I like to use split below but I will try your rex as well . Thanks alot  | eval dashboard_visit_name=mvindex(split(dashboard_visit_name, ":"),2) ... View more

@richgalloway  Thanks for the help , very useful I finished the report i needed 🙂 ... View more

Thank you for the kind reply. We have an elasticsearch setup without authentication and without Certificates so I tried to comment stanza as you suggest use_ssl = 0 # opt_ca_certs_path = but no success 😞   Than i decided to go into the python scripts and try to comment out the cert(strip) line   /opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/input_module_elasticsearch_json.py #opt_ca_certs_path = opt_ca_certs_path.strip()     Now I get another SSL  Error in log : 2025-06-11 12:00:03,503 ERROR pid=2813813 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/ta_elasticsearch_data_integrator_modular_input/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/elasticsearch_json.py", line 96, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/input_module_elasticsearch_json.py", line 153, in collect_events results = search_index(opt_elasticsearch_instance_url, opt_port, opt_user, opt_secret, opt_elasticsearch_indice, opt_date_field_name, opt_time_preset, size, from_number, opt_ca_certs_path) File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/input_module_elasticsearch_json.py", line 102, in search_index response = client.search(**search_params, scroll="1m") File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/ta_elasticsearch_data_integrator_modular_input/elasticsearch/_sync/client/utils.py", line 414, in wrapped return api(*args, **kwargs) File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/ta_elasticsearch_data_integrator_modular_input/elasticsearch/_sync/client/__init__.py", line 3859, in search return self.perform_request( # type: ignore[return-value] File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/ta_elasticsearch_data_integrator_modular_input/elasticsearch/_sync/client/_base.py", line 285, in perform_request meta, resp_body = self.transport.perform_request( File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/ta_elasticsearch_data_integrator_modular_input/elastic_transport/_transport.py", line 329, in perform_request meta, raw_data = node.perform_request( File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/ta_elasticsearch_data_integrator_modular_input/elastic_transport/_node/_http_urllib3.py", line 199, in perform_request raise err from None elastic_transport.TlsError: TLS error caused by: TlsError(TLS error caused by: SSLError([SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:1161))) If anyone managed to onboard elasticsearch data without authentication or certificate validation please adivse  ... View more

Hello we are trying to implement without authentication and we have the same error, here is my stanza please adivse if there is some mistake :   [elasticsearch_json://TEST_INPUT] cust_source_type = elastic-msgs-sms date_field_name = timestamp elasticsearch_indice = msgs-sms-v1.0-* elasticsearch_instance_url = vlelasp-fe-vip.at index = main interval = 60 port = 9200 secret = time_preset = 24h user = disabled = 0     ERROR FROM LOGS : 2025-06-10 12:21:15,012 ERROR pid=1333302 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/ta_elasticsearch_data_integrator_modular_input/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/elasticsearch_json.py", line 96, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/input_module_elasticsearch_json.py", line 147, in collect_events opt_ca_certs_path = opt_ca_certs_path.strip() AttributeError: 'NoneType' object has no attribute 'strip' ... View more

He has them  but still there is error, is there anything on the conf files: accelerate_search bulk_import_service_or_entity change_own_password configure_mltk_container configure_perms control_mltk_container delete_drift_detection_results delete_itsi_correlation_search delete_itsi_custom_threshold_windows delete_itsi_data_integration delete_itsi_deep_dive delete_itsi_deep_dive_context delete_itsi_drift_detection_template delete_itsi_event_management_export delete_itsi_event_management_state delete_itsi_glass_table delete_itsi_homeview delete_itsi_kpi_at_info delete_itsi_kpi_base_search delete_itsi_kpi_entity_threshold delete_itsi_kpi_state_cache delete_itsi_kpi_threshold_template delete_itsi_notable_aggregation_policy delete_itsi_notable_event_email_template delete_itsi_refresh_queue_job delete_itsi_sandbox_service delete_itsi_service delete_itsi_temporary_kpi delete_maintenance_calendar delete_module_interface delete_notable_event edit_log_alert_event edit_own_objects edit_search_schedule_window edit_sourcetypes edit_statsd_transforms edit_token_http embed_report entities_at_configurations_get execute-notable_event_action execute_notable_event_action export_results_is_visible get_drift_detection_kpis get_drift_detection_results get_metadata get_typeahead input_file interact_with_itsi_correlation_search interact_with_itsi_deep_dive interact_with_itsi_deep_dive_context interact_with_itsi_event_management_state interact_with_itsi_glass_table interact_with_itsi_homeview interact_with_itsi_notable_aggregation_policy kpis_at_configurations_get list_accelerate_search list_all_objects list_health list_inputs list_metrics_catalog list_mltk_container list_search_head_clustering list_settings list_storage_passwords list_tokens_own metric_alerts output_file pattern_detect read-notable_event read-notable_event_action read_itsi_backup_restore read_itsi_base_service_template read_itsi_correlation_search read_itsi_custom_threshold_windows read_itsi_data_integration read_itsi_deep_dive read_itsi_deep_dive_context read_itsi_drift_detection_template read_itsi_entity_discovery_searches read_itsi_entity_management_policies read_itsi_event_management_export read_itsi_event_management_state read_itsi_glass_table read_itsi_homeview read_itsi_kpi_at_info read_itsi_kpi_base_search read_itsi_kpi_entity_threshold read_itsi_kpi_state_cache read_itsi_kpi_threshold_template read_itsi_notable_aggregation_policy read_itsi_notable_event_email_template read_itsi_refresh_queue_job read_itsi_sandbox read_itsi_sandbox_service read_itsi_sandbox_sync_log read_itsi_service read_itsi_team read_itsi_temporary_kpi read_maintenance_calendar read_metric_ad read_module_interface read_notable_event read_notable_event_action request_remote_tok rest_access_server_endpoints rest_apps_view rest_properties_get rest_properties_set rtsearch run_collect run_custom_command run_dump run_mcollect run_msearch run_sendalert schedule_rtsearch schedule_search search search_process_config_refresh upload_lookup_files upload_onnx_model_file write-notable_event write_itsi_correlation_search write_itsi_custom_threshold_windows write_itsi_data_integration write_itsi_deep_dive write_itsi_deep_dive_context write_itsi_drift_detection_template write_itsi_event_management_export write_itsi_event_management_state write_itsi_glass_table write_itsi_homeview write_itsi_kpi_at_info write_itsi_kpi_base_search write_itsi_kpi_entity_threshold write_itsi_kpi_state_cache write_itsi_kpi_threshold_template write_itsi_notable_aggregation_policy write_itsi_notable_event_email_template write_itsi_refresh_queue_job write_itsi_sandbox write_itsi_sandbox_service write_itsi_sandbox_sync_log write_itsi_service write_itsi_temporary_kpi write_maintenance_calendar write_metric_ad write_module_interface write_notable_event     ... View more

same issue for me i have 3 panels with 22 servernames each that i want to have per 1 page.. splunk should expand the trelis and single value visualization options like add pages per view.. please let me know if there is an XML option in the panel or html code to increase the default 20 units per page ... View more

is there any update on this topic as per 2025 ? Does anyone have an example script which sends SMS please? ... View more

After consulting with team we are currently unavailable to upgrade version and need to stay on version 9.3.2. Is there any workaround for the German Umlauts to display on older version 9.3.2.. maybe some option we can add in the source code? ... View more

We are currently  using Splunk Enterprise Version: 9.3.2, not latest  I am testing with other svgs  font families in the xml and such but the result is the same :   I will communicate with the team for upgrade request if you are certain this feature was hotfixed. ... View more

thank you so much for assistance, we will try if we can implement it within inputs.conf ... View more

We are using Splunk Enterprise Version: 9.3.1 and we need it for Classic Dashboard  What I managed to put together is this : <html> <style type="text/css"> table tr:nth-child(odd) td{color: red; } table tr:nth-child(even) td{color: green; } </style> </html> It looks like this :       What I actually need is to Select rows Containing  INFO / ERROR / WARNING and color them RED , BLUE , YELLOW ... View more

thanks but this colors the background of the cell i need to color the font only ... View more

I need help coloring rows FONT text based on a cell value  Logic is like below  case(match(value,"logLevel=INFO"),"#4f34eb",match(value,"logLevel=WARNING"),"#ffff00",match(value,"logLevel=ERROR"),"#53A051",true(),"#ffffff") ... View more

Is it possible to color the FONT text of the row not the background please ?? I need it done soon as such.   logLevel : INFO -> Blue logLevel : WARRNING -> Yellow logLevel : ERROR -> Red   <format type="color"> <colorPalette type="expression"> if(match(value,"logLevel=INFO"),"#4f34eb",null), if(match(value,"logLevel=WARNING"),"#ffff00",null), if(match(value,"logLevel=ERROR"),"#53A051",null) </colorPalette> </format>   ... View more

Hello all, This thread was very helpful to me and i described my picked time period in the dashboard panel description .  I used the progress tag :   <eval token="a1_jobEarliest">strptime($job.earliestTime$,"%Y-%m-%d_%H:%M:%S")</eval> <eval token="a1_jobLatest">strptime($job.latestTime$,"%Y-%m-%d_%H:%M:%S")</eval> <set token="a1_jobEarliest">$job.earliestTime$</set> <set token="a1_jobLatest">$job.latestTime$</set> However I still get formatting details that I dont need ( underlined in blue are miliseconds) :       ... View more

Sadly its still not working all is colored red as the last defined one:   <format type="color"> <colorPalette type="expression"> case(match(value,"logLevel=INFO"),"#4f34eb",match(value,"logLevel=WARNING"),"#ffff00",match(value,"logLevel=ERROR"),"#53A051") </colorPalette> </format>   ... View more

Veryy helpful! Thx! My case is with three conditions , can you help me color different cases as such please? LogLevel : INFO -> Blue LogLevel : WARRNING -> Yellow LogLevel : Error -> Red   What I come up with is below but not working   😞  <format type="color"> <colorPalette type="expression"> if(match(value,"logLevel=INFO"),"#4f34eb",null), if(match(value,"logLevel=WARNING"),"#ffff00",null), if(match(value,"logLevel=ERROR"),"#53A051",null) </colorPalette> </format>   ... View more

So far pretty useful to my dashboard but do you know how to add conditions  as such :   LogLevel : INFO -> Blue LogLevel : WARRNING -> Yellow LogLevel : Error -> Red ... View more