Hello !
I'd like to plot the result of a query on a 3 seperate maps (rt, last 24h, last 7d) but I'm facing a strange bug.
I've configured the "LinkSwitcher" in "independant" mode but it is designing a big box able to store the three maps, like in "serializedall" mode... As a result, I've got a big white box with my map on the top.
I've reproduced this bug with the other switchers modules.
Please, note that this bug disapears if I add other boxes using panel_row_col layouts, based on another HiddenSearch on a specified search window ( "-7d to now" for example). But if I specifies a realtime search window like that for example :
rt-5m
rt
the same bug appears again...
As a consequence, I think that there is something wrong with LinkSwitcher and rt hiddenSearch, but I don't know how to cope with that. The bad thing is that I can't fiddle with the css because I'm writing an independent App intended to be installed on splunk servers that I won't manage...
Fyi, I'm working with Splunk v5.0.1
PLease find below a little xml form which is producing my bug. I also have a screenshot if you want.
Thank you in advance
best regards
Julien
Overview
*
False
1
sourcetype=beeware AND bw_log_source != "Event Logs" bw_log_class=BLOCKED OR bw_log_class=ALERT | search icx_src_ip!=192.168.0.0/16 icx_src_ip!=10.0.0.0/8 icx_src_ip!=172.16.0.0/20 | stats count by icx_src_ip | eval count_label="Attack" | eval iterator="icx_src_ip" | eval iterator_label="Source IP" | eval zoom = "zoom=\"250%\" zoom_x=\"0%\" zoom_y=\"-75%\""| eval movie_color="#FF0000" | eval output_file="rt_threat_data.xml" | eval app="beeware" | lookup geoip clientip as icx_src_ip | mapit
rt-5m
rt
independent
rt_map.html
24h_map.html
7d_map.html
... View more