this works like a charm ... View more

@sandeepmakkena Nope it is not working. Below is the sample code i tried. <dashboard stylesheet="test.css"> <label>test</label> <row> <panel> <table> <search> <query>|stats count|eval aaa="1",bbb="2",ccc="3",ddd="4",eee="5",fff="6",ggg="6",hhh="7",iii="9",jjj="5",kkk="4",lll="4",mmm="5",nnn="3",ooo="4",ppp="3",qqq="2",rrr="4",sss="4",ttt="2",uuu="5",vvv="9",xxx="4",yyy="2",zzz="2"</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <table> <search> <query>index=_internal|stats c by sourcetype|head 1</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </dashboard> test.css table { border-collapse: separate; border-spacing: 0; border-top: 1px solid grey; } td, th { margin: 0; border: 1px solid grey; white-space: nowrap; border-top-width: 0px; } div { width: 500px; overflow-x: scroll; margin-left: 5em; overflow-y: visible; padding: 0; } .headcol { position: absolute; width: 5em; left: 0; top: auto; border-top-width: 1px; /only relevant for first row/ margin-top: -1px; /compensate for top border/ } .headcol:before { content: 'Row '; } .long { background: yellow; letter-spacing: 1em; } ... View more

Hi , Any one have working code(java script or css) to freeze ONLY first column when scrolling that table to right or left, I had a table with 65 columns. Thanks ... View more

I did not see any issues, I kept it default ... View more

bport15, try to install "sysstat" package in your linux server and check read and writes by using "sar" command you can use "iostat" and "sar" commands to find latency. ... View more

@rpille Thanks rpille. ... View more

@ kmorris [Splunk] , @rpille [Splunk] Hi Morris/rpille, Is there a way to index box files. example: I had a csv file which is saved in box. I want to index that csv data in to splunk. Is it possible? Regards, Reddy ... View more

use this examples app and drilldown and token passing https://splunkbase.splunk.com/app/1603/ ... View more

For Already indexed data you can extract fields in search time. two ways you can use this cases: use transaction ID stats list() or values() by ID ... View more

Entire event will move to null queue http://docs.splunk.com/Documentation/Splunk/4.3.1/Deploy/Routeandfilterdatad#Discard_specific_events_and_keep_the_res ... View more

I tried in my local it is working with below search query: |stats c|eval a="2"|eval b=3|table a,b|eval ab=pow(a,2)|eval cd=pow(b,2)|eval norm=ab+cd|eval norm2=round((sqrt(norm))) Note: if your extracted values for x,y,z are strings it will show as a blank ... View more

https://answers.splunk.com/answers/489539/bug-in-rex-command-not-working-if-the-raw-data-has.html ... View more

Try this below link and modify the query to alltime https://answers.splunk.com/answers/242759/help-to-find-daily-indexed-data-size-by-each-index.html ... View more

try this: |stats c |eval _raw="C:\logs\public\test\appname\test.log"|rex field=_raw "\w+.\w+.\w+.(?<appname>\w+)" ... View more

try like this: |stats c|eval _raw="ComputerName-DJ001DJKWN03-AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}"|rex field=_raw "AppGUID..(?\w{8}-\w{4}-\w{4}-\w{4}-\w{12})" ... View more

try this: -If you want to discard the XML tag use transforms.conf and send it to null queue ... View more

some thing related answer: https://answers.splunk.com/answers/499611/how-to-monitor-remote-logs-in-a-centerized-heavy-f.html ... View more

try using CSS follow below links https://answers.splunk.com/answers/43666/single-value-change-font-size.html https://answers.splunk.com/answers/491140/how-to-change-the-font-size-for-a-single-value-pan.html ... View more

try like this: index=_internal|eventstats count by sourcetype|timechart span=1h c by sourcetype | addtotals ... View more

Can you post some sample data. if you want to combine total json file in to single event Give a try using this property in props.conf SHOULD_LINEMERGE= TRUE ... View more