Hello, better way to reduce the size of index is to reduce retention period, or some other parameter of index configuration. You need splunk admin rights. Some info from the documentation: Use these indexes.conf settings to configure data retention policies for a SmartStore index: maxGlobalDataSizeMB maxGlobalRawDataSizeMB frozenTimePeriodInSecs I hope it helps you Regards ... View more

Hi danielbb, You can try | tstats count where index=wineventlog* TERM(EventID=*) by _time span=1m But in the _raw event, you must have something which corresponds, like ...EventID=4624... Then, if you want to use this EventID in the group by, you can try (be carefull The text you provide for the PREFIX() directive must be in lower case) | tstats count where index=wineventlog* TERM(EventID=*) by PREFIX(eventid=) _time span=1m Regards ... View more

Hello, not sure this was solved. However, I had the same problem, and managed to remove the link by checking Type "plain text" in the Edit PDF Schedule window. The link desappeared... Hope it helps. BR Nordine ... View more

Hello, I have the same issue, since one month now. All my scheduled pdf delivery, which were fine before, are showing now empty graphs. Only tables are visible in the pdf export. Does any one know what would be the issue? Thanks in advance Best resgards ... View more

Hello, depending on number of slices you are showing and their value, in your graph, what will help is to use  following options <option name="charting.chart.sliceCollapsingThreshold">0</option> or minimum size in the UI and increase the height of the graph itself, using <option name="height">1000</option> option. before with height=500   After with <option name="height">1000</option> and  <option name="charting.chart.sliceCollapsingThreshold">0</option>   Regards Nordine   ... View more

Hello Chris, in the same way, I would like to know if it is possible to color the node(from or to), when using the link rows? Thank you BR Nordine ... View more

Hello, Thanks a lot! It worked for me with Pie Chart label   Regards ... View more