About nfilippi_splunk

RaviNandasana0 · ‎05-22-2024

Use Below options <option name="link.exportResults.visible">0</option> <option name="link.inspectSearch.visible">0</option> <option name="link.openPivot.visible">0</option> <option name="link.openSearch.visible">0</option> <option name="link.visible">0</option> <option name="refresh.link.visible">0</option>

mclane1 · ‎01-04-2022

Thank you very much for this tip. It doesn't work for me on 8.2.0 in type="multiselect" 😭

ro_mc · ‎11-05-2021

I realise this is a post from 2016, but I noticed that the <input> uses a <default> value rather than the recommended <initial> value per the Splunk docs (for the current version of 8.2.3), which may help others while troubleshooting this or similar issues on newer Splunk versions. https://docs.splunk.com/Documentation/Splunk/8.2.3/Viz/FormEditor#Configure_input_value_handling

BernardEAI · ‎02-11-2021

The css option is a good one, however this potentially requires you to add this css to all the dashboards in your app. Another option is to add the following to your dashboard.js file (that gets loaded by default on all dashboards in your app): document.getElementsByClassName('edit-other')[0].style.visibility='hidden'; Remember to bump after changes to javascript.

stevewillson · ‎10-08-2020

Restarting with http://debug/refresh worked when editing files outside of Splunk Enterprise 8.0.6. If I edit the file directly in (\default\data\ui\views\) and then click on the App in the upper left corner of the screen under 'Apps', the display content for the modified file is not updated. Confirming what @DanMurad posted.

harishalipaka · ‎11-30-2017

hi am also searching for this type of problem please help for this .my question links are:: https://answers.splunk.com/answers/592116/related-to-tokens-in-multiselect.html https://answers.splunk.com/answers/593597/developing-a-splunk-app-and-it-doesnt-work-on-mobi.html

nfilippi_splunk · ‎11-04-2016

You can use the search event handler to dynamically set a token based on the result. Note that the search event handler only tokenizes the first result, which looks like it should work for you. Here's what it would look like: <dashboard> <label>Test Token</label> <search> <query>index=snow description=CPU | table number sys_created_by</query> <earliest>-60m@m</earliest> <latest>now</latest> <done> <set token="sys_created_by">$result.sys_created_by$</set> </done> </search> <row> <panel> <table> <search> <query>index=snow description=CPU sys_created_by=$sys_created_by$</query> <earliest>-60m@m</earliest> <latest>now</latest> </search> </table> </panel> </row> </dashboard>

sivaranjiniG · ‎07-18-2018

Thanks!! its working for me:)

reschal · ‎12-15-2017

This works well. Thank you 🙂

nfilippi_splunk · ‎10-27-2016

If you are using v6.5, there is a new token filter to force no encoding: <link>https://somewhere.co/?reportRepositoryKey=$click.value|n$</link>

nfilippi_splunk · ‎08-05-2015

You can also style using xml options: <chart> ... <option name="charting.backgroundColor">#475565</option> <option name="charting.foregroundColor">#EBF5FF</option> <option name="charting.fontColor">#99CCFF</option> </chart> Which should result in something like this:

benton · ‎07-18-2016

Note, that if your saved-search is a scheduled report, then the and tags do not apply in the dashboard -as far as I can tell anyway. All of the data created by the scheduled search over the scheduled time-period is displayed. If you remove the schedule from the saved search, then the "earliest" and "latest" tags will be applied in the dashboard as described above.

nfilippi_splunk · ‎11-07-2014

Searches within dashboards are run in "fast mode", which means that only those fields that are explicitly referenced within the search are available as selected fields in the result set. To ensure that you pass the necessary fields from a global search down to the post process searches, you will need to use the "| fields" command with the list of fields needed. As a shortcut, you can also use "| fields *" to pass all fields as selected fields. So your search could look something like this: <searchTemplate>index=_internal log_level="ERROR" | fields *</searchTemplate>

john_l_mottola · ‎11-01-2014

Thanks, this worked just as expected.

valentrm · ‎03-26-2015

It works but the width that i want to change is not the panel but inside panel. I want to change the group inside the panel. How can i in a row change the width of the groups?

shanksholla · ‎08-05-2014

This gave me what I wanted. Thank you!

cphair · ‎06-17-2014

Thanks for the clarifications. Unfortunately this isn't an instance I have control over upgrading, so I'll write it off for now.

devicenul1 · ‎06-13-2014

I'm going to mark this as the answer as I think you were trying to get across the concept that you can't use SplunkJS within splunk. It's an additional component you download and wire for your own web apps. I was assuming (Since the documentation between the web framework and SplunkJS link to each other) that they were all useable inside Splunk. This would be the foundational thing I wasn't understanding.

ShaneNewman · ‎03-28-2014

That worked! Thanks!

nfilippi_splunk · ‎03-20-2014

Converting those js/css files to dashboard.js and dashboard.css will result in those files being loaded on every Simple XML dashboard. Not sure that that is what you want here. As of Splunk 6, Simple XML now supports both app-level as well as page-level customizations via JS/CSS. - App-level: All Simple XML dashboards will load dashboard.js and dashboard.css if these files exist within your appserver/static/ directory - Page-level: You have the option load custom js/css for that specific page by explicitly including it in your top-level xml element.

gfuente · ‎11-04-2014

Hello I tested this, and in Splunk 5 doesn´t works if you hide the field with the "fields - fieldname" command. Althougt it works fine without hidding the field... Does you solution works in Splunk 6? Regards

otman01 · ‎04-10-2015

Yes its a good example. But can we add another icons ????? like icon-power, icon-battery-1, icon-closethick .... present in this page http://api.jqueryui.com/theming/icons/ Thank you for your answer.

JoshWhaley · ‎08-12-2015

+1 for requesting this feature. It seems odd that maps don't support this feature while others do.

somesoni2 · ‎04-01-2014

Upgrade to 6.0.2 Maintenance version and then use options mentioned in the accepted answer. The property is not present in documentation though.

nfilippi_splunk · ‎12-13-2013

So in this case, you probably don't need any default here as the suffix will do what you need.

Posts	101
Solutions	27
Karma Given	4
Karma Received	219
Member Since	‎07-16-2012

Online Status	Offline
Date Last Visited	‎02-24-2021 02:01 PM

Re: Is there a way to remove the "Open in Search, ...

Re: How can I set a dynamic default value in a dro...

Re: Why is eval in my Simple XML not working to se...

Re: How to hide or grey out Clone option under Edi...

Re: Edit Form/Dashboard XML manually , Splunk does...

Re: Why is the "condition value" in the XML of my ...

Re: How to set a field as the token to use in a da...

Re: How to send the "&" and the "=" character from...

Re: How to set a different drilldown for each cell...

Re: How to prevent URL encoding of an external fie...

Re: How to change the background color (from a CSS...

Re: Using time range picker does not work in dashb...

Re: Why is my simple XML form using post process d...

Re: Why aren't my dashboard searches returning all...

Re: Simple XML - Display 2 panels in a row with di...

Re: How to drill down from a table into a chart wi...

Re: How to create simple XML dashboard with contex...

Re: SplunkJS and HTML Dashboard

Re: Drilldown help

Re: In-Page Drilldown with Perma-linking in splunk...

Re: Splunk dynamic dashboard capability question?

Re: Icon alerts in a table for Up or Down values

Re: How do I create drilldown in the XML?

Re: Splunk 6 Simple xml dropdown, how to select fi...

Re: XML Form differences following Splunk 6 upgrad...

Join the Conversation