This is the way.  Thank you weidertc! ... View more

@maffreitas , sorry I am on version 7.1.0, so I can not look into 6.6.2 (visualizations.conf configuration for Single Value data count limit is applicable only for version 7.0 onward). Yes the charting.data.count is applicable only for Charts and not Single Value. So, until you get a solution for Single Value you can use Timechart for showing trends. As stated earlier anyways Single Value Sparline will be too small to show more than 1000 data points. I am going to add a comment stating applicable only 7.0 onward to my answer and convert it to comment so that others with 6.6. can answer. Also will see if I can get a system with Splunk 6.6 to find the required configuration/workaround for Single Value. ... View more

Great, once you change the settings in your authentication.conf you'll have to restart your Splunk instance or reload the authentication config. Then you'll need to regenerate your SPmetadata.xml and confirm that XML has the new certs. Then you'll need to pass this to your IdP. Let me know if you have any further questions. If not, please accept this answer. ... View more

@maffreitas, unfortunately this custom visualization does not install on Splunk Enterprise 7. But, as per the sample screenshots provided on Splunkbase seems like your statistical table can have three columns i.e. name, value, color where in third column you can give color hex code . Have you tried it out? Can you try the funnel Visualization with the following run anywhere search? | makeresults | eval name="Field1",value="100",color="#ff634d" | append [| makeresults | eval name="Field2",value="1000",color="#008080"] | append [| makeresults | eval name="Field3",value="2000",color="#007fff"] | append [| makeresults | eval name="Field4",value="5000",color="#ff634d"] | table name value color ... View more

Have the same issue. Did you solve it on your side? @smitra_splunk ... View more

Hi, Soon I can see the colored events 🙂 Thanks for your assitance. All the best, Cem ... View more

Hello All, Thanks for your answers, but the columns number is more. I cannot do colY=colY-colX every time, is there any better solution? I have around 20-30 rows as output and other than columns col1,col2,col3.. I have another one column which I am using in my by clause of search query ... View more

Hi Adonio, thank you for your feedback. I think this is a bug on perfmon network ingestion... Trying to ingest Windows Perfmon Network Data we realized the ingestion just don’t work, even after following all required configuration steps. The most strange was that network ingestion is the only one which is not working. Others like memory, CPU and disk are working regularly. After some exhaustive tests, we identified the problem: When a host is deployed on a server class, which has Network Perfmon app activated, Splunk creates a new entry at inputs.conf file referencing the following content: Object = Network We noticed that the correct object at inputs.conf in order to have the ingestion working should be: Object = Network Interface It is not feasible to perform the adjust at all inputs.conf manually, because we know it was not going to work, since the inputs.conf file is wrongly re-created every time a host is added to a server class. ... View more

I'm currently seeing this same issue. Can you provide details on how you resolved it? ... View more

Hi @aplura_llc_support iam trying to have customized color in my donut chart...how can i achieve this?? iam using splunk 7.2 ... View more

You should ask this as a new question. Not only will you get the attention a new question deserves and not pollute two-year-old other questions with varying potentially version-specific info, but also make it easier for others to find what they need. Off the top of my head I don't think the built-in pie charts have an option to move the labels to the inside of the pie, but you're always free to build a custom visualization and publish that as an app on splunkbase 🙂 ... View more