Try adding the max_match parameter Here is a run anywhere example.  Please note that the resulted field from  max_match will be a multivalued field in case you want further operation on the field. | makeresults | eval _raw="here are some url and http://firsturl.com and some text again url http://www.secondurl.com and again some text URL http://www.third.com/" | rex max_match=0 "\b(?<domain2>(?:http?://|www\.)(?:[0-9a-z-]+\.)+[a-z]{2,63})/?"   ... View more

If you have identifier of each transaction such as transaction id, use stats to get the earliest and latest for e.g. your search |earliest(_time) as starttime,latest(_time) as endtime by transactionID|eval duration=endtime-starttime   ... View more

There are few things which we need to check before we check the search Is the file available for each date? Is the search produce some result for   index="BBB" host="AAA" sourcetype="CCC" earliest=-24h | eval dateFile=strftime(now(), "%Y-%m-%d") | where like(source,"%".dateFile."%Report.csv")   Does it still has some values in the column C1111? ... View more

Isn't this a duplicate question answered a week back ? https://community.splunk.com/t5/Splunk-Cloud-Platform/Single-card-value-background-color-change/m-p/685989#M3011 ... View more

By selection, if you meant the canvas, it can be adjusted by changing   Or directly in the code "layout": { "type": "absolute", "options": { "width": 1440, "height": 960 }, "structure": [], "globalInputs": [ "input_global_trp" ] }, ... View more

You might be able to change the layout type in the code. However, the coordinates and other configuration parameters need to be adjusted based on the dimensions. Make a clone/copy of the dashboard to try so that original dashboards are not affected   "layout": { "type": "grid", "options": { "width": 1440, "height": 960 },   Having said that, absolute layout type gives you lot of flexibility . https://docs.splunk.com/Documentation/Splunk/9.2.1/DashStudio/Layouts In your case, why cant you add all the tables into the canvas? The size of the canvas can be changes as you might have already explored. If you could share the dashboard code, probably we get a better idea about the actual situation.   ... View more

You can use the dynamic element color https://docs.splunk.com/Documentation/Splunk/9.2.1/DashStudio/ModifyDOS select background and set the color based on the status   Here is a run anywhere example Just change the status in the dropdown and you can see the color changes { "visualizations": { "viz_NJsTjQl4": { "type": "splunk.singlevalue", "options": { "backgroundColor": "> majorValue | matchValue(backgroundColorEditorConfig)", "majorColor": "#ffffff" }, "dataSources": { "primary": "ds_275I8YNY" }, "context": { "backgroundColorEditorConfig": [ { "match": "Stopped", "value": "#ad3f20" }, { "match": "Running", "value": "#207865" } ] } } }, "dataSources": { "ds_275I8YNY": { "type": "ds.search", "options": { "query": "| makeresults\n| eval value=\"$status$\"" }, "name": "Search_1" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, "input_BHJAbWl2": { "options": { "items": [ { "label": "Running", "value": "Running" }, { "label": "Stopped", "value": "Stopped" } ], "token": "status", "selectFirstSearchResult": true }, "title": "Status", "type": "input.dropdown" } }, "layout": { "type": "grid", "options": { "width": 1440, "height": 960 }, "structure": [ { "item": "viz_NJsTjQl4", "type": "block", "position": { "x": 0, "y": 0, "w": 1440, "h": 400 } } ], "globalInputs": [ "input_global_trp", "input_BHJAbWl2" ] }, "description": "", "title": "single_panel_studio" } ... View more

Ok, lets check if the results are available by just removing below from the dashboard depends="$hide_this_always$"  We need to confirm the sid is available since its part of the download path.  So either in the title of the panel or somewhere just display the token. If the result is available and sid is present, try using the URL directly in the browser to make sure that the result is fetched. Here is a sample dashboard created using the same logic and it works <dashboard version="1.1" theme="light"> <label>Download</label> <row> <!-- Below is the table with the results. We are setting the panel depends to a non existing token so that it always false the panel is not visible.--> <panel depends="$hide_always$"> <title>$sid$</title> <table> <search> <query>index=_*|stats count by sourcetype</query> <earliest>-15m</earliest> <latest>now</latest> <done> <eval token="date">strftime(now(), "%d-%m-%Y %H:%M:%S")</eval> <set token="sid">$job.sid$</set> </done> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel> <!-- Setting the title for testing purpose and making sure that the SID is available in the token --> <title>Job Id is : $sid$, Time is : $date$</title> <html> <a href="/api/search/jobs/$sid$/results?isDownload=true&amp;timeFormat=%25FT%25T.%25Q%25%3Az&amp;maxLines=0&amp;count=0&amp;filename=test_$date$.csv&amp;outputMode=csv" class="button js-button">Download</a> <style> .button { background-color: steelblue; border-radius: 5px; color: white; padding: .5em; text-decoration: none; } .button:focus, .button:hover { background-color: #2A4E6C; color: White; } </style> </html> </panel> </row> </dashboard> ... View more

@Splunkerninja, this is clearly not due to the row separation but the formation of the URL for getting the search results. So if the current dashboard is working for you with the search result URL, just make the first change by closing the </row> after the table panel and open another <row> element before the html element. This will ensure that the existing dashboard is working as expected. As a second step, change the visibility of the row where table is listed and set a "depends" clause with non existing token. ... View more

Its a very generic questions 🙂 You have a plenty of possibilities in network area  Authentication Firewalls Proxy WAF Perimeter securities Loadbalancing and so on Have a look at  https://www.splunk.com/en_us/blog/learn/network-security.html and https://www.splunk.com/en_us/blog/learn/network-monitoring.html  and probably you should get something to start with   ... View more

@vananhnguyen  For that we need to know what value comes to map it with a color.  We can transpose the result and set the result as column values and set the colors. Please check the following run anywhere example. makeresults is just used to create a set of dummy data { "visualizations": { "viz_PKMJkTej": { "type": "splunk.column", "options": { "y": "> primary | frameBySeriesNames('count','Critical','Failure','Info','Success')", "seriesColorsByField": { "Critical": "#dc4e41", "Failure": "#f8be34", "Success": "#53a051", "Info": "#0051B5" }, "x": "> primary | seriesByName('count')", "y2": "> primary | frameBySeriesNames('Critical','Failure','Info','Success')" }, "dataSources": { "primary": "ds_Lmyq9G4p" } } }, "dataSources": { "ds_Lmyq9G4p": { "type": "ds.search", "options": { "query": "| makeresults count=100 \n| eval value=random() \n| eval status=case(value%2==0,\"Success\",value%3==0,\"Failure\",value%4==0,\"Warning\",value%5==0,\"Critical\",1==1,\"Info\") \n| stats count by status \n| transpose header_field=status column_name=count" }, "name": "Search_1" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" } }, "layout": { "type": "absolute", "options": { "width": 1440, "height": 960, "display": "auto" }, "structure": [ { "item": "viz_PKMJkTej", "type": "block", "position": { "x": 0, "y": 0, "w": 1010, "h": 300 } } ], "globalInputs": [ "input_global_trp" ] }, "description": "", "title": "Static Colors" } ... View more

@pevniacik , makeresults are for me to create dummy events. It does not matter which search or values you use. What we need to look is whether the logic works for you. In this case, does the logic provided in the sample works for you with the checkbox and text input? If not, based on the sample dashboard what changes you foresee? ... View more

So you want to use a checkbox and not a multiselect. Both are different in splunk context. Here is the updated one. You can leave the checkbox and just filter in the text box or you can select the check box and the filter <form version="1.1" theme="light"> <label>CheckBox_Text</label> <fieldset submitButton="false"> <input type="checkbox" token="exclude" searchWhenChanged="true" id="checkbox"> <label>Select to exclude</label> <fieldForLabel>Project</fieldForLabel> <fieldForValue>Project</fieldForValue> <search> <query>|makeresults count=5|streamstats count |eval Project="Project".count|eval Record="Some records "|eval Record=if(count%2==0,Record,Record."Error")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> ,</delimiter> <prefix>AND NOT Project IN (</prefix> <suffix>)</suffix> <default>""</default> </input> <input type="text" token="text_filter" searchWhenChanged="true"> <label>Text to Filter</label> <default>*</default> </input> </fieldset> <row> <panel> <table> <search> <query>|makeresults count=5|streamstats count |eval Project="Project".count|eval Record="Some records "|eval Record=if(count%2==0,Record,Record."Error") |where NOT like (Record,"%$text_filter$%") $exclude$</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> ... View more

@vananhnguyen , Here is a run anywhere example. Are you looking for something like this ? You can change the value in the dropdown and the colors will be reset { "visualizations": { "viz_NJsTjQl4": { "type": "splunk.singlevalue", "options": { "majorColor": "> majorValue | matchValue(majorColorEditorConfig)" }, "dataSources": { "primary": "ds_275I8YNY" }, "context": { "majorColorEditorConfig": [ { "match": "Running", "value": "#118832" }, { "match": "Stopped", "value": "#d41f1f" } ] } } }, "dataSources": { "ds_275I8YNY": { "type": "ds.search", "options": { "query": "| makeresults\n| eval value=\"$status$\"" }, "name": "Search_1" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, "input_BHJAbWl2": { "options": { "items": [ { "label": "Running", "value": "Running" }, { "label": "Stopped", "value": "Stopped" } ], "token": "status", "selectFirstSearchResult": true }, "title": "Status", "type": "input.dropdown" } }, "layout": { "type": "grid", "options": { "width": 1440, "height": 960 }, "structure": [ { "item": "viz_NJsTjQl4", "type": "block", "position": { "x": 0, "y": 0, "w": 1440, "h": 400 } } ], "globalInputs": [ "input_global_trp", "input_BHJAbWl2" ] }, "description": "", "title": "single_panel_studio" }   Reference : https://docs.splunk.com/Documentation/Splunk/9.2.1/DashStudio/visualEditDynamic  ... View more

@Splunkerninja , Can we add another row only for the html panel and hide the result row/panel with a "depends" token? Something like <row> <panel depends="$hide_this_always$"> <table> <search> <done> <eval token="date">strftime(now(), "%d-%m-%Y")</eval> <set token="sid">$job.sid$</set> </done> <query>index=test</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> <row> <html> <a href="/api/search/jobs/$sid$/results?isDownload=true&amp;timeFormat=%25FT%25T.%25Q%25%3Az&amp;maxLines=0&amp;count=0&amp;filename=test_$date$.csv&amp;outputMode=csv" class="button js-button">Download</a> <style> .button { background-color: steelblue; border-radius: 5px; color: white; padding: .5em; text-decoration: none; } .button:focus, .button:hover { background-color: #2A4E6C; color: White; } </style> </html> </row> ... View more

You can make use of the KV store to store information and retrieve https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/  https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/ https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/uselookupswithkvstore/ Splunk JS can be then used to control the button actions and processing the record. There were some dev materials available explaining the overall process but looks like its removed. There are some third party documentation available in public for splunk KVStore CRUD   ... View more

@ravir_jbp , Did you try fillnull https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fillnull OR  replace in case its a literal value NULL https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Replace    ... View more