Hello all,  since our Update to Splunk Enterprise 9.0.2 we experienced, that the Dashboard colors (Simple XML) changed completely. And the new colors are terrible! Did someone experience something similar after the update? And if yes: Were you able to get the colors back to the way they were? On 8.2.2.3   On 9.0.2 I would appreciate every hint. The new colors are something that cannot be presented to management 🙈 Thanks and best Regards   ... View more

Hello, I am experiencing an interesting Issue. I am trying to filter for a specific value in a numeric field. Following statement works finde:         index="IndexA" | eval A.distance=trim('A.distance',"'") | eval A.distance='A.distance'/100 | search A.distance=1         If I am trying to replace the search with a where, I am getting the Error "Error in 'where' command: Type checking failed. The '==' operator received different types."         index="IndexA" | eval A.distance=trim('A.distance',"'") | eval A.distance='A.distance'/100 | where A.distance=1         Event Coverage if this value is 100% and all the values get for typeof() the result "Number". All of the values do not have a digit after the comma. We are using Splunk Enterprise 8.2.3.3 . Does someone know, why the where statement is yielding an error in this case? Thanks ... View more

Hello,  i have a question regarding the usage of the results of a join within an eval if. I have a couple of responses, to which I am joining their preceeding requests (written in another source)   index="index1" sourcetype="sourcetype1" Response... |table rcvTime Command |join type=left left=response right=request usetime=true earlier=true where response.ID=request.ID [search index="index2" sourcetype="sourcetype2" Request ....|table rcvTime Command|sort _time-]   The issue is, that sometimes I get a wrong match, hence a request, that is not connected to the response and was a few days ago. The reason, why they are matched, is because it is the same device ID.  Thats why I am trying to have an eval for the timediff. If I am using the variable request.command within the if, I will receive empty results:   index="index1" sourcetype="sourcetype1" Response... |table rcvTime Command |join type=left left=response right=request usetime=true earlier=true where response.ID=request.ID [search index="index2" sourcetype="sourcetype2" Request ....|table rcvTime Command|sort _time-] |....(commands calculating timediff) | request.command=if(timediff<300,request.command,"")   If I am saving the value within a field that contains no point in the name, it works properly:   index="index1" sourcetype="sourcetype1" Response... |table rcvTime Command |join type=left left=response right=request usetime=true earlier=true where response.ID=request.ID [search index="index2" sourcetype="sourcetype2" Request ....|table rcvTime Command|sort _time-] |....(commands calculating timediff) |rename requestCommand as request.command | requestCommand=if(timediff<300,requestCommand,"")   Does someone have an idea, why I cannot use request.command within the eval (but on other commands I can use it)? Thanks and best Regards ... View more