Activity Feed
- Posted Re: How to refresh multiselect options with Javascript (re-execute the mutliselect search) on Splunk Search. 01-16-2025 06:36 PM
- Posted Re: Illumio Logo Update on Feedback. 01-16-2025 06:11 PM
- Got Karma for Re: Passing token value to another dashboard. 09-26-2024 10:29 PM
- Got Karma for Re: How to color a table column based on values selected from radio buttons. 09-05-2024 07:48 PM
- Karma Re: Splunk Timeline - Custom Visualization - Get the X-Axis to not move for bowesmana. 08-01-2024 06:37 PM
- Got Karma for Re: Event Timeline Viz Timezone Displayed Not Aligned with Splunk Timezone Setting. 06-24-2024 12:50 PM
- Got Karma for Re: Event Timeline Viz Timezone Displayed Not Aligned with Splunk Timezone Setting. 06-24-2024 12:50 PM
- Got Karma for Re: Event Timeline Viz Timezone Displayed Not Aligned with Splunk Timezone Setting. 06-23-2024 04:04 PM
- Got Karma for Re: Event Timeline Viz Timezone Displayed Not Aligned with Splunk Timezone Setting. 06-23-2024 03:39 PM
- Posted Re: Event Timeline Viz Timezone Displayed Not Aligned with Splunk Timezone Setting on Dashboards & Visualizations. 06-23-2024 03:35 PM
- Posted Re: Event Timeline Viz Timezone Displayed Not Aligned with Splunk Timezone Setting on Dashboards & Visualizations. 06-17-2024 09:42 PM
- Posted Re: How to make the URL hyperlink which is in the fields value of the table (Dashboard Studio - JSON format) on Splunk Search. 05-30-2024 04:01 PM
- Posted Re: How to make the URL hyperlink which is in the fields value of the table (Dashboard Studio - JSON format) on Splunk Search. 05-23-2024 10:55 PM
- Posted Re: How to Filter over 50K on different indexes/sources? on Splunk Search. 05-23-2024 10:24 PM
- Got Karma for Re: Set the index with a field when using collect command. 05-10-2024 09:05 AM
- Posted Re: Set the index with a field when using collect command on Splunk Search. 05-09-2024 10:15 PM
- Posted Re: Background Color for single card value on Splunk Dev. 05-09-2024 08:19 PM
- Posted Re: Combining static single-word from lookup table with sentence on Splunk Search. 05-09-2024 04:13 PM
- Posted Re: How do I add a dashboard link to the App? on Splunk Search. 05-09-2024 03:51 PM
- Got Karma for Re: Conditionally show/hide panels based on dropdown selection in Dashboard Studio. 05-08-2024 08:32 PM
Topics I've Started
No posts to display.
01-16-2025
06:36 PM
Hi @Afterimage, There is an option to force the dropdown to re-run the search every X seconds. Go into the Edit view and add this to the search: <refresh>30</refresh>
<refreshType>delay</refreshType> Like this: That will make the lookup search re-run every 30 seconds, picking up any new values in the process. -Spav
... View more
01-16-2025
06:11 PM
Hi @jacy-illumio, The app you linked to was created by Illumio Inc. There is also a companion app called the Illumio Technology Add-On for Splunk. The logos are found in the GIT repo here: https://github.com/illumio-shield/illumio-splunk-app/tree/main/IllumioAppforSplunk/static Someone from Illumio who has access to this GIT repo (Duncan S. was the last to make an update) can update the logos, package the app, and update the app on Splunkbase. -Spav
... View more
06-23-2024
03:35 PM
3 Karma
Version 1.9.0 of Event Timeline Viz is up on Splunkbase now: https://splunkbase.splunk.com/app/4370 Added support for different locales, based on what you've set in Splunk. Supported locales: English, Italian, Dutch, German, French Note that tooltips and example dashboards will still appear in English. Fixed bug where the time shown on the visualization was reflecting the time zone of the client OS, not the user preference set in Splunk. Fixed bug with the 'Disable Zoom' option where zoom could still be enabled when it was set to false.
... View more
06-17-2024
09:42 PM
1 Karma
Hi @ianthomas, Looks like that is a bug - I've never noticed it because my computer and Splunk time zones have always been in sync. The issue comes because the "now" time is generated via JavaScript, and so it obeys the time zone of the local PC. I can make a tweak to ensure that the time zone set by Splunk is used to generate "now". I'll let you know when I've posted an update to the app on Splunkbase. Cheers. Daniel
... View more
05-30-2024
04:01 PM
Hi @SureshkumarD, I tried out your code - the rows aren't showing up as links because of the table formatting / row color setting. Remove this line from your code: "rowColors": "> rowBackgroundColors | maxContrast(tableRowColorMaxContrast)", That is causing the "link" effect on the clickable rows to disappear. Here's the full viz code: "visualizations": {
"viz_qFxEKJ3l": {
"type": "splunk.table",
"options": {
"count": 5000,
"dataOverlayMode": "none",
"drilldown": "none",
"backgroundColor": "#FAF9F6",
"tableFormat": {
"rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)",
"headerBackgroundColor": "> backgroundColor | setColorChannel(tableHeaderBackgroundColorConfig)",
"headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)"
},
"eventHandlers": [
{
"type": "drilldown.customUrl",
"options": {
"url": "$row.URL.value|n$",
"newTab": true
}
}
], Give that a go on your dashboard.
... View more
05-23-2024
10:55 PM
Hi @SureshkumarD, To get the drilldown working from a field in a table you can use the drilldown options: "eventHandlers": [
{
"type": "drilldown.customUrl",
"options": {
"url": "$row.URL.value|n$",
"newTab": true
}
}
] You can set that up in the UI with the following:
... View more
05-23-2024
10:24 PM
Hi @sumarri, I created a dummy search to mock up your data, and created a lookup with 104,000 entries: | makeresults count=140000
| streamstats count as id
| eval account="account" . substr("000000000".tostring(id),-6), keep="true"
| table account, keep
| outputlookup "accounts_to_keep.csv" This will be our lookup file, replicating what you have in your lookup. It has the account ID and a "keep" field, and that's it. Next, I created a dummy search to generate a bunch of data, with accounts we don't care about and the 104,000 we do care about: | makeresults count=200000
| streamstats count as id
| eval account="account" . substr("000000000".tostring(id),-6)
| eval data=random()%10000, label="whatever", _time=relative_time(now(), "-" + tostring(random()%1000) + "m")
| table account, data, label, _time To use the lookup to identify the accounts we want to keep you can use this SPL: | inputlookup accounts_to_keep.csv append=t
``` use eventstats if stats messes up your data
| eventstats values(keep) as keep by account
```
| stats values(*) as * by account
| search keep="true"
| fields - keep This add the contents of the lookup to the results (append=t) Then we use stats to combine the keep field with the events in the search If this messes up your data, you can run eventstats instead, but that may run into memory issues with massive result sets. Finally, we search for all the events where the keep field is set to "true" Depending on how big your lookup gets, you may want to make the lookup a KV store collection.
... View more
05-09-2024
10:15 PM
1 Karma
Hi @ejwade, I'm with @bowesmana on this - I don't think it's possible to run | collect with multiple index locations. You could do this instead: | makeresults count=2
| streamstats count
| eval index = case(count=1, "myindex1", count=2, "myindex2")
| appendpipe[| search index="myindex1"| collect index=myindex1]
| appendpipe[| search index="myindex2"| collect index=myindex2] You will need an appendpipe command for each index you want to export to, but you should know the destination indexes in advance anyway.
... View more
05-09-2024
08:19 PM
Hi @PATAN, With Dashboard Studio, you can either dynamically color the text OR the background - as far as I know, you can't do both. You could achieve this effect a couple of ways though - create two visualisation panels, one for Dropped, and one for NotDropped, and make them show/hide depending on the value of the token. Another option (if you are using Absolute mode) is to put a square behind the single value box which colors itself based on the token, and the single value changes the text color based on the token (with a transparent background). Here's some example code: {
"visualizations": {
"viz_UVeH0JP5": {
"type": "splunk.singlevalue",
"dataSources": {
"primary": "ds_VyZ1EWbM"
},
"options": {
"majorColor": "> majorValue | matchValue(majorColorEditorConfig)",
"backgroundColor": "transparent"
},
"context": {
"majorColorEditorConfig": [
{
"match": "NotDropped",
"value": "#2f8811"
}
]
}
},
"viz_eKO2ikid": {
"type": "splunk.rectangle",
"options": {
"fillColor": "> fillDataValue | rangeValue(fillColorEditorConfig)",
"rx": 10,
"strokeColor": "> strokeDataValue | matchValue(strokeColorEditorConfig)"
},
"context": {
"fillColorEditorConfig": [
{
"value": "#171d21",
"to": 100
},
{
"value": "#088F44",
"from": 100
}
],
"fillDataValue": "> primary | seriesByType(\"number\") | lastPoint()",
"strokeDataValue": "> primary | seriesByType(\"number\") | lastPoint()",
"strokeColorEditorConfig": [
{
"match": "Dropped",
"value": "#D41F1F"
},
{
"match": "NotDropped",
"value": "#d97a0d"
}
]
},
"dataSources": {
"primary": "ds_dSLmtNBD"
}
}
},
"dataSources": {
"ds_VyZ1EWbM": {
"type": "ds.search",
"options": {
"query": "| makeresults\n| eval value=\"$status$\"\n| table value"
},
"name": "dummy_search"
},
"ds_dSLmtNBD": {
"type": "ds.search",
"options": {
"query": "| makeresults\n| eval value=if(\"$status$\"=\"Dropped\",100,0)\n| table value"
},
"name": "background"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-24h@h,now"
},
"title": "Global Time Range"
},
"input_I2IoVEpX": {
"options": {
"items": [
{
"label": "Dropped",
"value": "Dropped"
},
{
"label": "Not Dropped",
"value": "NotDropped"
}
],
"token": "status",
"selectFirstSearchResult": true
},
"title": "Dropdown Input Title",
"type": "input.dropdown"
}
},
"layout": {
"type": "absolute",
"options": {
"width": 1440,
"height": 960,
"display": "auto"
},
"structure": [
{
"item": "viz_eKO2ikid",
"type": "block",
"position": {
"x": 610,
"y": 180,
"w": 250,
"h": 130
}
},
{
"item": "input_I2IoVEpX",
"type": "input",
"position": {
"x": 630,
"y": 70,
"w": 198,
"h": 82
}
},
{
"item": "viz_UVeH0JP5",
"type": "block",
"position": {
"x": 610,
"y": 180,
"w": 250,
"h": 130
}
}
],
"globalInputs": [
"input_global_trp"
]
},
"description": "",
"title": "colors"
}
... View more
05-09-2024
04:13 PM
@alfredoh14, Here's some SPL that gives you a table with the app name, short name, and SQL: | makeresults count=3
| streamstats count as id
| eval sql=case(id=1,"'' as \"FIELD\",''Missing Value'' AS \"ERROR\" from scbt_owner.SCBT_LOAD_CLOB_DATA_WORK",
id=2,"'' as \"something \",''Missing Value'' AS \"ERROR\" from ART_owner.ART_LOAD_CLOB_DATA_WORK",
id=3, "from Building_Mailer_owner.Building_Mailer_")
| fields sql
``` The above was just to create the source data ```
| rex field="sql" "from\s+(?<lk_wlc_app_short>.+?)_owner"
| lookup lookup_weblogic_app lk_wlc_app_short
| table lk_wlc_app_short, lk_wlc_app_name, sql The regular expression pulls out the table name in the SQL, eg "from XXXX_owner", and uses the short code to match the app name from the lookup. To make the lookup work, you will need to ensure that the matches are NOT case sensitive, or make sure your lookup fields match what is in the SQL.
... View more
05-09-2024
03:51 PM
hi @Elupt01, You can update the navigation menu to include links to all of you dashboards. If you go to: Settings > User Interface > Navigation Menus > default You will see a text box where you can put in XML to define your navigation. There are a few ways to show items. Note: DASHBOARD_NAME refers to the name of the dashboard as seen in the URL, not the title. To link a single dashboard on the main navigation bar use this format: <view name="DASHBOARD_NAME" /> To create a dropdown with a bunch of dashboards, use this format: <collection label="Team Dashboards">
<view name="DASHBOARD_NAME_1" />
<view name="DASHBOARD_NAME_2" />
<view name="DASHBOARD_NAME_3" />
</collection> If you want the dashboards to be automatically added to the menu when you create them, use this format: <collection label="Team Dashboards">
<view source="unclassified" />
</collection> The "unclassified" here means it will list all dashboards not explicitly mentioned in the navigation menu. There are a few other tricks you can do, like using URLs as menu links: <a href="https://company.intranet.com" target="_blank">Team Intranet Page</a> Have a look at the dev docs for more detailed info: https://dev.splunk.com/enterprise/reference/dashboardnav/
... View more
05-08-2024
05:56 PM
1 Karma
Hi @davilov, Here's a way I've found to hide/show a panel based on a dropdown. It depends on 3 steps: Define a dropdown with options for each panel you'd like to show/hide, in this example I've called the token "show_panel", and we choose to show/hide two panels or show them all. Set your panel visualisations to hide when there is no data, under the "Visibility" setting: Update the searches for your visualisations to compare a known string (i.e. the possible token values) to the current token value: ``` I only want to show this panel if we have
selected "Bar Chart" from the drop down:```
| eval _show="Bar Chart"
| search _show="$show_panel$"
| fields - _show You can get a bit fancier by creating chain searches to compare the text so that the search doesn't rerun every time you change the dropdown. Here's a sample dashboard: {
"visualizations": {
"viz_QNQd730H": {
"type": "splunk.table",
"title": "Table of data",
"dataSources": {
"primary": "ds_BGrBVi8Q"
},
"hideWhenNoData": true
},
"viz_JM2qhOeK": {
"type": "splunk.bar",
"title": "Bar Chart",
"dataSources": {
"primary": "ds_KD6bNQc9"
},
"options": {
"xAxisTitleText": "Time",
"xAxisLineVisibility": "show",
"yAxisTitleText": "Score",
"yAxisLineVisibility": "show",
"yAxisMajorTickVisibility": "show",
"yAxisMinorTickVisibility": "show"
},
"hideWhenNoData": true
}
},
"dataSources": {
"ds_BGrBVi8Q": {
"type": "ds.search",
"options": {
"query": "| windbag\n| table source, sample, position\n| eval _show=\"Table\"\n| search _show=\"$show_panel$\"\n| fields - _show"
},
"name": "table_search"
},
"ds_KD6bNQc9": {
"type": "ds.search",
"options": {
"query": "| gentimes start=-7\n| eval score=random()%500\n| eval _time = starttime\n| timechart avg(score) as score\n| eval _show=\"Bar Chart\"\n| search _show=\"$show_panel$\"\n| fields - _show"
},
"name": "barchart"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-24h@h,now"
},
"title": "Global Time Range"
},
"input_hs0qamAf": {
"options": {
"items": [
{
"label": "All",
"value": "*"
},
{
"label": "Bar Chart",
"value": "Bar Chart"
},
{
"label": "Table",
"value": "Table"
}
],
"defaultValue": "*",
"token": "show_panel"
},
"title": "Choose you panel",
"type": "input.dropdown"
}
},
"layout": {
"type": "grid",
"options": {
"width": 1440,
"height": 960
},
"structure": [
{
"item": "viz_QNQd730H",
"type": "block",
"position": {
"x": 0,
"y": 0,
"w": 720,
"h": 400
}
},
{
"item": "viz_JM2qhOeK",
"type": "block",
"position": {
"x": 720,
"y": 0,
"w": 720,
"h": 400
}
}
],
"globalInputs": [
"input_global_trp",
"input_hs0qamAf"
]
},
"description": "https://community.splunk.com/t5/Dashboards-Visualizations/Conditionally-show-hide-panels-based-on-dropdown-selection-in/m-p/686803#M56222",
"title": "Splunk Answers Post"
}
... View more
04-28-2024
04:54 PM
1 Karma
Hi @theprophet01, To get a summary of entities with their info tags you can run the excellent query by sandrosov_splun: | rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/entity report_as=text
| eval value=spath(value,"{}")
| mvexpand value
| eval info_fields=spath(value,"informational.fields{}"),
alias_fields=spath(value,"identifier.fields{}"),
entity_id=spath(value, "_key"),
entity_title=spath(value, "title"),
entity_name=spath(value, "identifying_name")
| appendpipe
[| mvexpand alias_fields
| eval field_value = spath(value,alias_fields."{}"), field_type="alias"
| rename alias_fields as field_name
]
| appendpipe
[| where isnull(field_type)
| mvexpand info_fields
| eval field_value = spath(value,info_fields."{}"), field_type="info"
| rename info_fields as field_name
]
| where isnotnull(field_type)
| table entity_id entity_name entity_title field_name field_value field_type This will give you results similar to this: To list the services, you can call the "getservice" custom command that comes with ITSI: | getservice
| table title, serviceid, description, service_tags, kpis, service_depends_on, services_depending_on_me, enabled, base_service_template_id, entity_rules, * That gives you these results: Cheers, Daniel
... View more
04-25-2024
05:13 PM
Hi @Splunkerninja, If your sample data is: Sample data : nCountry: United States\nPrevious Country Can you try updating your field extraction to use: nCountry:\s(?<country>.+?)\\nPrevious\sCountry Only two tweaks: No need to escape the : character The text in the sample is "\n" - we need to escape the backslash with two backslashes. If you use three that translates to a single backslash followed by a new line.
... View more
04-25-2024
05:04 PM
Your best bet to switch from a chart to a table is to show/hide pre-built panels using tokens. Tables have different options in the XML code - e.g. column formatting, coloring, drill-downs, highlighting when the mouse hovers. None of these options are relevant for a chart visualization type. The main reason you can't use tokens to change from a chart to a table vis is that the charts use a <chart> tag, while the table vis uses a <table> tag. Simple XML doesn't support using tokens to set XML tags in the dashboard code like that. The cleanest way, in my opinion, is to have hidden panels that you switch between using tokens.
... View more
04-23-2024
08:18 PM
Hi @GaryZ, As far as I understand, this is not possible with dashboard studio so the best solution would be to have both charts there, but only one displaying depending on the token. However, you can do it with Classic Dashboards (i.e. simple XML dashboards). Here's an example: <form version="1.1" theme="light">
<label>Splunk answers</label>
<fieldset submitButton="false">
<input type="dropdown" token="chart" searchWhenChanged="true">
<label>Chart Style</label>
<choice value="line">Line Chart</choice>
<choice value="column">Bar Chart</choice>
<default>line</default>
<initialValue>line</initialValue>
</input>
</fieldset>
<row>
<panel>
<title>Chart</title>
<chart>
<search>
<query>| gentimes start=-20
| eval sample=random()%100
| eval _time = starttime
| timechart span=1d max(sample) as value</query>
<earliest>-20d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.chart">$chart$</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</form> The trick here is to create a token with the value of the chart you'd like to show ("line" or "column") and then use that token in the XML: <option name="charting.chart">$chart$</option> This might get annoying to develop though, as you can't edit the chart while this value is set. You can always change it while editing and then change it back when you're done.
... View more
04-23-2024
04:02 PM
1 Karma
Hi @MattKr, Here's an option that will run from the UI. | rest /services/data/indexes splunk_server=local
| stats count by title | rename title as index
| map [| metadata type=sourcetypes index=$index$ | eval index="$index$"] maxsearches=100 In the first line, make sure splunk_server=<NAME OF INDEXER>, for Splunk Cloud local is fine. Make the maxsearches=XXX match the total number of indexes you have. This uses the metadata command to get the sourcetypes, and earliest/latest times, and the number of matching events. The one drawback is that the index isn't included in the results, so I've set it up via the map command so it will run the metadata search for each index. Couple of things to note: This will run as many searches as you have indexes - so be careful. The metadata search is lightening fast as it only runs on the index metadata (hence the name) so there's no real data being brought back - just data about the index. You need to run it as an all-time search to get all of your data... Pick a time to do this to reduce any impact. I ran the search on a small cloud environment with 52 indexes over all time and it completed in 4.9s. Give that a go.
... View more
04-04-2024
10:29 PM
1 Karma
안녕하세요 릴리, 두 차트는 사용된 시간 범위로 인해 다르게 나타납니다. 첫 번째 차트는 데이터가 있는 경우에만 차트에 선을 표시하는 Splunk 검색에서 가져온 것입니다. 두 번째 차트는 데이터가 없더라도 "전체 기간"에 대한 타임라인을 표시하는 Dashboard Studio의 차트입니다. 차트 2를 차트 1처럼 보이게 하려면 데이터와 일치하도록 시간 범위를 설정하면 됩니다. 데이터와 일치하도록 시간 범위를 설정하면: (저는 한국어를 잘 못해서 번역기를 사용해야 했어요.)
... View more
04-03-2024
09:48 PM
1 Karma
Hi @viktoriiants., How about something like this: index=_internal
| eval dayOfWeek=strftime(_time, "%A"), date=strftime(_time, "%Y-%m-%d")
| eval dayNum=tonumber(strftime(_time,"%w")) + 1 ``` 1=Sunday, ..., 7=Saturday```
| stats count as "Session count" by dayOfWeek, date
| addtotals col=t row=f
| eval sort = if(isnull(date),1,0)
| sort - sort + date
| fields - sort Here we're creating a new temporary field to sort on, where we set it to 1 for our total row, and 0 for all other rows. Then we sort by this column and the date column. Finally, we remove the "sort" column.
... View more
04-03-2024
05:24 PM
1 Karma
Hi @karthi2809, Try this CSS: #input_link_split_by {width:fit-content!important;}
#input_link_split_by.input-link button{
width: fit-content!important;
margin-right:2px;
background-color: #3c444d;
border-top-color: #3c444d;
border-top-style: solid;
border-top-width: 1px;
border-right-color: #3c444d;
border-right-style: solid;
border-right-width: 1px;
border-left-color:#3c444d;
border-left-style: solid;
border-left-width: 1px;
border-top-left-radius: 10px;
border-top-right-radius: 10px;
transition: background-color 0.5s ease;
transition: border-color 0.5s ease;
}
#input_link_split_by button:hover{
background-color:#d2e3a0;
border-right-color: #d2e3a0;
border-top-color:#d2e3a0;
border-left-color:#d2e3a0;
color: black;
}
#input_link_split_by button[aria-checked="true"]{
background-color: #d2e3a0;
color: black;
} That gives you tabs that keep their colour after you have selected them: The key bit is: #input_link_split_by button[aria-checked="true"] Which is the CSS to identify a selected tab. Cheers, Spav
... View more
04-02-2024
11:30 PM
1 Karma
@NoIdea, There are different namespaces for tokens - default, submitted, and environment. You're running into the issue because you're using the "default" tokens. These are the ones we normally use as they are updated on the fly, whereas the submitted tokens are only updated after clicking the submit button. You can refer to these tokens using the namespace followed by a colon, eg: Default: $tok1$ Submitted: $submitted:tok1$ I've tried to understand the values you've put for the tokens and made an alternative dashboard showing the use of submitted tokens: <form version="1.1" theme="light">
<label>answers</label>
<fieldset submitButton="true" autoRun="false">
<input type="dropdown" token="tok1" searchWhenChanged="false">
<label>Tok1</label>
<choice value="All">*</choice>
<choice value="" "AND upper(STATUS)=upper('Active')"">Y</choice>
<choice value="" "AND upper(STATUS)=upper('Inactive')"">N</choice>
<prefix>Status="</prefix>
<default>*</default>
</input>
<input type="text" token="tok2" searchWhenChanged="false">
<label>UserID</label>
<default></default>
<prefix> AND UserID=\"*" + upper(</prefix>
<suffix>) + "*"</suffix>
</input>
</fieldset>
<row>
<panel id="table_1">
<html><h2>Using $$tok1$$</h2><table><tr><td><strong>$$tok1$$=</strong></td><td><textarea>$tok1$</textarea></td></tr><tr><td><strong>$$tok2$$=</strong></td><td><textarea>$tok2$</textarea></td></tr></table>
<style>textarea{padding: 4px; font-size:16px;resize:none;width: 300px;border: 1px solid black;}
div[id^="table"] td{border:1px solid black;padding: 4px;} div[id^="table"]{width: fit-content; }
</style>
</html>
</panel>
</row>
<row>
<panel id="table_2">
<html><h2>Using $$submitted:tok1$$</h2><table><tr><td><strong>$$submitted:tok1$$=</strong></td><td><textarea>$submitted:tok1$</textarea></td></tr><tr><td><strong>$$submitted:tok2$$=</strong></td><td><textarea>$submitted:tok2$</textarea></td></tr></table></html>
</panel>
</row>
<row>
<panel>
<html><h2>The Search</h2>| search * $submitted:tok1$ $submitted:tok2$ </html>
</panel>
</row>
</form> By putting your evals and conditionals directly into the values the form should work: Hopefully that gets you closer to what you're after. There is another way to tackle this - but I don't quite understand your search. It's almost SPL but not quite. If the above isn't what you're after, can you explain your search a bit more?
... View more
04-02-2024
08:56 PM
I think I understand - try this search to create a table with fields: _time, percentage and one or more columns based on the value calculated each hour: | gentimes start=-7
| eval sample=random()%100
| eval perc=random()%50
| rename starttime as _time
| append[|makeresults | eval sample=100, perc=45| table _time, sample, perc]
| timechart span=1d max(sample) as name, avg(perc) as "percentage"
``` Calculate how we name the fields based on the value of: name ```
| eval rename_field_to=if(name=100,"C","N/A")
| eval "The Sample Yields {rename_field_to}" = name
| fields - rename_field_to, name This will create three or four columns: _time = time percentage = hourly average of the perc field The Sample Yields C = If the max for that hour was 100 The Sample Yields N/A = If the max for that hour was not 100 If you only want "The Sample Yields C" or nothing, then you can filter out with a | search name="C" after the timechart command. The main SPL is : | eval "The Sample Yields {rename_field_to}" = name That will allow you to name a field using the value of another field. If you want NA to simply be N/A then you can do a rename: | rename "The Sample Yields N/A" as "N/A" Is that closer to what you were after?
... View more
04-02-2024
08:38 PM
Ok, here's a quick fix to stop any dashboards loading after a page refresh: <condition value="dash_a">
<link target="_blank">/app/search/dash_a</link>
<set token="form.link_dash"></set>
<set token="link_dash"></set>
</condition> This will only create a new window with a dashboard if the token matches dash_a, and do nothing if it's blank. Once we load the dashboard, we reset the token (both form.token and token) to an empty string. That way if the page reloads, we do nothing. We can also make the condition statement a bit smarter. If you set the choice values to be the name of the dashboard you want to load, we can do this: Final Version <form version="1.1" theme="light">
<label>Dash_C</label>
<fieldset submitButton="false">
<input type="link" token="link_dash">
<label>View other Dashboard:</label>
<choice value="dash_a">Dashboard 1 ↗</choice>
<choice value="dash_b">Dashboard 2 ↗</choice>
<choice value="dash_c">Dashboard 3 ↗</choice>
<change>
<condition value="">
</condition>
<condition>
<link target="_blank">/app/search/$link_dash$</link>
<set token="form.link_dash"></set>
<set token="link_dash"></set>
</condition>
</change>
</input>
</fieldset>
<row><panel depends="$CSS$"><html><style>
.splunk-linklist{width:fit-content!important;}
.splunk-linklist button{ min-width: 120px;}
.splunk-linklist button span{ -webkit-box-pack: left; justify-content: left;-webkit-box-align: left; align-items: left;}
.splunk-linklist button{background-color: #dddddd82;margin: 4px 2px 0px 0px; transition: 0.3s;}
.splunk-linklist button:hover {background-color:#007abd!important;color:white!important;}</style></html></panel>
</row>
</form> The condition block will do nothing if the link_dash token is blank, but will load the dashboard in $link_dash$ if it's not blank. It then sets the token to "" so it won't load the dashboard again on a refresh. By using the <condition> as above, it allows you to add as many dashboards as you want via the dropdown UI without needing to update the code.
... View more
04-01-2024
03:39 PM
Hi @joelsz, Using Splunk 9.1.0 I set up 3 dashboards: dash_a, dash_b, dash_c When you click a button it loads the corresponding dashboard, and that's all. I've added some starter CSS to pretty up the buttons: <form version="1.1" theme="light">
<label>Dash_C</label>
<fieldset submitButton="false">
<input id="linkToOtherDash" type="link" token="link_dash">
<label>View other Dashboard:</label>
<choice value="dash_a">Dashboard 1 ↗</choice>
<choice value="dash_b">Dashboard 2 ↗</choice>
<choice value="dash_c">Dashboard 3 ↗</choice>
<change>
<condition value="dash_a">
<link target="_blank">/app/search/dash_a</link>
</condition>
<condition value="dash_b">
<link target="_blank">/app/search/dash_b</link>
</condition>
<condition value="dash_c">
<link target="_blank">/app/search/dash_c</link>
</condition>
</change>
</input>
</fieldset>
<row><panel depends="$CSS$"><html><style>
.splunk-linklist{
width:fit-content!important;
}
.splunk-linklist button{
min-width: 120px;
}
.splunk-linklist button span{
-webkit-box-pack: left;
justify-content: left;
-webkit-box-align: left;
align-items: left;
}
.splunk-linklist button{
background-color: #dddddd82;
margin: 4px 2px 0px 0px;
transition: 0.3s;
}
.splunk-linklist button:hover {
background-color: #007abd!important;
color: white!important;
}
</style></html></panel>
</row>
</form> Note that if you click a button, then go back to the original dashboard and click edit then cancel, it will load the second dashboard again. If you want to avoid that then update the links and remove target="_blank" .
... View more
04-01-2024
03:02 PM
Hi @deepdive100., You can create the column name based on what the field "name" is set to using by: |makeresults
|eval sample="100"
|eval name=if(sample=100,"C",N/A)
|timechart max(sample) by name This creates a table with columns: _time, C. If the values are less or more than 100, there'll be an additional column "N/A" If you have a dashboard and you want to pick which column is displayed, you could do something like: |makeresults
|eval sample="100"
|eval name=if(sample=100,"$DROPDOWN_TOKEN$",N/A)
|timechart max(sample) by name And set up an input that sets the token $DROPDOWN_TOKEN$.
... View more