visualization that should be helpful to you. Download it here: https://splunkbase.splunk.com/app/6335/#/details ... View more

I have just released a Splunkbase addon visualization that should be helpful to you. Download it here: https://splunkbase.splunk.com/app/6335/#/details ... View more

I have finally added this functionality. Please download version 1.4.10 and let me know how you go. https://splunkbase.splunk.com/app/4657/ ... View more

I have fixed this bug in version 1.0.3  https://splunkbase.splunk.com/app/5153/    Thanks for taking the time to report this issue ... View more

I just released version 1.0.3 which allows for customising the colours: https://splunkbase.splunk.com/app/5153/  Let me know if you find any problems! ... View more

Yeah no worries, I will get this done in the next few days along with all the other changes I need to do.   Thanks for the suggestion 🙂 ... View more

Hi ebythomaspanick Yes this seems like a good idea. Leave it with me and I will try get it done in the next week or two. I will update here once complete. Thanks ... View more

hmm ok interesting. This should be fixable. Thanks for taking the time to report it. Ill reply here when I get it fixed, but I am on holidays at the moment so it might take a week or two. ... View more

Thanks bowsmana these are some great ideas. I am just on holidays at the moment but I will try get this sorted out as soon as possible. Thanks for your kind words. ... View more

I have updated the Flow Map viz (to version 1.4.9) so that you can now stack nodes underneath everything else by setting the "order" field to a negative value.   https://splunkbase.splunk.com/app/4657/ ... View more

The Number Display VIz  https://splunkbase.splunk.com/app/4537/ allows you to do an unlimited tiled trellis view.      Disclaimer: I wrote this app ... View more

Thank you for reporting this problem. I figured out what was causing the problem and I have pushed a new version to Splunkbase. OK Please download version 1.4.9 from here: https://splunkbase.splunk.com/app/4353/   Best of luck and let me know if you have any more problems ... View more

can you do the same commands as before bin\splunk cmd python and now try running this command: import os, subprocess; env_copy = os.environ.copy(); p = subprocess.Popen(['bin\\splunk', 'btool', 'check', '--debug'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, shell=False, env=env_copy); o = p.communicate(); o Thanks ... View more

I am sorry but this is unfortunatly this is not possible. Ill note it down to my change backlog but its unlikely I will get time to add an option for this. If many people comment/vote on this answer then I will prioritise it. All the best, Chris ... View more

Thanks for providing this output. The only anomaly I can find is that there is an extra comma appearing after the RANDFILE key. I have no idea how this has entered into the OS environment but it might indicate an environment variable with no name.. I wonder if you can find it by right click "This PC" > "Properties" > Environment variables > check both boxes. You also didn't mention what version of Splunk you are using, but some of my research indicates this might resolve if you use Python 3 - this will happen if you are using Splunk 8 and above. All the best and let me know what you find out. Cheers. Chris ... View more