Hello Splunkers, Is there a way to add padding or control white space between the single value blocks in the aggregated fields? i.e I have three blocks created in single-value using the trellis viz. This creates three nice blocks, but I would like to increase the white space between them if possible. Or use 3 separate single value viz, and space them with padding, etc. thank you for a great resource, eholz ... View more

Hello Members, This is a great source of information and help. I am using the Splunk Add on for Squid Proxy. I am getting data from the squid access log in the recommended splunk format. The dashboard that comes with the install is find. I am creating another dashboard based on that dashboard. I am monitoring bytes_in, bytes_out, and bytes. It seems that the Splunk search for bytes is the total of bytes_in and bytes_out. I am using a search that returns the sum of bytes_out using | status sum(bytes_out) for all src_ips. like this: index=squid | stats sum(bytes_out) as TotalBytes | eval gigabytes=TotalBytes/1024/1024/1024 | table gigabytes I do the same thing for "bytes"  Is there some way I can create a visualization, using a single value viz, so I can show bytes per time? Like x bytes / hour, maybe even one of those gauges? I would like to use a time picker with this as well - or a selectable span, etc Would the "timechart" allow me to do this? Thanks so much, eholz1   ... View more

Hello All, I am running Splunk 9.0.2 on Oracle 8.6. We monitor Cisco devices. These devices require using port 514 to forward their syslogs to splunk. We are running splunk as a non-root user. How can we configure Splunk to allow access to port 514? eholz1 ... View more