In the meantime I found the solution: https://community.splunk.com/t5/Dashboards-Visualizations/REST-API-for-Splunk-Dashboard-update-giving-error-for-complex/m-p/557379   ... View more

You are right of course. I managed to match it, but now the issue is, that the stacked column chart displays like 9 different SQL hashes + others and the pie chart way more of them + others. The not quite nice consequence is, that the color for "others" does not match. Would you know a chart option for both, stacked column and pie chart to restrict the number of displayed values say to 7 + "others"? I could not find it in the visualization options, so I guess this is some more advanced parameter I would use in the xml. ... View more

Unfortunately even after sorting both the same order, see the screenshot below, the colors assigned to both panels are different:   ... View more

I added your validation to the search of my fist panel, it is the UTC (see below,1637850000 = Realzeit: 25.11.2021 - 15:20:00 as per the converter): | noop search_optimization=false | dbxquery query="select to_char(SERIES_ROUND(timestamp, 'INTERVAL 5 MINUTE'), 'YYYY-MM-DD HH24:MI:SS') as TIMESTAMP, host, avg(cpu) as cpu from zspl_hsrvload_s where timestamp between '2021-11-24 15:00:00.0' and '2021-11-25 15:18:32.0' and sid_context_id = 'FA163EB49B521EEC91DD1B39CDB842DC' group by to_char(SERIES_ROUND(timestamp, 'INTERVAL 5 MINUTE'), 'YYYY-MM-DD HH24:MI:SS'), host" connection="HANA_S4_FRUN_FHP" | eval _time=strptime(TIMESTAMP,"%Y-%m-%d %H:%M:%S") | timechart span=5m avg(CPU) BY HOST | eval epoch_time = _time In the lower panel it gets subtracted and is one hour back - one can see it on the values passed to the SQL statement (1637846400 = 2021-11-25 14:20:00): | noop search_optimization=false | dbxquery query="select to_char(SERIES_ROUND(timestamp, 'INTERVAL 5 MINUTE'), 'YYYY-MM-DD HH24:MI:SS') as TIMESTAMP, host, avg(CPU) as METRIC from zspl_hsrvload_s where timestamp between '2021-11-24 14:00:00.0' and '2021-11-25 14:20:00.0' and datum between '20211124' and '20211125' and sid_context_id = 'FA163EB49B521EEC91DD1B39CDB842DC' group by to_char(SERIES_ROUND(timestamp, 'INTERVAL 5 MINUTE'), 'YYYY-MM-DD HH24:MI:SS'), host " connection="HANA_S4_FRUN_FHP" | eval _time=strptime(TIMESTAMP,"%Y-%m-%d %H:%M:%S") | timechart span=5m avg(METRIC) BY HOST | eval epoch_time = _time   ... View more

the %z makes the _time to be CET (my timezone/user timezone) and not UTC, which I do not want. Let me perhaps present the same issue on the below example of another dashboard: The upper panel is in UTC and it should be so, because the system to be monitored in this case is in the UTC/GMT.  Then the time selection between 6pm - 8pm leads to the wrong display in the below panel (5pm - 7pm), because the time token gets automatically corrected by the time zone settings of the user, which is CET. What I assume happens here is the dashboard '"thinks" the clicked/chosen values are in CET and automatically subtracts 1h to make it UTC, which is wrong. How would I correct it the best way? I assume I need to do some trick to the time tokens in code to clear them from the user timezone corrections and stay in UTC / original time of the monitored system. ... View more

... | eval _time=strptime(TIMESTAMP,"%Y%m%d%H%M") | timechart span=10m avg(AVG_WAITTIME) as "Avg. Wait Time ms", avg(AVG_RESPTIME) as "Avg. Response Time ms" then I take the $click.value$ from the chart, and it shifts the token by the user timezone. ... View more

Okay, you have the point. What I still do not understand is, why the dashboard chart accepts the _time (x-axis) being UTC and displays it also in UTC, but then when I click on the chart and want to drilldown using the token derived from the _time ($click.value$), it would automatically apply the timezone correction to this token, which in my case means subtracting one hour. This is then wrong.  Is there any way to tell the $click.value$ to take the value as it is without any transformations? ... View more

Yes, but this is precisely what I want: - let the $ts$ stay as it is and represent the number of seconds passed, etc, etc. But then I need another variable, which I need to derive from the $ts$ and reflect the timestamp plus timezone shift, and it should be also in the unix timestamp format. This will be another timestamp then, fine. How would I do such transformation / evaluate a new variable to get this? I know, from the perspective of Splunk and log search it does not make much sense perhaps, but I am going to use this variable to select from my database using a unix timestamp format over the |dbxquery and for that purpose I need this to be like that.  ... View more

@kamlesh_vaghela  Thank you. However I am not sure if I understand how this should work: - With the code below I got a multiselect field with the 1 - 10 numbers to choose. I also copied the a.js to the ../etc/apps/MYAPP/appserver/static. But somehow I do not see the chosen values to be filled in again when I refresh / restart the form.  Am I missing anything? Kind Regards, Kamil ... View more