Hi all, i'm trying to visualize an icon on a table when a specific IP address is found. To do  that i have used the code  and the CSS from Splunk dashboard example app. The table where i have to use the code is like this Time                                    DNS     Count  Site  -------------------                -------    -----       -----  2021-04-16 12:25:25 8.8.8.8 10          Site One  2021-04-16 12:25:25 1.1.1.1 20          Site Two  2021-04-16 12:25:25 8.8.4.4 30          Site Three  code and css as below require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { var CustomIconRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return _(['DNS']).contains(cell.field); }, render: function($td, cell) { var ip_dns = cell.value; // Compute the icon base on the field value var icon; if(ip_dns != '8.8.8.8' || (ip_dns != '8.8.4.4') { icon = 'alert-circle'; } else { icon = 'check'; } // Create the icon element and add it to the table cell $td.addClass('icon-inline numeric').html(_.template('<%- text %> <i class="icon-<%-icon%>"></i>', { icon: icon, text: cell.value })); } }); mvc.Components.get('table1').getVisualization(function(tableView){ // Register custom cell renderer, the table will re-render automatically tableView.addCellRenderer(new CustomIconRenderer()); }); }); ------ /* Custom Icons */ td.icon { text-align: center; } td.icon i { font-size: 25px; text-shadow: 1px 1px #aaa; } td.icon .severe { color: red; } td.icon .elevated { color: orangered; } td.icon .low { color: #006400; } /* Row Coloring */ #highlight tr td { background-color: #c1ffc3 !important; } #highlight tr.range-elevated td { background-color: #ffc57a !important; } #highlight tr.range-severe td { background-color: #d59392 !important; } #highlight .table td { border-top: 1px solid #fff; } #highlight td.range-severe, td.range-elevated { font-weight: bold; } .icon-inline i { font-size: 18px; margin-left: 5px; } .icon-inline i.icon-alert-circle { color: #ef392c; } .icon-inline i.icon-alert { color: #ff9c1a; } .icon-inline i.icon-check { color: #5fff5e; } /* Dark Theme */ td.icon i.dark { text-shadow: none; } /* Row Coloring */  #highlight tr.dark td { background-color: #5BA383 !important; } #highlight tr.range-elevated.dark td { background-color: #EC9960 !important; } #highlight tr.range-severe.dark td { background-color: #AF575A !important; } #highlight .table .dark td { border-top: 1px solid #000000; color: #F2F4F5; }   When i use as cell.field the column Count no problem, instead using the column DNS the icon is not set. I guess the problem comes from the field type, numeric / not numeric. How can i set icon checking the DNS field (not numeric) ? thanks       ... View more

Hello, I'm using SAI to get filesystem usage, unfortunately the mountpoint is not populated, or better it is partial. The following query (KPI in ITSI) | mstats min(df.free) as "df_free" max(df.used) as "df_used" WHERE `sai_metrics_indexes` by host,mount span=30s | eval host_dev = host . ":" . mount doesn't work because the dimension "mount" is missing. Changing "mount" with "device" I get result without mountpoint. Trying to change the collectd.conf (red part) <Plugin df> FSType "ext2" FSType "ext3" FSType "ext4" FSType "XFS" FSType "rootfs" FSType "overlay" FSType "hfs" FSType "apfs" FSType "zfs" FSType "ufs" MountPoint "/^/.+/" ReportByDevice false ValuesAbsolute false ValuesPercentage true IgnoreSelected false </Plugin> I get data only from one mountpoint (/boot) the other ones are still missing. I don't understand because the mount dimension is missing and only partial mountpoints are taken. Is it my fault ? I use the latest version of SAI, ITSI 4.4.3 and Splunk 8.0.3 Thanks   ... View more

Hello, trying to model a simple service I have found a little issue. The entities that compose the service are feeded from two source (windows add-on and SAI). The first one create events the second one metrics, so I cannot use the same search for CPU, memory and so on. I suppose a single service that contains this entities should have double kpi's (one for event, one for metrics), or I can create a service that correspond at a single server with its proper kpi. Could be the second options a valid solution or there is another way ? Thanks & regards ... View more

Hello, I'm starting a learning path on ITSI. Getting a fast look on documentation I see that latest version (4.5.0) is cloud only. Should I start my learn/study from the latest version because since now will be cloud based only or the previous version still exist with a parallel rollout? thanks ... View more