Found a clunky work around. Create the report via the GUI, set permissions, schedule it, enable embedding, etc. Then go to $SPLUNK_HOME/etc/apps/search/local/savedsearches.conf and find the stanza for the report you just made. In there you can add lines the same way you would edit a dashboard element via XML: colors of your bars, lines, etc: display.visualizations.charting.seriesColors = ["0x5c2fb6"] color of the deliminations: display.visualizations.charting.foregroundColor = #000000 color of the axis and labels: display.visualizations.charting.fontColor = #000000 color of the background: display.visualizations.charting.backgroundColor = #ffffff But, as far as I can tell, this file is not read on the fly, and you need to restart Splunk for any color changes to take effect. ... View more

Saving a search as a report. On the report I set a cron schedule, allow read permissions, then enable embedding. Splunk generates an iframe tag for export. ... View more

Thank you. This is what I've deployed until Splunk gets the add-on itself fixed. ... View more

Ditto. Would love to change the colors on embedded reports. ... View more

2nd this! Add-on was working fine in 6.4.1, credentials worked and was indexing data. Upgraded our on-prem enterprise to 6.5.1 and now when Splunk loads I get script error alert messages and no data indexes. Credentials still work because if I try to add a new input it still populates the drop-downs with my correct Google Cloud project info and valid monitoring metrics. I've had a support case open for 20 days now with no headway. ... View more

What I usually do is just put "counters = *" in the perfmon and let that run for 5-10 minutes, then just go search in splunk for that index, host, and object and see what counters it threw. ... View more