I ended up finding the answer to this question. It took me several hours to figure out, so I thought I'd post it here for future Splunkers. I added some custom visualizations in a Splunk dashboard. I print these dashboards to a PDF and want to preserve the color. I was trying to figure out why my charts did not print out in color, but other Splunk charts did. It turns out that it has to do with the Splunk CSS. It has a print configuration like the following: @media print {   .visualization-controls {   display: none !important;   } } If the element doesn't contain the "!important" property, the formatting is removed when printing. So when setting the color of my objects, I had to add "!important", like the following:      color: darkred!important Otherwise, just doing "color: darkred" will not pass through the color when printing.     ... View more

I have an autogenerated dashboard with 160 panels. The good news: Each panel's search uses an accelerated saved search. The bad news: I have so many panels that I frequently see this message in about 40 of the panels: Search not executed: The maximum number of concurrent historical searches on this instance has been reached., concurrency_category="historical", concurrency_context="instance-wide", current_concurrency=50, concurrency_limit=50   If I hover over those panels and click the "Refresh" icons, after the other searches have finished, the search tries again and succeeds. I see the information I was looking for in the panel.   I accept that there is a limit to concurrent searches. I'm willing to wait. But clicking the individual "Refresh" icon in each of panels with the "Search not executed" message is a lot of work.   Ideally, I'd like the search panel to automatically retry as capacity frees up, without me clicking the "Refresh" icon. Is that possible?   If it's not possible, is there a programmatic way for me to automatically kick off the "Refresh" icon? I tried using the JavaScript console with something like:  mvc.Components.get("baseSearch_item3_P1").startSearch(); but it couldn't resolve the mvc object. I was thinking I could walk through the DOM and execute an action for each panel that contains the text "Search not Executed", but I don't have the expertise to figure out how to do that and I can't even get the startSearch() action working for one individual search. Any tips or workarounds around automatically refreshing with one JavaScript command via the JavaScript console?   As a last ditch workaround, I've separated the dashboard into 6 sections with "depends" tokens that are controlled by an input dropdown. Each dropdown item loads 1/6th of the dashboard at a time. It's an ugly, hacky way that I really want to avoid. My coworkers will laugh at me for doing that. ... View more

Using the Splunk REST API, one can use GET against the "saved/searches" endpoint and get a list of all Saved Searches. We can use filters on the key names in the dictionary element to reduce the number of entries returned. However, I want to filter based on the <author><name> element: is that possible with the REST API? Ultimately, I'm trying to answer this question with the REST API: what are all the saved searches that are created by a specific user / what are all the saved searches in a specific user's namespace?   References: 1) Example XML output is given in the documentation for "saved/searches": https://docs.splunk.com/Documentation/Splunk/8.0.5/RESTREF/RESTsearch#saved.2Fsearches     ... View more

I need help on doing cumulative percentiles, such as p90, over a period of time. This is different from rolling averages or taking the p90 of individual spans of time. For example, I'm trying to calculate the cumulative, rolling p90 over a month. Here's a table that illustrates what I want: Day # P90 Value Calculation 2020-07-01 (Day 1) p90 of all events on day 1 2020-07-02 (Day 2) p90 of all events on day 1 and day 2 2020-07-03 (Day 3) p90 of all events from day 1 to day 3 ... ... 2020-07-31 (Day 31) p90 of all events during the month (day 1 - 31)   If I wanted to do P90 for individual days, it's very simple:  base_query | timechart span=1d p90(latency). Unfortunately, that's not what I want. There are 100,000+ events each day. I tried using streamstats but didn't get the expected results. I suspect that this is because streamstats only has a maximum window size of 10,000 events. My failed approach to using streamstats was to take the cumulative p90 of every event over a time period, and then return the final event of each day in that period:  base_query | bin span=1d _time as day | streamstats p90(latency) as p90latency | dedup 1 day | sort by _time | table _time, p90latency     Can anyone show me how to do a cumulative p90 in Splunk? I'm using an imperfect workaround of cumulative weighted average p90 values, but it's just an approximation and I'd like to have the real deal instead. ... View more