I want to create a table in Dashboard Studio that will open up another dashboard when the user clicks on a row in the table.  However, I cannot figure out how to provide the name of the dashboard to link to in a hidden field (see code below).  How do I create a table drilldown to a dashboard based on the name in a hidden column?   { "visualizations": { "viz_15E2DDQP": { "type": "splunk.table", "dataSources": { "primary": "ds_HsTRSmYx" }, "title": "Fleet Status" } }, "dataSources": { "ds_HsTRSmYx": { "type": "ds.search", "options": { "query": "| makeresults\r\n| eval ITEM = \"Operator Logins\"\r\n| eval STATUS = \"Good\"\r\n| eval _hot_link = \"operator_logins_dashboard\"\r\n| append [\r\n| makeresults\r\n| eval ITEM = \"Revenue Service\"\r\n| eval STATUS = \"Fair\"\r\n| eval _hot_link = \"revenue_service_dashboard\"\r\n]\r\n| append [\r\n| makeresults\r\n| eval ITEM = \"Announcements\"\r\n| eval STATUS = \"Poor\"\r\n| eval _hot_link = \"announcements_dashboard\"\r\n]\r\n| append [\r\n| makeresults\r\n| eval ITEM = \"Navigation\"\r\n| eval STATUS = \"Warning\"\r\n| eval _hot_link = \"navigation_dashboard\"\r\n]\r\n| append [\r\n| makeresults\r\n| eval ITEM = \"Available Resources\"\r\n| eval STATUS = \"Error\"\r\n| eval _hot_link = \"resources_dashboard\"\r\n]\r\n| table ITEM STATUS _hot_link" }, "name": "Fleet Status" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" } }, "layout": { "type": "absolute", "options": { "display": "auto-scale" }, "structure": [ { "item": "viz_15E2DDQP", "type": "block", "position": { "x": 0, "y": 0, "w": 690, "h": 260 } } ], "globalInputs": [ "input_global_trp" ] }, "description": "", "title": "Dashboard Studio Hotlink POC" }   ... View more

The following Dashboard Studio code will display a three-column table with the last column color coded by the value of the last column.  How do I color code the second column by the value of the last column and hide the last column? { "visualizations": { "viz_mGj9tW8N": { "type": "splunk.table", "dataSources": { "primary": "ds_EKJuCMzj" }, "title": "Product List", "description": "Current prouct versions", "options": { "columnFormat": { "color_key": { "data": "> table | seriesByName(\"color_key\") | formatByType(color_keyColumnFormatEditorConfig)", "rowColors": "> table | seriesByName('color_key') | rangeValue(color_keyRowColorsEditorConfig)" } } }, "context": { "color_keyColumnFormatEditorConfig": { "number": { "thousandSeparated": false, "unitPosition": "after" } }, "color_keyRowColorsEditorConfig": [ { "to": 20, "value": "#D41F1F" }, { "from": 20, "to": 40, "value": "#D94E17" }, { "from": 40, "to": 60, "value": "#CBA700" }, { "from": 60, "to": 80, "value": "#669922" }, { "from": 80, "value": "#118832" } ] } } }, "dataSources": { "ds_EKJuCMzj": { "type": "ds.search", "options": { "query": "| makeresults \r\n| eval Product = \"Circle\" \r\n| eval Version = \"1.2.3.4\" \r\n| eval color_key = 52 \r\n| eval _time=relative_time(now(), \"-1d@d\") \r\n| append \r\n [| makeresults \r\n | eval Product = \"Square\" \r\n | eval Version = \"2.3.4.5\" \r\n | eval color_key = 48 \r\n | eval _time=relative_time(now(), \"-1d@d\") \r\n ] \r\n| append \r\n [| makeresults \r\n | eval Product = \"Triangle\" \r\n | eval Version = \"3.4.5.6\"\r\n | eval color_key = 75 \r\n | eval _time=relative_time(now(), \"-1d@d\") \r\n ] \r\n| append \r\n [| makeresults \r\n | eval Product = \"Rectangle\" \r\n | eval Version = \"4.5.6.7\" \r\n | eval color_key = 4 \r\n | eval _time=relative_time(now(), \"-1d@d\") \r\n ] \r\n| append \r\n [| makeresults \r\n | eval Product = \"Oval\" \r\n | eval Version = \"5.6.7.8\" \r\n | eval color_key = 2 \r\n | eval _time=relative_time(now(), \"-1d@d\") \r\n ] \r\n| stats latest(Version) as Version latest(color_key) as color_key by Product", "queryParameters": { "earliest": "-24h@h", "latest": "now" } }, "name": "Product List" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": {}, "layout": { "type": "absolute", "options": { "display": "auto-scale" }, "structure": [ { "item": "viz_mGj9tW8N", "type": "block", "position": { "x": 0, "y": 0, "w": 340, "h": 300 } } ], "globalInputs": [] }, "description": "", "title": "Dynamic Coloring POC - SPLK-1271" }   ... View more

Does anyone know how to change the default time for ad-hoc searches from 30 minutes to 7 days in Splunk Cloud? I changed the setting in Server settings » Search preferences to 7 days. However, the default in Search & Reporting is still 30 minutes. Our data usually takes 48 hours to get though the data pipeline, so a 30 minute time window for searches will never return data. ... View more

We want to disable Power Users from editing source types but still allow sc_admin the capability. We unchecked the edit_sourcetypes capability on the Edit Role dialog box for the Power User in Splunk Cloud, then went to the Edit Role for the sc-admin to enable that capability. However, after disabling edit_sourcetypes for the Power User, that capability does not show up in the Edit Role for any role and now no users can edit source types. How do we enable the edit_sourcetypes capability for only the sc_admin role? ... View more