I am upgrading my Splunk version from 6.3 to the latest and seeing the XML validation issue in one of my dashboards. Can anyone suggest another alternative for this? name="fields">$show_fields$ Seeing warning: Option "fields" is deprecated ... View more

I am importing LLP3 and LLP4 algorithms in splunk-6.3.1 from the below file but now we are trying to migrate to the latest version of splunk-7.2.1 and observed the below LLP3 and few algorithms are commented in splunk-7.2.1. So which algorithm should i import ? because i am using this class in my custom command. Is there any documentation related to this ? splunk-6.3.1 : ./splunk/lib/python2.7/site-packages/splunk/stats_util/statespace.py:71:class LLP3 splunk-7.2.1 : ./lib/python2.7/site-packages/splunk/stats_util/statespace.py:1649:#class LLP3(): ./lib/python2.7/site-packages/splunk/stats_util/statespace.py:1650:# ''' LLP3 follows LL for a while until it detects a period in the data, then it switches to LLP using that period. Any help is appreciated. Regards, Nagendra ... View more

Hello experts, I have a case where I need to show a field in a table, but I need to hide it in the chart. Search: index = ..... my search | stats ..... by field_1| eval field_1 = "Hello"| eval field_4 = "Hello\nHow are you"| table field_1, field_2, field_3 Table: field_1 field_2 field_3 1: Hello foo jjoooo How are you 2: Hello malware jhon How are you Issues: When try to use the field_1 in the bar chart, I see the value as empty because of a long string. I wasn't able to create a new field ( field_4) with previous value of field_1 and show it on the chart, but not in the table. The chart in the report takes input from the table. I need to hide the field_1 column in the table and want to display the field_4 in the bar chart. Note: I faced the same issue in the dashboard. I used fields tag in the xml to hide. Any help is appreciated. Regards, Nagee. ... View more