Hi I know this question has been asked before but the answers do not seem to work in Splunk Cloud. I'm opening splunk dashboard in tabs using selenium and I'd like to know if there is a way to bypass authentication so I do not have to manually enter my splunk acc username and password? ... View more

Hi how to disable the hover functionality for line charts? I've tried disabling tooltips but it just hides the label- I do not want other lines to be greyed out? ... View more

Hi, Is it possible to disable the greying out of other lines when you hover over a line in Splunk line chart in XML? I'm displaying the dashboards in a desktop that's for public viewers so I would not like the charts to change as easily as moving the mouse? ... View more

Hi, I have this search and basically it shows a table with the channel. Error type, total error, and the sum total of the errors- but I append a sort function at the end to sort by total but it doesn't sort it? index=appguids host=netweba* ApplicationID=order20 ApplicationSource=*order* errorguid Monster.PaymentProcessor.PaymentFailedException | rex field=Message "(?m)^Message:[^:]+:\s(?<type>.*)$" | stats count BY type,ChannelID | lookup local=1 MonsterChannels ChannelId AS ChannelID | eval Channel=if(isnull(Channel) OR match(Channel,"^0$"),"Unknown ChannelID", Channel) . " [ChannelID: " . ChannelID . "]" | stats values(type) AS "Error Type", list(count) AS "#Errors" BY Channel | appendpipe [ stats sum("#Errors") AS "#Errors" BY Channel | eval "Error Type"="Total for Channel" ] | stats values(Channel) AS X, list("Error Type") AS "Error Type", list("#Errors") AS "#Errors" BY Channel | fields - X | sort - "Total for Channel" ... View more

Hi, I managed to get the time picker label value like this: <fieldset autoRun="true" submitButton="false"> <input type="time" token="time_token" searchWhenChanged="true"> <label>Select time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> <change> <eval token="displayTime">$label$</eval> </change> </input> </fieldset> But I realized if I change the timepicker value to last 7 days from presets then it says "Custom time' instead? How do I write an if loop to check if "Last 7 days" is chosen so I can set the label manually instead of forcing the user to choose from relative time? ... View more

Hi, I've changed the font size of the labels an legends like this but I want to incorporate a space in between each legend item and the time and labels. Is this possible? g.highcharts-axis-labels.highcharts-xaxis-labels text{ font-size: 130% !important; } g.highcharts-axis-labels.highcharts-yaxis-labels text{ font-size: 130% !important; } g.highcharts-legend text{ font-size: 130% !important; } ... View more

I displayed the percentage values by enabling this: <option name="charting.chart.showPercent">1</option> And I tried rounding off the values to 1 dp by using this query but it still shows 3 dp ? host=NETWEBA* cs_method="GET" cs_uri_stem="/jpw/*" (sc_status="2**" OR sc_status="3**") NOT("ErrorGuid") | where mww_vm_ipaddress!= c_ip |stats dc(c_ip) as "Number_of_Unique_IPs" by cs_host | sort 5 - "Number_of_Unique_IPs" | eval Number_of_Unique_IPs = round(Number_of_Unique_IPs,1) ... View more

I wrote this base search query: host=NETWEBA* sourcetype="WinEventLog:Application" AND ApplicationSource="/jpw*" AND "ErrorGUID" | fields OuterExceptionType And I extended this query to get the top 5 exceptions stats count by OuterExceptionType AS "Outer_Exception_Type"| sort - "Outer_Exception_Type" But it returns no results whereas if I don't use a base search it works fine? ... View more

Hi, I have this query: host="NETAPPA*" sourcetype="WinEventLog:Application" AND AppDomainName= "EcomSubscription.*"AND "ErrorGUID" | timechart span=1h count AS "EcomSubscription" | appendcols [search host=NETAPPA* sourcetype="WinEventLog:Application" AND LogName="Application" AND ExceptionManager_AppDomainName= "Monster.Services.Windows.ServiceBase.exe" | timechart span=1h count AS "MonsterWindowServices" ] I changed the setting of the shared time picker to last 24 hours and the chart just returns null but when I changed the setting to last 7 days there are results. But from the 7-day results it shows that 'Monster window services' is not null for the last 24 hours. Is it because of the appendcols? EDIT:I realized when ecomsubsription is null monster window services does not display as well eventhough it is not null? Is there a way to avoid appendcols altogether? ... View more

Hi, I have this query that I use as a base search query. host=NETWEBA* sourcetype=iis NOT("ErrorGuid") cs_uri_stem="/order20/api/order/confirmation*" (sc_status="2**" OR sc_status="3**") "GET" | stats distinct_count(eo) by cs_host In my post-process query I want to distinct_count(eo) and display it in a timechart by hour. So I wrote this fields _time | timechart span=1h count(eo) as Number_of_Orders But no chart is displayed even if I added the time field? ... View more

Hi, I want to display this query in my dashboard in two different charts. So this is my base search query: search base="OrderSearch" host=NETWEBA* sourcetype=iis NOT("ErrorGuid") (sc_status="2**" OR sc_status="3**") "GET" | rex field=cs_referer "https:\/\/[a-zA-Z]+\.[a-zA-Z]+\.([a-zA-Z]+|[a-zA-Z]+.[a-zA-Z]+)\/order20\/order\/confirmation-v2\/(?<orderID>[0-9]+)(.*)" | dedup orderID |stats count by cs_host Then I want to display this in a different timechart: search id="OrderSearch" timechart span=1h count(orderID) as Number_of_Orders I tried changing it to eventstats but it didn't work? ... View more

Hi, I have a field called message: Message="Fault bucket , type 0 Event Name: ServiceHang Response: Not available Cab Id: 0 Problem signature: P1: MonsterWindowsService P2: Monster.Services.Windows.ServiceBase.exe P3: 2019.15.0.12 P4: 10 P5: 2 P6: P7: P8: P9: P10: Attached files: These files may be available here: Analysis symbol: Rechecking for solution: 0 Report Id: f9938371-b8d1-11e9-8f94-00505682bfbe Report Status: 0" And I'm trying to extract the line in bold? Is this possible or is there an easier way other than to write the regex? ... View more

Hi, I have two timecharts that I appended using appendcols. Now I have another query that I want to append as well but append cols only appends two searches? I can't use match and case because it is different fields? earliest=-1d@d latest=@d host="NETWEBA*" sourcetype="WinEventLog:Application" AND ApplicationSource="/order*" AND "ErrorGUID" | timechart span=1h count AS "Order20" | appendcols [search earliest=-1d@d latest=@d host="NETAPPA*" sourcetype="WinEventLog:Application" AND AppDomainName= EcomSubscription.* AND "ErrorGUID" | timechart span=1h count AS "EcomSubscription" ] Query I'm trying to insert: host=NETAPPA* AND LogName=Application AND Monster.Services.Windows.ServiceBase. AND Message="MonsterWindowsService" sourcetype="WinEventLog:Application" ... View more

Hi, I want to count the number of events returned based on application source and display them as different timecharts. I realized appendcols only appends two timecharts and it is rather inefficient as many terms are repeated. For example, host, errorguid etc. Is there a way for me to append the third chart "TalentAnalyzer" as well? earliest=-1d@d latest=@d host=NETWEBA* sourcetype="WinEventLog:Application" AND ApplicationSource="/api/tcrm*" AND "ErrorGUID" | timechart span=1h count AS "Api.TCRM" | appendcols [search earliest=-1d@d latest=@d host=NETWEBA* sourcetype="WinEventLog:Application" AND ApplicationSource="/jcm*" AND "ErrorGUID" | timechart span=1h count AS "JCM" ] | appendcols [search earliest=-1d@d latest=@d host=NETWEBA* sourcetype="WinEventLog:Application" AND ApplicationSource="/TalentAnalyzer*" AND "ErrorGUID" | timechart span=1h count AS "TalentAnalyzer" ] ... View more

Hi, I know that we can create radial gauges using aggregate values but I've selected the radial gauge visualization and it doesn't show for this query? How do we create radial gauges for each channel from this query? earliest=-1d@d latest=@d index=appguids host=netweba* ApplicationID=order20 ApplicationSource=*order* errorguid Monster.PaymentProcessor.PaymentFailedException | rex field=Message "(?m)^Message:[^:]+:\s(?<type>.*)$" | stats count BY type,ChannelID | lookup local=1 MonsterChannels ChannelId AS ChannelID | eval Channel=if(isnull(Channel) OR match(Channel,"^0$"),"Unknown ChannelID", Channel) . " [ChannelID: " . ChannelID . "]" | stats values(type) AS "Error Type", list(count) AS "#Errors" BY Channel | stats values(Channel) AS X, list("Error Type") AS "Error Type", list("#Errors") AS "#Errors" BY Channel | fields - X | chart sum("#Errors") AS TotalError BY Channel ... View more