Desired Outcome : I am trying to create a simple timechart  to show a count of ports and the relative time line on the x-axis. Sounds simple. The problem: It appears timecharts (for whatever reason) use the first row of the results for the x-axis values.  Whenever I run a query, the _time columns is the first column shown while executing the query, but is always moved to the last column when the query is finished. The result is the timechart uses whatever column value is sees in the first column as the x-values. If that' s by design, its rather awful as I see no way to hard code the x-axis values to another column. I've tried a bunch of options to try and move the column back to the first column, but they all fail. Here is one such option I tried. This of course does the same thing. Works great until the final results are rendered and then the _time column again moves to the end and fouls up the x-axis values. I've also tried renaming _time to a_ or 0_ to try to force the order, but no dice. My search index blah blah.. | eval Date=strftime(_time,"%y-%m-%d %H:%M:%S") | timechart span=5m count by port useother=true limit=15 | table _time * | fields keepcolorder=t "_time" "*" I've attached images "executing" and "execution complete" to show the difference. of    ... View more

Problem: I've created a dashboard which looks great, but is limited in functionality by the inherently simple XML structure Splunk uses to stub these things out. I want to convert my dashboard to HTML but the well advertised "Convert to HTML" option is not available through either the edit button or the ellipses dropdown on the dashboard. Are there any particular Splunk antics required to make it appear in the drop down? On both of the installs I have tested I get the same list of options from the ellipses drop down Clone, Set as Home Dashboard and Delete. I am logged in as admin on both system with the included capability of edit_view_html and basically every other assignable capability of admin. I have tried this on versions... Version:8.1.0 Build:f57c09e87251  and Version 4.4.1 Build 1566518380334 Thanks ... View more

Question : I am trying to determine if it's possible to exclude selected columns of data from algorithm processing when running a search analysis in the search and reporting window.  This would equate to using a python pandas dataframe and selecting the features you desire from the dataset to be processed or considered in the algorithm. Example index=firewall action="allowed" (host="myhost*") transport="tcp" -- Assumption: my data has 10 columns, but I only want to use 6 of them in the algorithm. -- Problem:  Filter the columns to be used when executing the 1CSVM Algorithm. By default I believe Splunk is assuming I want to analyze all columns as features. `comment("Fit Using 1CSVM Algorithm")` | fit OneClassSVM * kernel="rbf" gamma=1 nu=.0001 shrinking=False | outputlookup compositeResults.csv append=true   ... View more