Something like this then: #panel_name th:nth-child(6), #panel_name th:nth-child(7) { background-color: yellow !important; } ... View more

sourcetype=e143_csv, index="L134521_e143", PROCESS_ID = "FileDelivery" FREQ="DAY" | rex field=PROCESS_NAME "(?P<Process>.*)for" | eval Process=if(Process="Daily AHS Instrument File ","Daily AH",Process) | eval Process=if(Process="Daily Position File ","Daily Po",Process) | eval Process=if(Process="Daily Credit Risk Info File ","Daily Risk",Process) | eval Process=if(Process="Daily CB File ","Daily File",Process) | eval Process=if(Process="Daily Instrument File ","Daily Instrum",Process) | table Process, START_TIME, FINISH_TIME, RELATED_GRS_UNIT_ID | sort -START_TIME, -FINISH_TIME, -Process, -RELATED_GRS_UNIT_ID | dedup RELATED_GRS_UNIT_ID, Process sortby -FINISH_TIME | xyseries Process, RELATED_GRS_UNIT_ID, FINISH_TIME | transpose 0 header_field=Process | eval "Daily Po" = if('Daily AH' <= 'Daily Po', 'Daily Po', null()) | eval "Daily Risk" = if('Daily AH' <= 'Daily Po' AND 'Daily Po' <= 'Daily Risk', 'Daily Risk', null()) | eval "Daily File" = if('Daily AH' <= 'Daily Po' AND 'Daily Po' <= 'Daily Risk' AND 'Daily Risk' <= 'Daily File', 'Daily File', null()) | eval "Daily File" = if('Daily AH' <= 'Daily Po' AND 'Daily Po' <= 'Daily Risk' AND 'Daily Risk' <= 'Daily File', 'Daily File', null()) | eval "Daily Instrum" = if('Daily AH' <= 'Daily Po' AND 'Daily Po' <= 'Daily Risk' AND 'Daily Risk' <= 'Daily File' AND 'Daily File' <= 'Daily Instrum', 'Daily Instrum', null()) ... View more

Edit -> Source then there is attributes for panel heights. Just update those to the same value. Depending on visualisation it's name could be a little bit different and without changing panels size before hand, It could be missing there. ... View more

Hi @Edwin1471, sorry I made an erro, it isn't a good idea to have spaces or special chars in field names: | eval finish_time_epoch = strftime(strptime(FINISH_TIME, "%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S") | eval start_time_epoch = strftime(strptime(START_TIME, "%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S") | eval duration_s = strptime(FINISH_TIME, "%Y-%m-%d %H:%M:%S") - strptime(START_TIME, "%Y-%m-%d %H:%M:%S") | eval duration_min = round(duration_s / 60, 2) | rename duration_min AS Completion_time | eval Process=if(Process="013","2.1 Main calculation",Process) | eval Process=if(Process="014","2.2 Main calculation",Process) | table Process, 2.START_TIME, 3.FINISH_TIME , 4.Completion_time | sort -START_TIME, -FINISH_TIME | sort +Process | transpose 0 header_field=Process column_name=Process | dedup Process | rename "2.1 Main calculation" AS 21_Main_Calculation "2.2 Main calculation" AS 22_Main_Calculation | eval 2_Main_Calculation=case(Process="2.START_TIME",21_Main_Calculation, Process="3.FINISH_TIME", 22_Main_Calculation, Process="4.Completion_time",21_Main_Calculation+22_Main_Calculation) | rename 2_Main_Calculation AS "2.Main Calculation" | table Process "2.Main Calculation" Ciao. Giuseppe ... View more

YOu can do something like this (if Process value is 0141, change it to 0512 else keep the original value) | eval Process=if(Process="0141","0512",Process)    ... View more

Hi @Edwin1471, yes all the requirememts you listed are possible and not difficoult to implement, but it's difficoult without any information on your data. Could you share some sample of your data? Anyway, supponing that in each event you have all the fields (scheduled, via, flight, status), you could run a search like the following:   index=your_index | stats values(scheduled) AS scheduled values(via) AS via values(status) As status BY flight | table scheduled via flight status | sort scheduled   About autorefresh, you have to set in the dashboard this parameter. If you're using Dashboard Studio see at https://community.splunk.com/t5/Dashboards-Visualizations/How-to-set-up-the-auto-refresh-on-a-dashboard-in-Splunk/td-p/574319 If you're using Dashboard Classic, you have to insert in the first row   <form refresh="30">   For the colours, you should use the gui options in the panel's columns and assign the colours you like to the possible values Ciao. Giuseppe   ... View more

Hi @Edwin1471, if "time" is the duration expressed in minutes, you have to add at the end of your search an eval statement like the following: | eval time_hours=round(time/60,0), time_min=round(time-time_hours*60,0), time_sec=round((time-time_hours*60-time_min)*60,0) | eval time=time_hours." h ".time_min." m ".time_sec Ciao. Giuseppe ... View more

Try this | eval finish_time_epoch = strptime(FINISH_TIME, "%Y-%m-%d %H:%M:%S") | eval start_time_epoch = strptime(START_TIME, "%Y-%m-%d %H:%M:%S") | eval duration = finish_time_epoch - start_time_epoch | stats sum(duration) as duration by finish_time_epoch | sort - finish_time_epoch | eval TimeDate=strftime(finish_time_epoch, "%Y-%m-%d %H:%M:%S") | eval duration=tostring(duration,"duration") | table duration TimeDate ... View more