Hi guys! I need a help with a time problem. So  my structure is the following: i have many agent installed  on Windows machine that collects some data , i have a heavy forwarder thant handles the universals and forward data to an enterprise instances.  My issue is that one of the server where the universal is installed has a time different from the other machine and from the heavy forwarder, in particular -1h .  So when i use search and alerts in real_time or in 5/10 minutes range i miss all the events related to that machine. I would like all events to take as _time the system time of the enterprise instances (index_time)  or at least the heavy forwader system time.  I tried to change the props.conf and inserting date_config = current at every level but nothing change. It's ok also to have a custom configuration that add + 1h to that specif host  as long as the _time field is alligned with other machine.   Some assumption: All the machine are in the same country, the particular machine has different clock setting and can't be changed. The event that generates the universal contain always a timestamp of the specif machine but we don't want it as _time.  ... View more

Hi guys, I'm trying to show a table where in one colums there will be some icons based on the cell value. I used the examples provvided from the Splunk dashboard example App.  the problem I'm experiencing is that if i load the dashboard the table is rendered with the string , but if i switch to edit mode then the table is rendered correctly with the icons.  Reloading the page will render the table without icons and anytime i go trough the edit mode the table renders with icons.       <dashboard version="1.1" stylesheet="css/test.css" script="js/test.js"> <label>test</label> <row> <panel> <table id="table1"> <search> <query>| inputcsv thermal_structure.csv | eval range = case(status=="ok","low",status=="warning","elevated",status=="no","severe") | table zone,range</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </dashboard> /* Custom Icons */ td.icon { text-align: center; } td.icon i { font-size: 25px; text-shadow: 1px 1px #aaa; } td.icon .severe { color: red; } td.icon .elevated { color: orangered; } td.icon .low { color: #006400; } /* Row Coloring */ #highlight tr td { background-color: #c1ffc3 !important; } #highlight tr.range-elevated td { background-color: #ffc57a !important; } #highlight tr.range-severe td { background-color: #d59392 !important; } #highlight .table td { border-top: 1px solid #fff; } #highlight td.range-severe, td.range-elevated { font-weight: bold; } .icon-inline i { font-size: 18px; margin-left: 5px; } .icon-inline i.icon-alert-circle { color: #ef392c; } .icon-inline i.icon-alert { color: #ff9c1a; } .icon-inline i.icon-check { color: #5fff5e; } /* Dark Theme */ td.icon i.dark { text-shadow: none; } /* Row Coloring */ #highlight tr.dark td { background-color: #5BA383 !important; } #highlight tr.range-elevated.dark td { background-color: #EC9960 !important; } #highlight tr.range-severe.dark td { background-color: #AF575A !important; } #highlight .table .dark td { border-top: 1px solid #000000; color: #F2F4F5; } requirejs([ '../app/simple_xml_examples/libs/underscore-1.6.0-umd-min', '../app/simple_xml_examples/theme_utils', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, themeUtils, mvc, TableView) { // Translations from rangemap results to CSS class var ICONS = { severe: 'alert-circle', elevated: 'alert', low: 'check-circle' }; var RangeMapIconRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { // Only use the cell renderer for the range field return cell.field === 'range'; }, render: function($td, cell) { var icon = 'question'; var isDarkTheme = themeUtils.getCurrentTheme() === 'dark'; // Fetch the icon for the value // eslint-disable-next-line no-prototype-builtins if (ICONS.hasOwnProperty(cell.value)) { icon = ICONS[cell.value]; } // Create the icon element and add it to the table cell $td.addClass('icon').html(_.template('<i class="icon-<%-icon%> <%- range %> <%- isDarkTheme %>" title="<%- range %>"></i>', { icon: icon, range: cell.value, isDarkTheme: isDarkTheme ? 'dark' : '' })); } }); mvc.Components.get('table1').getVisualization(function(tableView) { // Register custom cell renderer, the table will re-render automatically tableView.addCellRenderer(new RangeMapIconRenderer()); }); });         ... View more

  Hello guys! I need a help with some dashboards, basically i dont even know if what i have to do is possibile or not... I have a choroplet map where countries are colored based on a status field using geom command..(i have attached an example). When a user click on one of the colored country, a new dashboard  should appear with a new map of the country selected. In this map i have to put based on lat and lon (that i have) some icons with a specific color. ( icons an color are base on two fields. I'm struggling just for charting only a country map and not the entire planisphere, but i do noyhave also idea if its possible to put custom icon on it. Thanks in advance for anyone who can help! Below an example of the table that i have for doing the second dashboard Country (select by the user from the first dashboard) Lat Lon Icon Type Icon Color Italy number number ballon red Italy number number umbrella yellow ... View more

Hello, I have a strange behavior with one of my panel where i have a clustered map. Pratically i have two imput panel, one that permit the selection of a country, and the second one who permit the selection of a city. Depending on the city select i have two tokens that saves the respecting lat and lgt of the city, and then in the xml source i give this two toker for centering the map. Pratically the result is blank, but if during editing before saving i go the source tab then the visualization works. But then if i refresh the page the map doesn't appear anymore. Hero the code that i'm using: <search> <query>| inputlookup Worldcities.csv       | search city = $Area$ | dedup city </query> <done> <set token="lat">$result.lat$</set> <set token="lng">$result.lng$</set> <set token="zoom">7</set> </done> </search> <fieldset submitButton="false"> <input type="dropdown" token="country"> <label>Country</label> <fieldForLabel>name</fieldForLabel> <fieldForValue>name</fieldForValue> <search> <query>| inputlookup Country.csv | search name= Spain OR name = Italy</query> <earliest>-15m</earliest> <latest>now</latest> </search> <default>Italy</default> </input> <input type="dropdown" token="Area" searchWhenChanged="true"> <label>Area</label> <fieldForLabel>city</fieldForLabel> <fieldForValue>city</fieldForValue> <search> <query>| inputlookup Worldcities.csv | search country = $country$ | dedup city</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <default>Milan</default> </input> </fieldset> <map> <search> <query>(query that gives me the value needed) | geostats latfield=Latitude longfield=Longitude globallimit=0 maxzoomlevel=13 translatetoxy=false count by test</query> <earliest>-24h@h</earliest> <latest>now</latest> <refresh>30s</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="mapping.map.center">($lat$,$lng$)</option> <option name="mapping.map.zoom">7</option> <option name="mapping.type">marker</option> <option name="refresh.display">progressbar</option> </map> Is something wrong with the code or it's just a bug?  Thank you ... View more