I need to set a token on the green marker displayed on the map. The search includes the fields REGION, latitude, longitude, and status. Whenever a user clicks on a marker, the corresponding token should be set, and any panel that uses this token should become visible.    Below is my source code, {   "type": "splunk.map",   "title": "Active Alert in Map View",   "dataSources": {     "primary": "ds AFMPLT"   },   "options": {     "layers": [       {         "type": "marker",         "data": "primary",         "latitude": "> primary | seriesByName('latitude')",         "longitude": "> primary | seriesByName('longitude')",         "size": 12,         "fields": {           "REGION": "> primary | seriesByName('REGION')",           "STATUS": "> primary | seriesByName('status')"         },         "dataColors": "> primary | seriesByName('status') | matchValue(colorMatchConfig)",         "additionalTooltips": [           "REGION",           "STATUS"         ],         "resultLimit": 1000       }     ],     "center": [       47.31597438587,       19.366742195838     ],     "zoom": 1.53,     "showZoomControls": false,     "showScale": false   },   "context": {     "colorMatchConfig": [       {         "match": "Healthy",         "value": "#00FF00"       },       {         "match": "Critical",         "value": "#FF0000"       },       {         "match": "No Data",         "value": "#808080"       }     ]   },   "eventHandlers": [     {       "type": "drilldown.setToken",       "options": {         "tokens": [           {             "token": "REGION",             "key": "row.REGION"           }         ]       }     }   ],   "containerOptions": {},   "showProgressBar": false,   "showLastUpdated": false } ... View more

I have a radial guage panels in my splunk dashboard, i am noticing bit weird thing were the color changing is working for all panels except for one which is 'PROCESSOR' and sometimes all panel will change to white background, but my requirement is to have the blue background like rest of the other panels Could anyone please help me how  i can solve this issue.   ... View more

Hi,  i have the below table data where i have timecharted for 1hr time span i want to remove the row which is in red colour as it is coming with different time when compare to other data.  can i be using outlier command to perform this operation and how i can achieve this requirement. Thank you in advance,  _time B C D E F 2023-10-06 22:00             2023-10-07 22:00             2023-10-08 22:00             2023-10-09 09:00             2023-10-09 22:00             2023-10-10 09:00             2023-10-10 22:00             2023-10-11 22:00             ... View more

we have a search which is feeding data to kv store lookup let say lookup name 'sample_test'. now i want to run a weekly scheduled search that will compare the index source data and the data in 'sample_test' and remove the entire row from the kv store lookup which are not in index source data. Example: KV store data ('sample_test') X Y Z a A 1 b B 2 c C 3 d D 4 e E 5 Index Source Data X Y Z a A 1 b B 2 c C 3 d D 4 So ideally, when compare to above 2 tables last row in the kv store lookup in not present my source data i need to run a weekly scheduled search to remove that last row from the KV store. It would be more helpful if anyone can help me to resolve this issue. Happy Splunking!! ... View more

I need to know how we can pause the search for 30 seconds and then run the saved search  for example, i have a search scheduled at 9:30:00 my requirement is that the search should pause for 30 seconds and run at 9:30:30 seconds.  It would be more helpful if anyone help me in resolving this!! happy Splunking!! ... View more

In the below dashboard table, I need to set colour condition of 2 columns that is is expected difference and sla_difference. if expected_difference Is negative it should show in red colour if it is positive it should show in green colour. same as for sla_difference if it is negative it should be orange if it is positive it should show in green.     ... View more