Hi, I have an existing search as follows:     | eval tempTime=strptime(due_at."-0000","%Y-%m-%d %H:%M:%S.%3N%z")     | eval dueDateCompact = strftime(tempTime, "%m-%d-%y") which I have used to successfully convert a string field ('due_at') representing an UTC value (although formatted without the time-zone designation at the end), to an abbreviated notation (month-day-year) displayed in local time. So, for example, if "due_at" has a value of "2023-09-30 04:59:59.000", then the resulting "dueDateCompact" field ends up with "09-29-23" in there, correctly representing  "due_at" but in Chicago local time (5 hours behind UTC).  However, my current requirements are such that "due_at" comes formatted as "2023-09-30T04:59:59.000Z" (iso 8601 proper) instead of the original "2023-09-30 04:59:59.000" (note: only the intermediate T and ending Z are the differences between original and updated formats).  Therefore, I updated the first part of my original search to read:        | eval tempTime=strptime(due_at,"%Y-%m-%d %H:%M:%S.%3QZ")     (so I am not appending '-0000' anymore to "due_at", since the 'Z' is present in the format string) but this is NOT producing the correct local time in 'dueDateCompact' anymore (it produces "09-30-23" instead of "09-29-23").   Is there a logical explanation for this?  ... View more

We created an application (mostly Javascript, with a proxy server for communicating to Splunk) that, while running outside of Splunk,  accesses Splunk Enterprise data and displays Splunkjs visualizations (using the docs at https://dev.splunk.com/enterprise/docs/developapps/visualizedata/usesplunkjsstack/ ). Unfortunately we seem to be running into load-related issues when several users simultaneously access it, as follows: 1 - Incomplete chart displays ('waiting for data'  forever) in a couple of charts that happen to depend on the completion of saved searches for their own (post process) search to get started. 2 - Other times, this error appears in the Javascript console and none of the charts load:        Uncaught Error: Load timeout for modules: splunkjs/ready!_unnormalized2,splunkjs/ready!http://requirejs.org/docs/errors.html#timeout    at makeError (eval at module.exports (config.js:138), <anonymous>:166:17)    at checkLoaded (eval at module.exports (config.js:138), <anonymous>:692:23)    at eval (eval at module.exports (config.js:138), <anonymous>:713:25) NOTE: these issues don’t come up unless there are various simultaneous (10 or so is all that it requires) loads of the application, which is why we are theorizing that they are load-related issues. In addition, our Splunk admin was present when we tested this app, and he did not see the relevant limits being reached on the back end (e.g. number of simultaneous searches, space used by the single service user employed in this application) . Could somebody please advise on what could be happening? Are there limitations specific to the Splunkjs stack that we should be aware of?      ... View more

I'd like to display up to a certain number of data points in a bar chart in a way that the rest of the items which do *not* get displayed are collapsed into one bar: "other". Is there a way to do this? I'm aware that I can simply set the maximum number of data points to display, but this provides no information about the rest, which is what I'm trying to do.  I'm using the Splunjs framework to create the visualization in an app external to Splunk.  ... View more

Hi, I'm looking for the proper way to set the 'search' property of a PostProcessManager in splunkjs within an app that runs outside of Splunk Enterprise. Documentation on this is not clear, and my trials have been unsuccessful, as follows: myManager.set("search", <mysearchstring>) is apparently syntactically correct, but returns no results myManager.settings.set("search", <mysearchstring>) is apparently syntactically correct, but returns no results myManager.search.set(<mysearchstring>) is apparently syntactically correct but causes no update in the display myManager.query.set(<mysearchstring) is also syntactically correct but causes no update in the display NOTES: - After setting the search query, I'm also calling 'startSearch()' on the search manager, and then render() on the chart - Before responding, please note that this is for apps outside of Splunk and not otherwise. See examples for this type of apps in https://dev.splunk.com/enterprise/docs/developapps/webframework/codeexamplefw/splunkjsstack/searchcontrolseventsjs This is where the 'manager.search.set' and 'manager.query.set' are used in examples with plain SearchManager instances) Thanks in advance for any help. ... View more

I have a simple search with a sort command at the end as follows: .... some base search | dedup id | table id, name | sort -id and I'm being presented with the following results: 18760000000000166 2020 Summer 18760000000000168 2020 Fall 18760000000000167 2020-2021 Academic Year 18760000000000164 2020 Winter 18760000000000165 2020 Spring 18760000000000163 2019 Fall 18760000000000131 2019-2020 Academic Year 18760000000000127 2019 Spring 18760000000000129 2019-2020 Academic Year 18760000000000130 2018-2019 Academic Year I expected the results to have been ordered by id (descending order). What am I missing? ... View more